The UK Cyber Security and Resilience Bill: Preparing as a Data Centre Operator

Designation is not the moment you start preparing. It is the moment the clock starts, and the capabilities it demands take months to build. If you run a data centre and you wait to be named, you will be building an incident-reporting pipeline and a supply-chain evidence base under a deadline you no longer control.

The Cyber Security and Resilience (Network and Information Systems) Bill was introduced to the House of Commons on 12 November 2025 and has been working through Parliament since. It does not replace the Network and Information Systems Regulations 2018; it amends and widens them, and it takes powers for the Secretary of State to keep amending them by secondary legislation. The headline for our sector is simple: data centres are being brought into scope for the first time, alongside managed service providers and certain critical suppliers. Much of the operational detail will land in regulations and regulator guidance rather than the Bill itself, so specific numbers should be verified against the final Act and the codes that follow it. But the direction is settled enough to prepare against now.

If you want the general shape of the reform first, we have covered what the Bill means for your business separately. This piece is narrower and more practical: it is a readiness playbook for the operator who has worked out they are probably in scope and wants an ordered set of actions before the letter arrives.

Work out whether you are in scope, and stop guessing

The Bill draws the line by capacity. As currently drafted, an enterprise data centre run for a single organisation’s own use falls in scope at a rated IT load of 10 megawatts or more, while a colocation facility serving multiple customers is caught at 1 megawatt or more. The lower threshold for colocation reflects a policy judgement that shared facilities carry concentration risk that single-tenant sites do not. Those figures are the ones to watch through the Bill’s remaining stages, because thresholds are exactly the kind of detail that moves in committee or gets settled in regulations.

Do the arithmetic on your actual estate now, per site, on rated IT load rather than gross facility draw. If you sit close to a threshold, assume you are in and prepare accordingly. The cost of preparing for a designation that never comes is a stronger security posture. The cost of assuming you are out and being wrong is a scramble.

Stand up the incident-reporting pipeline first

This is the capability that takes longest and matters most. The regime is built around a two-stage duty: an initial notification of a significant incident within 24 hours of becoming aware of it, and a fuller report within 72 hours. Ofcom is expected to act as the regulator receiving these reports for data centres, with the Information Commissioner covering managed service providers. There is also a duty to inform customers likely to be adversely affected as soon as reasonably practicable.

A 24-hour clock is a systems problem before it is a compliance one. It means you can detect a significant incident, decide within hours that it meets the reporting threshold, and produce a first notification with real content — not a holding line. Most operators cannot do this today because the pieces sit in different places: monitoring in the SOC, the decision to escalate somewhere between security and legal, the customer-notification list in an account-management spreadsheet nobody has tested. The work is to connect them into one path with named owners, a written severity threshold, and pre-drafted notification templates that map to what the regulator will ask for.

The mechanics of this are not unique to data centres. We set out the general approach in building the incident-reporting pipeline for the UK’s operational and third-party rules, and the same discipline applies: instrument the detection, fix the decision point, rehearse the clock. Run a tabletop against the 24-hour deadline before you are designated, because the first time you discover your escalation path has a gap should not be during a real incident that a regulator is now entitled to hear about.

Assemble supply-chain security evidence you can hand over

The Bill’s widening of scope to critical suppliers signals where supervisory attention is going. A data centre is a supply-chain node for everyone it hosts, and it sits on top of its own chain: hardware vendors, remote-management and DCIM platforms, cooling and power controllers, connectivity providers. Being able to demonstrate that you manage security across that chain is the second capability to build, and it is an evidence problem more than a policy one.

Concretely, that means a current inventory of the suppliers whose failure or compromise would materially affect the security or continuity of the service you provide; the contractual security terms you hold with each; and a record of how you assess and monitor them, not just a statement that you do. Operational-technology suppliers — the building-management and power systems that a purely IT-focused review tends to skip — belong in this inventory, because they are exactly the route into a facility that a purely IT-focused review misses. Where your suppliers are themselves product vendors, the same evidence they must produce under the EU Cyber Resilience Act is evidence you can demand and hold on file, which turns two regimes into one artefact.

Close the governance gaps designation will expose

Designation brings duties that assume an accountable organisation, not just a technical one. Expect to have to register with the regulator and keep your details current — the working expectation is a notification duty within around three months of being designated, and a requirement to nominate a UK representative if you are established outside the country. Behind that sits the substance: someone at board level who owns the regime, a risk-management approach proportionate to the service, and the ability to show your working when asked.

These are the gaps that do not appear on a security dashboard. They surface when a regulator asks who is accountable, where the decision to report was recorded, and how the last supplier review was conducted. An honest internal read against those questions — before anyone external asks them — is the cheapest work in this whole exercise.

The order of operations

1. Confirm scope per site against the current thresholds, and treat anything close to the line as in.
2. Build and rehearse the 24-hour / 72-hour reporting pipeline end to end, with named owners and tested customer-notification lists.
3. Assemble the critical-supplier inventory and the security evidence for each, operational technology included.
4. Assign board-level accountability and prepare to register within the designation window.

None of this depends on the Bill’s final wording. It is the readiness that designation will require whatever the last amendments do to the numbers. The operators who come out of this well are the ones who built the pipeline while the deadline was still theirs to set.