Cyber Security and Resilience Bill Raises the Stakes for Supplier Governance

By Dan Raywood • 13 October 2026 • 6 min read

As the Cyber Security and Resilience Bill (CSRB) progresses through Parliament, proposed new powers could give ministers greater control over the use of potentially risky technologies and suppliers in critical sectors. Dan Raywood looks at what these changes could mean for compliance.

At the time of writing, the Cyber Security and Resilience Bill is at one of its final stages before becoming part of UK law. One significant factor of the Bill, added in recent months, is Section 43, a provision which would give the Secretary of State broad powers to direct regulated organisations to take specific action where a cyber or operational incident, or the threat of one, poses a risk to national security.

In basic terms, this new addition could allow ministers to direct organisations in critical sectors to stop using certain products or services, or modify or remove equipment, where doing so is necessary and proportionate to address a national security risk. However, the government would not necessarily have to publicly identify the supplier or give it an opportunity to respond.

Further amendments proposed in August 2026, would introduce more specific powers relating to potentially risky technology vendors. Under Section 43, organisations could already be directed to change how systems are managed, provide information, restrict or stop the use of particular goods or services, and remove or modify technology.

This can include preventing the use of, or removing, specific goods or services because of risks associated with their supply chains. For in scope organisations, this raises an important question: how well do they understand the suppliers and technologies their essential services depend on, and how prepared would they be if they were required to stop using them?

Critical Supply Chain

The government argues the measures are needed to act before a threat materialises, particularly where suppliers have links to hostile states and could enable espionage, sabotage or disruption.

Ian Kayne, founder at Cyv8, says that the Bill has three levels: if you are part of a critical supply to the UK, “thou must do all of these things”, one of which includes supply chain security.

“Level two has the regulation that tells us what we must do, or control what we must do. The third piece is how do we actually do it, because regulations don’t tell you how to do it; they tell you the objective that you’ve got to achieve. You’ve then got to sit there and know who your suppliers are and what that is.”

He said that the easiest way to comply is to use a proven framework. If businesses follow a framework such as the NCSC’s Cyber Assessment Framework (CAF), he says: “The CAF framework already says you’ve basically got three types of compliance: you’re either not complied, partially complied or fully complied.”

Kayne said that the main takeaway from this amendment was the “formalisation of the tech suppliers”, as the regulators of these critical industries can now determine certain suppliers to fall under their most stringent rules.

“The controls that are being formalised were already there. So, this is not new controls, this is new obligations enforcing existing controls.”

That is the important piece; organisations may already have supplier risk controls in place, but the Bill increases the importance of demonstrating that those controls are effective, and that action can be taken when risks emerge.

Under this ruling, consultation requirements for organisations receiving directions would apply, but these can be set aside on national security grounds. Technology suppliers themselves may not necessarily be consulted or publicly identified, raising questions about transparency and the practical consequences for affected businesses.

Modifying Equipment

The other consideration is about modifying or removing equipment. Imran Nino Eškić, CTO of HyperBUNKER, explains that removing deeply embedded software or systems from company infrastructure is a complex, long-term project rather than a quick fix.

He also believes that if the CSRB proposal passes, CISOs – particularly in utility companies – will need to restructure their operations for an almost immediate migration, which would have a severe impact on infrastructure costs.

“Most of the CISOs will not change anything if they do not have to. But in the era of AI with the cybersecurity and cyber risks, it is constantly ongoing work. You need to learn a lot. You need to change. You need to monitor everything.”

“Also, a lot of companies do not know where their data is, where they have the server. They don’t know their addresses. If they lost it, what is stored on these backups, and they cannot access or find the asset,” he says.

Section 43 of the proposed Bill requires ministers to specify a reasonable period for compliance but does not establish a fixed minimum transition period for removing technology. Eškić argues that this could create uncertainty for organisations managing complex infrastructure, particularly where replacing embedded systems may require significant time and investment.

This makes supplier exit planning and operational resilience closely connected: identifying a risky dependency is one thing, but being able to replace or remove it without disrupting essential services is another.

Flow Down

Another factor of the proposed Section 43 is a significant “flow-down” impact across UK supply chains, extending cybersecurity requirements beyond the organisations directly regulated by the legislation to those further down the chains.

Kayne believes that requirements will increasingly be passed from regulated organisations to their suppliers, and then down to those suppliers’ own third parties, where cybersecurity teams, expertise and budgets are often much more limited.

This could leave smaller organisations facing significant new compliance costs as they are required to demonstrate that they meet the cybersecurity expectations of larger customers.

The challenge will be ensuring these additional expectations genuinely strengthen supply chain resilience, rather than simply passing compliance costs and administrative burdens down to smaller suppliers.

So, what does a good CSRB compliance posture look like with this addition? It starts with understanding which suppliers and technologies an organisation depends on, the risks those dependencies create, and the evidence that those risks are being actively managed.

That means maintaining a supplier inventory with clear criticality classifications, mapping dependencies against essential business services, and continuously monitoring supplier risk. Organisations should also be able to demonstrate how decisions have been made and what action has been taken. Where technology may need to be removed or replaced, contractual exit provisions and tested contingency arrangements become equally important.

While the Bill is still progressing through Parliament, its direction is clear. Supplier governance is not simply about assessing risk when a contract is signed but understanding and managing those dependencies throughout the relationship. For organisations delivering essential services, that includes being prepared for circumstances in which a critical supplier or technology can no longer be relied upon.