Skip to content
Most of the commentary on the UK Cyber Security and Resilience Bill has focused on IT infrastructure. Critical national infrastructure. NHS networks. Cloud providers. What has barely featured in that conversation is physical security. The access control systems, CCTV platforms, remote monitoring services, and networked sensors that sit quietly at the edge of your organisation’s digital estate.
That gap is a problem. Because if your physical security infrastructure is connected to your network then this legislation is directly relevant to you.
What The Bill Actually Does
Introduced to Parliament on 12 November 2025, the Cyber Security and Resilience Bill represents the most significant reform to UK cybersecurity legislation since the Network and Information Systems (NIS) Regulations 2018. It is currently progressing through Parliament and is expected to receive Royal Assent and begin phased implementation in 2026.
The Bill updates and significantly expands the NIS framework in three keyways:
- It widens scope, bringing Managed Service Providers, data centre operators, and ‘critical suppliers’ within the regulated perimeter for the first time.
- It strengthens incident reporting obligations, organisations in scope will face mandatory reporting requirements, with proposals for reporting within 24 hours of a significant incident becoming aware of it.
- It increases enforcement powers, regulators across 12 sectors will have broader investigatory tools and the ability to impose substantial financial penalties for non-compliance.
Proposed penalties under the Bill are significant. The legislation introduces a simplified two-band structure: up to £17 million or 4% of worldwide turnover (whichever is higher) for more serious breaches such as incident notification failures and security duty failures, and up to £10 million or 2% of worldwide turnover for less serious breaches. Regulators can also impose daily fines of up to £100,000 for ongoing non-compliance. The framework is intended to align with comparable regimes such as GDPR, and to reflect the seriousness with which cyber resilience obligations are now being treated.
Why Physical Security Teams Are in Scope (Whether They Know It or Not)
The Supply Chain Is Now in the Frame
The Bill’s expansion of the MSP definition is where physical security integrators and their clients need to pay close attention. Under the proposed legislation, a ‘Relevant Managed Service Provider’ (RMSP) is defined as any medium or large entity providing a managed service in the UK, including services essential to the resilience or security of another organisation’s network or information systems.
Read that again. If your organisation uses a security integrator to remotely monitor your access control, manage your CCTV platform, or provide outsourced alarm response, that integrator may fall within the Bill’s expanded scope. And if the integrator falls in scope, the security of the connection between you matters.
One of the most significant UK cyber incidents of 2025 began not with a direct attack on the target organisation, but through a third-party contractor. Social engineering via an external supplier gave attackers the foothold they needed. The disruption lasted weeks. The Cyber Security and Resilience Bill is, in significant part, a legislative response to exactly that kind of attack vector.
Physical security systems are an obvious candidate for this kind of exploitation. IP cameras, access control panels, door controllers, and alarm systems all communicate over networks. Many use default or rarely changed credentials. Some carry outdated firmware. In December 2025, the NCSC co-issued an advisory warning that pro-Russian hacktivists had successfully targeted industrial control systems by brute-forcing exposed remote access services with default credentials.
Your CCTV system is not exempt from this threat. Neither is your access control platform.
One of the most significant aspects of the Bill is its explicit focus on supply chain security. The legislation allows regulators to designate specific suppliers as ‘critical’ and to require higher standards from those suppliers. Buyers of security services will increasingly demand stronger contractual protections, evidence of secure practices, and demonstrable resilience from their technology and service providers.
For organisations that purchase managed security services, this creates a clear due diligence obligation: understand how your integrator secures the connection between your estate and their monitoring infrastructure. Ask about firmware update policies. Ask about credential management. Ask about incident response procedures.
For organisations subject to sectoral regulation, like critical national infrastructure, transport, energy, healthcare, financial services, the Bill may bring direct compliance obligations that specifically touch physical security deployments.
Four Questions to Ask About Your Physical Security Estate Right Now
- How is remote access to your security systems managed?
If your integrator connects to your access control or CCTV platform remotely, what authentication controls are in place? MFA, credential rotation, and encrypted tunnels are baseline requirements under a cybersecure physical security architecture.
- What is your firmware and patch posture?
IP cameras, door controllers, and networked sensors all run embedded software. Unpatched devices are a persistent vulnerability. When did your integrator last audit the firmware versions running across your estate?
- Do you have an incident response plan that covers your physical security systems?
The Bill’s mandatory reporting obligations apply to significant cyber incidents. A breach that originates through your access control infrastructure or that disrupts your monitoring capability is a physical security incident with cyber dimensions. Your response plan needs to reflect this.
- Is your integrator within scope of the Bill, and if so, what does their compliance posture look like?
Ask your managed service provider directly. A security integrator that takes this question seriously (and can answer it clearly) is demonstrating exactly the kind of cyber resilience posture the legislation is designed to encourage.
What Good Looks Like
The most instructive comparison from 2025 is between two UK retailers who faced the same attacker group at roughly the same time, with strikingly different outcomes. One suffered weeks of online disruption. The other detected the intrusion in minutes and contained it in hours. The difference was not budget. The difference was architecture and preparation — network segmentation, zero trust principles, and a rehearsed incident response capability.
Physical security systems that are segmented from core business networks, managed through hardened remote access, and operated by providers with mature security practices do not eliminate risk. But they dramatically reduce the attack surface.
Evolution's Position
As a managed security services provider, Evolution falls within the extended scope the Bill is designed to cover. We welcome that. The legislation codifies what responsible integrators should already be doing and creates a framework that separates security providers who take cyber seriously from those who treat it as someone else’s problem.
Our managed monitoring and remote services operate through dedicated, encrypted connections. We maintain firmware update schedules across client estates, apply credential hygiene standards, and hold cyber incident response procedures that are tested, not just documented. When clients ask us about our cyber posture, we can answer.
Speak to the Evolution team about a cyber resilience review of your physical security estate. We can help you understand your exposure, close the gaps, and document your compliance position ahead of the Bill’s implementation.