The Cyber Security and Resilience Bill Is Almost Law — and SMBs Are Moving Backwards

The Cyber Security and Resilience Bill had its Lords Third Reading today. Royal Assent is expected before the end of the year. This is the most significant overhaul of UK cyber rules since the NIS Regulations in 2018 — and it arrives at an awkward moment.

The government's own Cyber Security Breaches Survey 2025/2026, published in April, shows that the share of small businesses with a business continuity plan covering cyber security has dropped from 53% to 44%. That is not a rounding error. That is a return to 2023/24 levels, wiping out the progress made last year in a single survey cycle.

So the law is moving in one direction. SMB preparedness is moving in the other. That gap is going to cause real problems.

What the Bill Actually Means for SMBs

The bill directly targets larger operators and managed service providers — critical national infrastructure, digital service providers, that sort of thing. If you run a 50-person accountancy firm or a regional manufacturer, you are probably not in scope in the technical legal sense.

But that framing misses something important: supply chain provisions.

If you supply goods or services to an organisation that is in scope, they will need to demonstrate that their supply chain does not represent a risk. In practice, that means they will start asking you questions. Do you have a business continuity plan? What happens to your systems if you are hit by ransomware? How quickly can you recover? Can you prove it?

Businesses that cannot answer those questions will lose contracts. It may not happen immediately, but the direction of travel is clear, and procurement teams at larger organisations tend to move fast once compliance pressure arrives from above.

The Recovery Standard the Bill Signals

The bill does not invent a new concept here. UK GDPR already requires organisations to be able to restore personal data promptly after an incident — that is Article 32, and it has been on the books since 2018. What the bill does is raise the political and commercial stakes for not having that capability in place.

The signal is straightforward: backup and recovery is no longer a passive IT function that sits quietly in the background. It needs to be documented. It needs to be tested. It needs a named owner — someone who knows what happens on day one after an attack, not someone who will be finding out alongside everyone else.

For SMBs, that means three practical questions worth answering now:

• Where is your critical data? Cloud, on-premises, SaaS applications — do you actually know what you have and where it lives?
• How quickly can you recover it? Not "we have backups" — how long does it take to get systems back to a working state after a serious incident?
• Who owns that process? If your IT lead is unavailable, who else knows what to do?

If you cannot answer all three confidently, you have a gap.

What the ICO Is Already Doing

Before the bill even becomes law, the enforcement landscape is already active. The ICO recently reprimanded two Welsh organisations following a ransomware attack in which 182.7GB of data was encrypted and 42GB exfiltrated. The attack exploited a dormant account with a weak password.

Two things stand out from that case. First, access hygiene and backup are two sides of the same coin. If you leave doors open, attackers will walk through them — and then backup is your last line of defence. Second, without backup, recovery from an attack like that is not slow or painful. It is impossible.

The ICO reprimand happened without the Resilience Bill in force. Once Royal Assent comes through and expectations are formally raised, organisations without credible recovery capability are taking on a level of regulatory risk that is hard to justify.

The Window Is Closing

The drop from 53% to 44% in business continuity planning is not just a worrying statistic. It is evidence that many SMBs are making an active or passive choice to deprioritise this — at the worst possible time.

Cyber insurers are already asking harder questions at renewal. Larger clients are starting to include resilience requirements in supplier questionnaires. The bill will add legislative weight to pressure that is already building from the commercial side.

The practical foundation for all of it — the thing that makes a business continuity plan credible rather than a document that gathers dust — is a backup and recovery capability that actually works. That means covering cloud data, on-premises systems, and SaaS applications. It means regular, tested restores, not just backups that nobody has checked in two years. And it means being able to demonstrate the whole thing to someone outside your IT team when they ask.

Getting that in order now, before customers and regulators start asking hard questions, is the straightforward move.

---

Ready to get your backup and recovery in order before the bill becomes law? Talk to IronFell about how our managed backup service works for businesses like yours — no jargon, no hard sell.