Cyber Security and Resilience Bill: Is Your Bid Evidence Ready?

A supplier can offer a strong service, competitive pricing and years of relevant experience, yet still lose buyer confidence if it cannot explain what happens during a cyber incident. How will delivery continue? Who will make decisions? When will the customer be informed?

These questions are becoming part of mainstream supplier assurance. The Cyber Security and Resilience Bill may be focused on protecting essential and digital services, but its wider commercial message is clear: cyber resilience is becoming bid evidence.

Cyber Resilience Is Now a Buying Decision

Cyber security was once treated primarily as an IT responsibility. In public procurement, that distinction no longer works.

A compromised system can interrupt service delivery, expose sensitive information, delay mobilisation and affect an entire supply chain. Buyers therefore need to assess more than whether a supplier can deliver under normal conditions. They need confidence that important services will remain available when systems, technology providers or subcontractors are disrupted.

This fits with the wider direction established by the Procurement Act 2023. Greater transparency, more visible contract performance and increased attention to supplier capability all create a stronger incentive for buyers to investigate operational risk before making an award.

Cyber resilience is part of that risk.

What Would the Bill Change?

At the time of writing, the Bill is progressing through the House of Lords and has not yet received Royal Assent. It is intended to reform the Network and Information Systems Regulations 2018, which already place security and resilience duties on organisations involved in essential and certain digital services.

Thornton & Lowe’s wider guide to the **Cyber Security and Resilience Bill** examines its implications for public sector suppliers. Key proposals include:

• Bringing medium and large managed service providers into the regulatory regime
• Treating qualifying data centres as essential services
• Introducing regulation for large load controllers
• Allowing regulators to designate particularly important organisations as critical suppliers
• Expanding incident-reporting requirements
• Strengthening regulatory, enforcement and information-sharing powers

For reportable incidents, the proposals include an initial notification within 24 hours and a fuller report within 72 hours. The government also intends affected data centres, digital service providers and managed service providers to inform customers where an incident is likely to affect them.

Not every organisation bidding for public contracts will be directly regulated. However, the influence of the Bill is likely to extend beyond its formal scope.

Where a public body, prime contractor or framework operator has stronger regulatory duties, it will need greater assurance from the organisations supporting its services. Those expectations can flow directly into procurement documents and contracts.

Buyers Will Ask for Proof, Not Promises

Many tender responses still rely on statements such as “we take cyber security seriously” or “we maintain robust systems”. These claims provide little assurance on their own.

Buyers need to understand what controls are in place, how they operate and whether they will protect the proposed service. A credible response may need to identify:

• Who holds senior responsibility for cyber risk
• How access to systems and data is controlled
• How employees are trained
• How vulnerabilities are identified and addressed
• What happens when an incident is detected
• How quickly customers will be notified
• How services will continue during disruption
• How subcontractors and technology providers are checked

The stronger the answer, the easier it is for an evaluator to connect the supplier’s controls with reduced delivery risk.

This is especially important following **recent procurement changes** that have increased the visibility of contract performance. Cyber controls should not be described as isolated corporate policies. They need to be presented as practical measures that protect mobilisation, service continuity, reporting and contractual outcomes.

Build Your Cyber Evidence Before the Tender Arrives

Waiting for a live tender to ask about cyber resilience creates unnecessary pressure. Policies must be found, subject specialists contacted and evidence approved while the submission deadline is already approaching.

A better approach is to prepare reusable content in advance.

1. Map the Systems Supporting Delivery

Identify the systems, software, data and connected equipment required to deliver your service.

This should include technology operated internally and any platforms provided by third parties. Consider what would happen if each system became unavailable, was compromised or could no longer be accessed securely.

2. Define Responsibility Clearly

A tender response should explain who owns cyber risk and who would take control during an incident.

Avoid relying solely on job titles. Set out how an issue is escalated, who can make operational decisions and who is responsible for communicating with the customer.

Smaller suppliers do not necessarily need a large security department, but they do need clear accountability.

3. Test Incident and Continuity Plans

An untested plan offers limited reassurance.

Tabletop exercises, recovery tests and simulated incidents can reveal unclear responsibilities or dependencies before they affect a contract. They can also create valuable evidence, including exercise records, lessons learned and resulting improvements.

This helps turn a generic statement about business continuity into a credible account of how the organisation would respond.

4. Review the Full Supply Chain

Your own controls may be strong, but the delivery model can still depend on cloud platforms, software suppliers, managed IT providers, specialist subcontractors or other partners.

Check what assurance these organisations can provide. That might include certifications, security policies, incident-notification commitments, data-location information or continuity arrangements.

A bidder should be able to explain how suppliers are selected, monitored and replaced if their performance creates an unacceptable risk.

5. Create an Approved Evidence Library

Bring the strongest material together in one controlled location.

Useful evidence could include policies, certifications, training figures, governance structures, process diagrams, test records and previous examples. Each item should have a clear owner and review date.

Bid technology can make this information easier to find and reuse, but expert oversight remains essential. Content still needs to be adapted to the buyer, specification and delivery model. A technically accurate answer can score poorly if it doesn’t address the evaluation criteria.

Critical Supplier Status Raises the Stakes

One of the Bill’s most significant proposals is the ability to designate suppliers whose disruption could seriously affect essential or digital services.

Designation would depend on the supplier’s importance to a regulated organisation and the potential impact of disruption. The wider lesson is that supply chain criticality will receive more scrutiny, even where formal designation does not apply.

Buyers may investigate ownership, operational dependencies, data access, subcontracting and the supplier’s ability to recover from an incident.

This overlaps with the Procurement Act’s national security exemption, which can affect procurement where standard processes would conflict with national security interests. Cyber security, infrastructure and economic security can all contribute to a more sensitive procurement environment.

Defence and Critical Infrastructure Will Move Faster

Heightened cyber scrutiny is likely to be especially visible in defence, health, energy, transport, water, digital infrastructure and managed technology services.

These sectors depend on connected systems and complex supply chains. A disruption affecting one provider can create consequences across several organisations.

The government’s **Defence Investment Plan** reinforces the emphasis on readiness, advanced technology, secure supply chains and industrial resilience. Suppliers pursuing related work should expect cyber assurance to sit alongside requirements covering security, capacity and continuity.

This does not close the market to smaller organisations. There are growing **opportunities for SMEs to win defence contracts**, particularly where they offer specialist capabilities or innovation. However, accessing those opportunities requires evidence that the organisation can meet demanding security and delivery standards.

A concise, well-supported response from an SME can be more convincing than pages of generic corporate language from a larger competitor.

Procurement Teams Need Proportionate Assurance

Buyers also have work to do.

Cyber requirements should reflect the risks created by the contract. Applying the same extensive security criteria to every procurement can restrict competition without producing better protection.

A proportionate approach starts by understanding:

• What data or systems suppliers will access
• How serious an interruption would be
• Which third-party dependencies could affect delivery
• What certifications or controls are genuinely necessary
• What evidence can reasonably be evaluated
• How assurance will continue after contract award

Preliminary market engagement can help test whether proposed requirements are realistic. Evaluation guidance should also make clear what a strong response needs to contain.

Once the contract begins, cyber resilience should form part of ongoing supplier and contract management. Risks, systems and subcontractors can all change during a multi-year agreement.

Common Questions About the Bill

Is the Cyber Security and Resilience Bill already law?

No. As of July 2026, the Bill is progressing through the House of Lords. Further parliamentary stages, Royal Assent and secondary legislation will be required before all proposed measures take effect. The government has indicated that implementation will be phased.

Will every public sector supplier be regulated?

No. The Bill’s direct obligations focus on defined organisations and services. However, regulated customers and prime contractors may introduce stronger cyber requirements throughout their supply chains.

What should suppliers prepare first?

Start with the evidence closest to contract delivery: responsibility, access controls, incident response, business continuity, staff training and subcontractor assurance. Then make sure this evidence is current, approved and easy for the bid team to use.

Strengthen Your Bid Evidence Before It Becomes a Barrier

The Cyber Security and Resilience Bill reinforces a shift that is already under way. Buyers want confidence that suppliers can protect critical systems, respond quickly and maintain delivery when disruption occurs.

At Thornton & Lowe, we help organisations develop stronger bid strategies, manage complex submissions and turn operational processes into clear, evidence-based tender responses. We also support procurement teams with outsourced expertise, compliant processes and supplier-management activity.

To review your current approach or strengthen an upcoming submission, **contact Thornton & Lowe**.