Which SMEs could be affected?
The expanded regime includes relevant managed service providers and data centres, alongside existing regulated services. The Bill also proposes a critical-supplier designation mechanism.
However, supplying a regulated customer does not automatically make every SME a regulated critical supplier. Applicable definitions, thresholds, exemptions and designation decisions matter.
An ordinary retailer may face mainly contractual notification requirements. An IT provider supporting essential services may have a more direct regulatory exposure. Size alone is not a sufficient answer.
How should SMEs prepare without overcomplicating compliance?
A short, tested response process is more useful than a lengthy policy nobody can access during an outage.
Five actions to take this month
1. Map legal and contractual exposure. Record your services, regulated customers and relevant supplier obligations. Obtain advice where your business could meet a regulated-provider definition or face critical-supplier designation.
2. Name a reporting decision-maker and deputy. Establish who assesses reportability, who approves notifications and who submits them. Include out-of-hours contact details and a route that works if business email is unavailable.
3. Prepare notification templates. Include awareness time, affected services, known impact, actions taken and unresolved questions. Separate confirmed facts from working assumptions. Do not delay an applicable notification while seeking a perfect account.
4. Run a Friday-evening exercise. Simulate a supplier compromise affecting customer systems while the director is unavailable. Measure how long it takes to identify obligations, reach decision-makers and draft an initial notification. Record and fix each failure.
5. Review supplier notification clauses. Check triggers, contact routes and information requirements—not just the stated number of hours. A supplier’s delay can consume your response window. Contractual deadlines may also be shorter than statutory ones.
Keep an incident decision log even when an event is judged non-reportable. Recording the evidence and reasoning supports accountability and later review.
Keep UK GDPR reporting separate
The proposed cyber reporting regime does not replace personal data breach obligations.
The Information Commissioner’s Office guidance explains that a reportable personal data breach must be notified without undue delay and, where feasible, within 72 hours of awareness. Notification is required unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. High-risk breaches also require affected individuals to be informed without undue delay.
An incident could trigger cyber-regulatory reporting, data protection reporting, contractual notifications and insurance requirements simultaneously. One notification should not be assumed to satisfy every obligation.
FAQs and the practical takeaway
The key is to distinguish regulatory scope from operational readiness. Every SME benefits from faster escalation, even where the proposed statutory duty does not apply.
Does every UK SME face a new 24-hour reporting deadline?
No. The proposed requirement concerns organisations within the relevant regulatory regime. Other SMEs may face customer-contract requirements or existing data protection obligations. Check your services and contractual commitments before concluding either that you are covered or that you are exempt.
Must the investigation be finished within 24 hours?
No. The government factsheet describes an initial notification containing basic details, followed by a fuller report within 72 hours containing information known at that stage. Investigation and recovery may continue afterwards.
Does a phishing email start the reporting clock?
Not automatically. Receiving an attempted phishing message is different from becoming aware of an incident meeting the applicable reporting threshold. Staff should still escalate suspicious activity promptly so authorised personnel can assess whether systems or information have been compromised.
What should an SME director prioritise?
Test the route from discovery to decision. The poll’s clearest warning is not a lack of paperwork; it is reliance on processes that have never been exercised.
This month, rehearse one out-of-hours incident with your IT provider and reporting deputy. Confirm who decides, who submits and how both continue working when email or the main business system is unavailable. That is a practical investment in SME cyber resilience, regardless of the Bill’s final commencement timetable.
