Article4 November 202612 min readCyConex Team

The UK's New Cyber Security Law Changes the Question: Can You Prove Resilience?

The Cyber Security and Resilience Bill signals a significant development in UK cyber regulation. But beyond the expanded scope and reporting requirements lies a more fundamental challenge for organisations: demonstrating that their security controls actually deliver the resilience they claim.

Layered illustration of essential services, technical controls and governance connected by data flows, with an orange resilience path highlighted through the stack

The UK is moving towards a more demanding approach to cyber security regulation. The Cyber Security and Resilience (Network and Information Systems) Bill, which completed its passage through the House of Lords on 2 November 2026, proposes significant changes to the regulatory framework protecting the services on which the country depends. Its provisions extend beyond traditional critical infrastructure to address vulnerabilities within managed service providers, data centres and interconnected supply chains.

The Bill has not yet become law. It has returned to the House of Commons for consideration of Lords amendments, and several important requirements will depend on subsequent legislation and regulatory guidance. Nevertheless, the direction is becoming clearer: cyber security is increasingly being treated as a matter of demonstrable operational resilience, rather than simply the existence of documented policies and controls.

For organisations responsible for delivering essential services, and for the suppliers supporting them, this raises an important question. When asked to demonstrate that their cyber security arrangements are effective, will they be able to produce credible, current and independently defensible evidence?

From protecting systems to sustaining services

The UK's Network and Information Systems Regulations 2018 established security and incident-reporting obligations for operators of essential services and certain digital service providers. The proposed legislation builds on that foundation, reflecting a recognition that the dependencies supporting essential services have changed considerably.

An electricity network, healthcare provider or transport operator no longer operates within a neatly defined technological boundary. Its ability to function may depend on external cloud platforms, managed service providers, specialist software, data centres and suppliers several layers removed from the organisation itself. A significant security failure anywhere within that dependency chain can have consequences far beyond the organisation where it originated.

The Bill seeks to address several of these dependencies by expanding regulatory coverage, strengthening incident-reporting arrangements and providing additional powers to regulators and government. Its proposals include a two-stage incident reporting process, with an initial notification within 24 hours and a fuller report within 72 hours for incidents meeting the relevant criteria.

These are important changes, but the broader challenge is not simply determining which organisations are regulated or how quickly an incident must be reported. It is understanding whether those organisations can establish, with reasonable confidence, that the controls protecting their critical services are working.

A documented security management process may provide useful evidence of organisational intent. It does not necessarily establish that the underlying technical measures are implemented correctly, operating consistently or capable of supporting the required service outcomes under adverse conditions.

That distinction matters increasingly when security failures can propagate across complex supply chains.

The problem with compliance as a proxy for security

Most established cyber security frameworks contain sensible requirements. Organisations are expected to manage vulnerabilities, restrict access, protect networks, detect suspicious activity, respond to incidents and recover essential services. Few security professionals would dispute the value of these measures.

The difficulty emerges when demonstrating compliance becomes confused with demonstrating effectiveness.

Consider an organisation that has a comprehensive vulnerability management policy. The policy describes regular scanning, risk-based prioritisation and defined remediation timescales. During an assessment, the document is presented as evidence that vulnerability management has been implemented.

It may be relevant evidence, but what does it actually prove?

It establishes that the organisation has documented its intended approach. It does not, by itself, demonstrate that all relevant assets are included in vulnerability scanning, that critical findings are remediated within the stated timescales, or that exceptions are appropriately authorised and managed.

Establishing those facts requires different evidence: asset inventories, scanner coverage, vulnerability findings, remediation records, exception approvals and potentially technical verification.

The same distinction applies across almost every security discipline. An access control policy does not establish that privileged accounts are appropriately restricted. A backup procedure does not demonstrate that essential services can be restored within their recovery objectives. An incident response plan does not prove that the organisation can detect, contain and recover from a sophisticated attack.

None of this makes policies or documented procedures unimportant. They provide governance, expectations and accountability. But they represent only part of the evidence required to understand whether security outcomes are being achieved.

The existence of a control is not the same as evidence of its effectiveness.

Why the NCSC Cyber Assessment Framework matters

One of the most significant aspects of the government's regulatory direction is its relationship with the National Cyber Security Centre's Cyber Assessment Framework (CAF).

In a parliamentary answer published on 2 November 2026, the government confirmed that proposed future security and resilience requirements for regulated entities would be consistent with the CAF, with an emphasis on clear technical and operational outcomes. Sector regulators would provide guidance on appropriate and proportionate measures for the organisations they oversee.

This is an important distinction because the CAF is fundamentally structured around cyber security and resilience outcomes. Rather than treating compliance as the completion of a generic checklist, it encourages organisations and assessors to consider whether the measures necessary to achieve those outcomes are present and effective.

The CAF's objectives address managing security risk, protecting against cyber attack, detecting cyber security events and minimising the impact of incidents. Its Indicators of Good Practice help organisations and assessors develop a consistent understanding of what achieving those outcomes may look like.

However, an outcome-based framework does not automatically produce outcome-based assurance.

An assessment can still become a documentation exercise if its conclusions are based predominantly on policy statements, interviews and unverified assertions. Conversely, a carefully structured assessment can use technical records, operational data and targeted testing to establish a much stronger evidential basis.

The difference lies not in the framework itself, but in the relationship between requirements, evidence and conclusions.

The missing layer: defensible security evidence

An effective assurance process must answer more than whether evidence exists. It must establish whether that evidence is relevant, sufficiently complete, trustworthy and current.

For each security requirement, assessors need to understand precisely what must be demonstrated. They must then determine which evidence supports the requirement, what limitations apply and whether any material gaps remain.

Take the example of multi-factor authentication. An organisation may state that MFA is enforced for all privileged users. A written policy provides evidence of that expectation, while identity platform configuration records may demonstrate the controls actually configured.

Yet even those records may not be sufficient in isolation. An assessor may need to consider the population of privileged accounts, exclusions, emergency access arrangements, legacy authentication pathways and the period covered by the evidence.

Only by examining these relationships can the assessor reach a defensible conclusion about the security outcome.

The process also needs to preserve traceability. A conclusion should be linked to the underlying evidence and the specific requirement being assessed, allowing reviewers to understand how it was reached. Where evidence is incomplete or contradictory, that uncertainty should be made explicit rather than concealed behind a reassuring compliance status.

This becomes especially important when multiple stakeholders depend on the same assessment. Operational teams need actionable findings, senior management needs a reliable understanding of residual risk, and regulators need sufficient confidence in the conclusions presented.

A simple pass or fail may be convenient for reporting, but it rarely communicates the full quality of the evidence supporting the decision.

Continuous change creates a continuous assurance problem

There is another limitation in traditional cyber security assessment that increasingly deserves attention: time.

An assessment describes an organisation's security position based on evidence available during a particular period. Even where that assessment is technically rigorous, the environment may change almost immediately afterwards.

New assets are deployed, identities are created, cloud services are reconfigured, vulnerabilities are disclosed and supplier dependencies evolve. Any of these changes may invalidate assumptions used to support an earlier assessment conclusion.

A privileged access configuration verified in September may no longer provide the same assurance in November. A previously successful recovery test may become less relevant following a significant architectural change. A supplier assessed as adequately protected may subsequently experience an incident that changes the organisation's exposure.

The traditional response is periodic reassessment. While regular reviews remain valuable, they can create extended periods during which an organisation's reported security position no longer accurately reflects its operating environment.

A more mature approach connects assurance conclusions to the evidence on which they depend. When important evidence changes, the affected controls and outcomes can be identified for reconsideration.

This does not mean that every technical event should trigger a complete reassessment or that automated systems should make regulatory judgements without human oversight. It means that the assurance process should be capable of recognising material change and directing attention towards conclusions that may no longer be justified.

Continuous assurance is therefore not simply more frequent assessment. It is the ability to understand how changes in an organisation's actual security condition affect the confidence that can reasonably be placed in its assessed outcomes.

The implications extend beyond regulated organisations

Although the Bill is focused on defined categories of essential and digital services, its practical significance may extend further through commercial and operational relationships.

An organisation might fall outside the direct scope of the legislation while supplying technology or services to a regulated customer. That customer may still need sufficient assurance that its suppliers are managing the risks associated with their services.

This can create additional evidence requests, contractual security obligations and scrutiny of third-party dependencies. Organisations that can demonstrate their security arrangements through structured, credible evidence may be better positioned to respond than those relying primarily on questionnaires and declarations.

However, it is important not to confuse potential commercial expectations with statutory obligations. The legal requirements will depend on the final legislation, implementing regulations, regulatory guidance and each organisation's circumstances.

The larger lesson is that trustworthy assurance is becoming relevant across organisational boundaries. Customers, regulators and internal governance functions may ask different questions, but often depend on the same underlying facts about an organisation's security posture.

A role for AI, but not a substitute for judgement

The increasing complexity of security evidence creates a substantial challenge for traditional assessment processes. A single organisation may generate information across identity systems, cloud infrastructure, endpoint platforms, vulnerability scanners, security monitoring services, governance repositories and operational records.

Reviewing this information manually, establishing relationships to framework requirements and maintaining an auditable record of conclusions is labour-intensive. It also creates opportunities for inconsistency, particularly where multiple assessors interpret the same evidence differently.

Artificial intelligence offers a practical opportunity to support this work. AI-assisted assurance can help identify relevant evidence, analyse technical material, highlight inconsistencies and suggest relationships between observed security conditions and assessment requirements.

But the introduction of AI creates its own assurance challenge.

A generated explanation can sound authoritative without being adequately supported. An AI system may misinterpret a technical configuration, overlook an important exception or draw a conclusion that extends beyond what the available evidence actually establishes.

For that reason, the value of AI in assurance should not be measured simply by how quickly it produces an assessment. It should be measured by whether it helps produce conclusions that are more consistent, transparent and defensible.

The underlying evidence must remain accessible, the assessment requirements must be explicit, uncertainty must be represented accurately, and appropriate human judgement must remain central to the final determination.

Automation should strengthen the evidential basis of assurance, not replace it with another layer of unverified assertions.

From compliance reporting to confidence in resilience

The Cyber Security and Resilience Bill represents an important stage in the development of the UK's cyber regulatory environment. Its expansion of regulatory scope, incident-reporting reforms and proposed approach to security outcomes reflect the growing importance of resilience across interconnected essential services.

Yet legislation and regulatory frameworks can only establish expectations. Organisations must still demonstrate how those expectations are met.

For security leaders, this presents an opportunity to reconsider the foundations of their assurance programmes. Rather than concentrating primarily on producing completed assessments, the focus can shift towards establishing reliable evidence, understanding its relationship to security outcomes and ensuring that conclusions remain justified as the operating environment changes.

This is also the thinking behind CyConex's approach to cyber security assurance: using structured requirements and traceable evidence to support consistent, explainable assessments, while retaining human oversight of security judgements.

The objective is not to eliminate established frameworks or replace professional assessors. It is to make the evidence underpinning their conclusions more accessible, reusable and defensible.

As the UK's regulatory expectations evolve, organisations will increasingly need to do more than describe their security arrangements. They will need to demonstrate why those arrangements should be trusted.

The important question is no longer simply whether an organisation can show that it has security controls. It is whether it can provide convincing evidence that those controls deliver the resilience on which its services depend.

References

Legislative position: 4 November 2026. This article discusses proposed legislation and its implications for cyber security assurance. It does not constitute legal advice.