The UK’s long-awaited Cyber Security and Resilience (Network and Information Systems) Bill passed its Second Reading in the House of Commons on 6 January 2026. This is an important milestone because it signals stronger expectations for cyber resilience across the UK economy.
The Bill was introduced to Parliament on 12 November 2025. It aims to modernise the UK’s cyber defence laws by updating the existing Network and Information Systems (NIS) Regulations. It also gives regulators stronger powers to protect critical services and the wider economy from escalating cyber threats.
For organisations of every size, one message is becoming clear: it will no longer be enough to say you are secure. Organisations will increasingly be expected to demonstrate resilience through measurable evidence and clear reporting.
Take the first step by completing your NIST 2.0 self-assessment today.
MPs raise concern over weak board-level cyber focus
During the parliamentary debate, Dame Chi Onwurah MP, Chair of the Science, Innovation and Technology Committee, warned that many businesses still fail to take cyber risk seriously, particularly at the leadership and board level.
She referenced research indicating that only 56% of IT professionals believe their board prioritises cybersecurity. This highlights a significant accountability gap at a time when cyber incidents can disrupt entire sectors and have wide economic impacts.
Bill expands rules to cloud and data centres
One of the Bill’s most significant proposals is expanding its scope to cover more digital service providers, including cloud platforms and data centres, which now underpin almost every business service.
This shift is important because when shared infrastructure providers are attacked, disruption does not stop at one organisation. It can spread rapidly across supply chains, industries, and public services, amplifying the impact of a single incident.
Warning: many major employers could still be out of scope
While the Bill is a major step forward, commentators, including ISACA, have cautioned that it may still leave many large private-sector organisations outside formal regulation, even though they are highly digitised and vulnerable to attack.
This is why cyber governance, resilience, and measurable assurance are quickly becoming expectations not only from regulators, but also from customers, insurers, auditors, and supply-chain partners.
The new business reality: cyber resilience must be measurable and provable
As cyber regulation expands, organisations are increasingly being asked whether they can show evidence of their cybersecurity posture, report gaps clearly, demonstrate year-on-year progress, and prove that customers and partners can trust their security governance.
In this environment, structured and framework-aligned assessments are becoming essential. Organisations must be able to translate cybersecurity activity into clear, consistent evidence that can be understood by leadership, regulators, customers, and wider stakeholders.
NIST 2.0 Compliant Assessment: Prove your cyber readiness with confidence
Truss Consulting offers a NIST 2.0 Compliant Assessment to help organisations prove their cyber readiness with confidence. The assessment is designed to make cybersecurity self-assessments faster, clearer, and more actionable in response to the growing demand for assurance.
Organisations can complete their NIST 2.0 self-assessment to better understand their cybersecurity posture and provide measurable assurance to partners through a structured process aligned with NIST 2.0.
After the assessment is completed, organisations receive a report with key insights, including their final NIST coverage score by domain. The report also highlights priority gaps and improvement areas, and shows how security priorities align with the organisation’s culture, mission, and operational priorities.
Why this matters now
With stronger cyber legislation progressing through Parliament and regulators gaining broader oversight, organisations should act now to prepare for rising expectations and tougher scrutiny.
Even if an organisation falls out of scope today, customers and partners are already demanding assurance and evidence of cyber resilience. A structured NIST 2.0 self-assessment provides the clarity needed to strengthen governance, communicate security posture credibly, and build trust.
Learn more about the NIST 2.0 Self-Assessment and generate cyber assurance-ready report you can present to your executive team..
