On the first of September, in a committee room off the Lords' west corridor, a bill that has been moving through Parliament since November 2025 enters Grand Committee. There is no gallery for this. Committee stage is line-by-line work, and the Bill has been doing it in public for nearly ten months.
That is one clock: dated, visible, no surprises.
The other runs differently, and it is the one worth your attention.
The weekend
Friday, 18:40. A support engineer's credential opens a remote session into a client's environment. The credential is real, the session looks like every other session, and nothing generates an alert. This is the ordinary case now: not malware arriving, but legitimate access in the wrong hands.
Saturday. The session moves, looking at what it can reach, and it can reach a great deal because remote management access is broad by design.
Sunday, 02:00. The busiest hour of the week for this work, for the obvious reason.
Monday, 08:15. Somebody notices something odd in a log and asks a colleague.
Monday, 11:00. It is confirmed.
Under the Bill, a relevant managed service provider must notify the regulator within 24 hours of becoming aware of a significant incident, with a full report at 72. So the clock in that sequence does not start on Friday evening. It starts at eleven o'clock on Monday morning.
Noticing slowly is not shelter
Read quickly, that sounds like shelter: if the obligation attaches to awareness, the firm that notices slowly has more room than the one that notices fast.
It is exactly backwards.
The clock is not the thing being measured. It is the thing that makes the measurement visible. A firm reporting within 24 hours of Monday morning has met the deadline, and produced a document stating that an intrusion ran unobserved since Friday evening. The notification is not the test. It is the disclosure of how long the test took.
The second obligation bites harder. The full report at 72 hours has to say what happened: which systems, which data, which clients. Reconstructing three days nobody watched is a forensics job that gets harder the longer it ran. The reporting duty and the detection capability are the same problem in different clothes.
Who this reaches, and who it does not
Less of the channel than the coverage suggests. The Bill does not regulate managed service providers. It regulates relevant ones, and the definition is narrow: a provider of managed services in the UK that is not a small or micro enterprise. The government's own impact assessment applies that boundary at 50 or more UK staff and turnover above €10m.
Of roughly 12,867 managed service providers (MSPs) in the UK, between 556 and 1,019 are expected to be newly regulated (a central estimate of 788). That is a narrow door, and most firms reading this are not walking through it.
Worth stating plainly, because a lot of what is being circulated says the opposite.
The number being circulated
If you have seen a figure of 900 to 1,100 UK MSPs, it is wrong.
It is a misreading of the impact assessment's own arithmetic. 977 to 1,214 providers clear the size test, but 658 of those are cloud providers already regulated under the existing framework. Take them out and the newly regulated population is the 556 to 1,019 above. A plan sized against the larger number aims at a population roughly forty per cent bigger than the one that exists.
It came from industry commentary and it looked authoritative, which is how it has travelled as far as it has. If it is in a plan of yours, check where it came from.
Exempt is not the same as unaffected
Two things reach firms below the threshold.
The Bill amends the blanket small and micro exemption so regulators can designate a smaller provider a critical supplier where a supply chain needs safeguarding. Being under the line is not permanent.
The larger one arrives sooner and from a different direction. A regulated customer carries duties for its own supply chain, and it will discharge them through procurement. That reaches you as a questionnaire from someone's purchasing team long before it reaches you as anything from a regulator, and it will ask the same questions.
What this actually is
It would be easy to write this as a warning. It is not one.
For twenty years, whether an IT provider watched its clients' systems out of hours was a commercial decision made against margin. For a defined group it stops being discretionary and becomes professional practice, the kind every mature discipline acquires and then cannot imagine working without.
That is a promotion. Firms managing other organisations' infrastructure are being recognised as what they have been for a decade: first responders, holding real trust, now with a standard attached.
Where you stand
Start with whether the Bill reaches you at all. It regulates relevant managed service providers, and the government's impact assessment tests for one in three parts. All three have to be true:
- You provide managed services in the UK: ongoing management of a customer's IT systems, reached through remote access.
- You employ 50 or more people in the UK.
- Your annual turnover is above €10m.
If any of the three is false, the Bill as drafted does not regulate you, although designation and your customers' procurement teams still can.
If all three are true, these are the four questions worth answering, and none of them is about products.
- Who is looking outside office hours? Analysts watching in real time, somebody on call for critical alerts, or a dashboard that gets checked the next working day.
- How quickly could you isolate something? If ransomware starts at two on a Sunday morning, how long is it before the machine is cut off, and does anybody have to approve that first?
- What can you actually correlate? Endpoint, firewall, logs, cloud and identity in one view, or alerts sitting in separate dashboards that nobody joins up.
- Could you produce the account? If an incident were confirmed on Monday morning, could you notify within 24 hours and file a full report within 72 that says which systems, which data and which clients?
If the Bill reaches you and any of those answers gave you pause, tell us where. Someone from CMS Distribution will be in touch to talk it through.
CMS vendors in this area
- eSentire: managed detection and response: a team that watches for, investigates and contains threats at any hour.
- ESET: endpoint detection and response, with a managed service option.
CMS Distribution distributes the vendors listed here. They appear alphabetically, and none paid for placement or reviewed this article.
Every date and figure in this piece is verified against the Bill documents, the Department for Science, Innovation and Technology factsheets and its final stage impact assessment (reference DSIT002(FIA)-25-DTI, 12 November 2025). Royal Assent is currently forecast for late 2026 (a forecast, not a date). The thresholds that make an incident "significant" enough to report will be set by secondary legislation and have not yet been made.
