Skip to content
The UK’s proposed Cyber Security and Resilience Bill has taken another step forward, with amendments that would give ministers new powers to restrict the use of technology suppliers deemed to present a cyber security risk to critical infrastructure operators.
The latest changes reflect growing concern over supply chain vulnerabilities and the increasing role third-party providers play in the resilience of essential services. While previous discussions around the Bill focused on expanding regulatory requirements and strengthening cyber security standards, the new amendments place greater emphasis on managing risk across connected suppliers and technology partners.
Under the proposed measures, organisations operating within critical sectors could be prevented from using suppliers considered high risk from a cyber security perspective. The move follows heightened scrutiny of supply chain threats and comes as cyber attacks targeting critical infrastructure continue to attract attention from government and regulators.
For business leaders, the update serves as another reminder that cyber resilience is no longer limited to internal systems and controls. Organisations are increasingly expected to understand the security posture of the suppliers, service providers and technology partners they rely on.
The Bill itself continues to progress through Parliament, with the latest amended version published in early September as it moves through the House of Lords. While the legislation has not yet become law, the direction of travel is clear: greater accountability, enhanced oversight of critical suppliers and stronger expectations around cyber resilience across supply chains.
What this means for organisations
Businesses should use this period to review supplier assurance processes, assess critical third-party dependencies and ensure cyber risk management extends beyond their own network perimeter. As regulatory expectations continue to evolve, organisations that have visibility into their supply chain risks are likely to be better positioned to demonstrate resilience and compliance.
Key takeaway: The latest amendments suggest the Cyber Security and Resilience Bill is evolving beyond organisational cyber security requirements and towards a broader focus on securing the supply chains that support the UK’s critical infrastructure.
