There's a piece of legislation working its way through Parliament right now that is going to change how thousands of UK businesses think about breach detection — and most of the businesses it covers haven't read it yet.
The Cyber Security and Resilience Bill updates the UK's NIS Regulations 2018, and it does two things that matter enormously if you run — or rely on — IT services in this country. First, it dramatically expands who is regulated. Second, it puts a clock on incident reporting: 24 hours for an initial notification, 72 hours for a full report, to your regulator and the National Cyber Security Centre simultaneously.
Twenty-four hours. To report an incident. Which presupposes something the legislation is too polite to spell out: that you noticed.
Who's Newly in Scope
The headline change is that managed service providers are brought into regulation for the first time. The Government's own factsheet defines a managed service as one involving "ongoing management of information technology systems for the customer" — support and maintenance, monitoring, active administration — where the provider has "access to network and information systems relied on by the customer."
And it explicitly includes the security industry itself. The factsheet names "managed security services, such as security operations centre, and security information and event management" as in-scope service types, and gives as its worked example "an IT security company providing cyber security services to a UK business customer, such as ongoing firewall management, intrusion detection, and incident response services."
If you're an MSP or MSSP above the small/micro threshold, you will need to register with the regulator, manage your risks with "appropriate and proportionate measures", and report significant incidents on that 24-hour clock. Data centre operators and large load controllers join the regime too, and regulators gain the power to designate critical suppliers — meaning even a smaller firm can be pulled into scope if an essential service depends on it.
The 24-Hour Rule, Precisely
An incident is reportable when it has "adversely affected, or is adversely affecting, the operation or security of network or information systems", the impact is (or is likely to be) significant, and it relates to the whole or part of the UK. Two details deserve your full attention:
- It covers incidents that haven't disrupted anything yet. The regime explicitly includes "ransomware and pre-positioning attacks that are likely to have significant impacts" — attackers who are in, but haven't pulled the trigger.
- Compromised data counts towards significance. One of the factors is "whether the confidentiality, authenticity, integrity or availability of data relating to users has been, or is likely to be, compromised."
In-scope providers must also notify customers who are likely to be affected. So the chain of obligation runs: detect the compromise, report it to your regulator and the NCSC within 24 hours, file the full picture within 72, and tell your affected clients. Every link in that chain hangs off the first one.
Enter the CAF: How Compliance Will Actually Be Judged
The Bill's security duties are outcome-based — the legislation doesn't hand you a checklist of controls. In practice, UK regulators assess NIS compliance against the NCSC's Cyber Assessment Framework (now at version 4.0), and that's where the expectations get concrete.
CAF Objective C is titled, without ambiguity, "Detecting cyber security events". It contains two principles:
- C1 — Security Monitoring: monitor your network and information systems to "detect security events indicative of a security incident."
- C2 — Threat Hunting: "proactively seek to detect... adverse activity" — including activity that "evades standard security prevent / detect solutions."
Read that C2 wording again, because it describes the exact gap that stolen credentials fall through. An infostealer infection on an employee's personal laptop never touches your EDR. The credential harvested from it doesn't trip your firewall. The first "adverse activity" your internal tooling could possibly see is an attacker logging in with a valid password — looking, to every downstream system, exactly like your employee. Detection that relies solely on watching your own perimeter structurally cannot see this class of compromise. That's not a tooling deficiency; it's a category error.
You Cannot Report What You Cannot Detect
Here's the uncomfortable arithmetic. Independent research puts the window between an infostealer infection and the stolen credentials appearing on a dark web marketplace at 48 hours or less. The Bill gives you 24 hours from detection to notification. If your detection strategy is "wait until something breaks", your realistic timeline is: credential stolen, credential sold, credential used, ransomware pre-positioned — and then, weeks later, a report to the regulator that opens with an apology.
External monitoring inverts that. Watching breach corpora, stealer log dumps and underground marketplaces for your domains means the alert arrives when the credential surfaces — often before it's ever used against you. That is detection evidence in precisely the CAF Objective C sense: proactive discovery of adverse activity your perimeter tooling cannot see, feeding an incident response process that can actually meet a 24-hour deadline.
What This Means Depending on Who You Are
If you're an MSP or MSSP
You're about to be regulated, and your compliance posture will be assessed by a regulator drawing on the CAF. You need continuous detection capability for your own estate — and because your clients' incidents can become your reportable incidents, you need to know when their credentials surface too. There's a commercial upside here: credential monitoring across client domains is a service line your newly-compliance-anxious customers will pay for, delivered through APIs and SIEM integrations you can fold into your existing stack.
If you're an operator of essential services
You've lived with NIS since 2018, but the reporting window is tightening and pre-positioning attacks are now explicitly reportable. Stolen credentials are the leading initial access vector for exactly those attacks. Evidence that you monitor for exposed credentials belonging to your organisation is among the cheapest CAF Objective C wins available.
If you're a supplier to any of the above
The critical supplier designation power means your customers' regulators can reach you. And even where they can't, expect the Bill's obligations to flow downhill contractually: in-scope firms will start asking their suppliers hard questions about detection. "We monitor continuously for our credentials appearing in breach data" is a much better answer than a shrug.
Getting Ahead of It
The Bill is still before Parliament, so nothing above is enforceable this morning. But regulation rewards the prepared, and detection capability isn't something you conjure the week the duties commence. DarkStrata continuously ingests stealer logs, marketplace data and breach corpora, and alerts you — usually within hours — when credentials for your domains, your staff or your customers surface, with the context needed to rotate, revoke and, where the duty applies, report on time.
You can see whether your organisation already has exposed credentials in about five minutes.
Free 7-day trial. No agents to install — we watch the outside, so you can answer for the inside.