Is UK transport ready for the Cyber Security and Resilience Bill?

Writing for Transport Monthly, Laurence Kresnyak, Business Development Director at Getronics, explores why transport operators should strengthen their cyber resilience now—and where practical preparation should begin.

What does the Bill mean for transport operators?

The Cyber Security and Resilience (Network and Information Systems) Bill would update the UK’s existing NIS Regulations 2018, strengthening the framework that protects essential services and digital infrastructure.

Legislative status reviewed: 23 October 2026. The Bill remains before Parliament, with House of Lords Report stage scheduled for 26 October. Its provisions may change, and implementation would take place in phases following Royal Assent. Check the latest parliamentary status.

Transport is already covered by the NIS framework, including specified activities across air, rail, road and maritime services. However, operating in the sector does not automatically mean every organisation has the same obligations. Operators should establish whether their activities fall within scope, their designation and the relevant regulatory guidance.

The Department for Transport’s NIS implementation guidance provides a starting point for understanding the existing framework.

Two proposed changes deserve particular attention:

1. Earlier incident reporting
   The Bill proposes an initial notification within 24 hours of becoming aware of a qualifying incident, followed by a fuller report within 72 hours. Both deadlines run from awareness of the incident; the second is not an additional 72 hours after the first notification.
   
   The proposals would also broaden reporting to include certain incidents likely to have significant impacts, even where disruption has not yet occurred. 
   
   The government's incident reporting factsheet explains the intended changes: https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/incident-reporting 
    
2. Greater scrutiny of critical suppliers
   The Bill would give regulators powers to designate certain critical suppliers and subject them to security requirements.
   
   This would not automatically bring every supplier into direct regulation. Designation would depend on defined conditions, including the potential consequences of disruption. For transport operators, it reinforces the importance of understanding which external services support essential operations. Read the government’s critical-supplier factsheet

When a technology outage becomes a transport problem

A transport service can be disrupted even when its vehicles remain operational. Losing access to scheduling, passenger information or the data needed to coordinate services can affect the wider network.

Laurence’s central argument is that resilience requires a clear understanding of how those dependencies work.

Older applications and newer cloud platforms often operate together. A system that appears minor may support several critical processes, while a supplier’s service may underpin activities across the organisation.

For operators managing complex transport technology environments, the starting point is to understand which services matter most, what supports them and what would happen if a dependency failed.

Six practical steps to strengthen readiness

Preparation starts with identifying what matters most and gathering evidence that plans work. The following steps are practical readiness measures, rather than a checklist of documents explicitly required by the Bill.

A structured IT service continuity approach connects recovery planning with operational priorities. Clear cybersecurity management helps ensure findings lead to decisions and accountable action.

Where applicable, the NCSC’s Cyber Assessment Framework can help structure assessment and improvement. Operators should follow the framework and expectations relevant to their transport activity and regulator, rather than assume one assessment applies identically across every mode of transport.

Could your teams meet the proposed reporting deadlines?

Earlier notification requires more than a reporting template. Teams need to recognise an incident, assess its significance, obtain information and know who can authorise communication.

Operators can begin by asking:

• Who decides whether an incident meets the reporting criteria?
• Can operational teams and suppliers share the information needed quickly?
• Have we exercised escalation, communication and recovery together?

These arrangements should work outside normal office hours and when key individuals are unavailable.

An exercise may reveal that the main obstacle is an unclear handover, an outdated contact list or uncertainty over who can make a decision. Addressing those gaps is part of building a dependable response.

Experience supporting critical transport operations

Getronics’ work with a UK airport operator illustrates the breadth of technology services behind an always-on transport environment.

The partnership spans more than 12 years and includes round-the-clock service desk support, field engineering, infrastructure management, public cloud and security services.

The UK airport operator case study provides an example of integrated service delivery across a complex transport estate. It demonstrates operational experience, rather than certification against the forthcoming Bill.

Start with the services that must keep running

The Bill’s final requirements and implementation dates will need continued review. Operators can already make progress by understanding dependencies, exercising recovery and clarifying responsibilities.

A useful starting point is to ask: if an important system or supplier became unavailable tomorrow, would our teams know what to protect, what to restore and who needs to act?

Read Laurence’s article in Transport Monthly for his perspective on preparing the sector.