Preparing for the UK Cyber Resilience Bill and a Closer Look at NIS 2
Cybersecurity is not just a technical topic anymore. It plays a key role in how businesses stay open, keep their reputations strong, and follow legal rules. In today’s digital world, being able to handle cyber threats is just as important as managing money or contracts.
In 2023, the European Union introduced the NIS 2 Directive which came into force under EU law in October 2024. This new version builds on the original rules and asks for more from organisations. If your business is based in the UK and doesn’t trade with the EU, these rules may not apply just yet. However, the UK government is working on its own version, called the UK Cyber Resilience Bill. It is likely to include very similar rules and responsibilities.
At ADM Computing, we have already reviewed NIS 2. We compared its requirements with the systems and processes we use for ISO 27001 (Information Security) and ISO 9001 (Quality Management). Because of this, we are confident that we’re ready for the UK’s upcoming law. Below, we explain the ten areas that NIS 2 covers. Each of these helps businesses stay safer online and prepare for future threats.
Governance
Strong cybersecurity begins at the top. NIS 2 says it is imperative that a director or board member is given overall responsibility for cybersecurity. In larger organisations, a senior manager can also be appointed to handle the day-to-day work. This person should have enough authority and experience to manage security operations effectively.
It also says every organisation should have a clear cybersecurity plan. This plan should cover everything — from how risks are handled to how staff are trained.
Risk Management
Good risk management helps stop problems before they happen. NIS 2 asks organisations to check their systems regularly for weak spots. These checks help identify what could go wrong and how serious it might be.
After the checks, organisations must create clear plans. These plans explain how they will fix or manage each risk and who is responsible for doing it.
Incident Management
Even with strong systems in place, issues can still occur. NIS 2 says organisations must have a plan for dealing with incidents. This plan should help teams act fast, limit damage, and get systems back up and running.
It also requires certain incidents to be reported to the right authorities quickly. This helps the wider network respond and recover more effectively.
Business Continuity
Cybersecurity is not just about keeping attackers out. It’s also about keeping your business running when something goes wrong. NIS 2 says that organisations must have business continuity plans. These plans help make sure that essential services can keep going during and after a cyber incident.
It also requires disaster recovery plans. These are the steps that help restore your systems, services and data after a cyberattack or other major issue.
Security Measures
NIS 2 highlights the need for solid technical defences. Organisations should put in place practical steps to protect their systems and data. This includes:
- Access controls, so only approved people can reach sensitive data and systems.
- Encryption, which protects data as it moves and when it is stored.
- Network security tools, like firewalls and intrusion detection, to keep hackers out.
Monitoring and Logging
Spotting problems quickly is just as important as stopping them. NIS 2 says organisations must always keep a close eye on their systems. This helps detect any signs of trouble early.
Organisations must also collect and review logs. These are detailed records of activity in your systems. Analysing these logs helps you investigate security issues and understand how they happened.
Supply Chain Security
Your cybersecurity is only as strong as your weakest link — and that often means your suppliers. Many cyberattacks happen through third-party vendors or service providers. In fact, a study by the World Economic Forum found that supply chain weaknesses are the top barrier to cyber resilience for 54% of large businesses.
Because of this, NIS 2 requires organisations to check the security of their suppliers. You also need clear policies in place to manage risks in your supply chain.
Training and Awareness
Technology alone isn’t enough. People play a huge role in cybersecurity. Mistakes by staff are one of the biggest causes of data breaches.
NIS 2 says that regular training is essential. All employees should know the basics of staying safe online, such as spotting suspicious emails or using strong passwords. Organisations should also run wider awareness campaigns to build a strong security culture.
Compliance and Reporting
Staying compliant is not a one-time job. NIS 2 requires organisations to check regularly that their cybersecurity measures are up to date and effective. This can involve internal audits or external reviews.
Organisations must also report serious incidents. These reports must go to the proper authorities and be made within the time limits set by the directive. It’s all about transparency and fast action.
Cooperation and Information Sharing
No business can fight cyber threats alone. NIS 2 encourages organisations to work together. This means sharing information about threats and incidents with government bodies and other organisations.
By sharing what you know, you help others stay safe — and they can help you in return. It creates a stronger defence across the whole network.
How ADM Is Responding
At ADM Computing, we have already put many of these controls into place. Our work with ISO 27001 and ISO 9001 has helped us build strong systems that match the goals of NIS 2.
This means we are not only ready for the upcoming UK Cyber Resilience Bill, but we are also in a strong position to help our clients get ready too. Whether you need help building a cybersecurity strategy, reviewing your supply chain risks, or improving your staff training, we are here to support you.
If you want to understand what the new rules mean for your organisation, or if you’re looking for a practical path to compliance, talk to our team today.
Book in a FREE Cyber Security Audit
About ADM
Founded in 1984, ADM Computing is Kent’s largest and longest established IT services company specialising in IT support services that help to reduce IT costs as well as improve network efficiency. We have a long history of charity work and won’t be slowing down any time soon!
To keep up to date with all our latest updates, follow us on LinkedIn:Â ADM Computing LinkedIn
Blog Author
Andy Cox – Senior Engineer
Andy joined ADM in 2010 as a First Line Engineer, bringing with him over a decade of IT experience from his time in the NHS. Since then, he has become a cornerstone of the ADM team, progressing to the role of Senior Engineer.
Andy works on customer projects with a focus on Microsoft 365, Azure, and security solutions. In addition to his client-facing role, Andy plays a pivotal part in ADM’s internal operations, particularly in security and compliance. He contributes as a key member of the ADM Security, Compliance, and ISO teams, ensuring the company meets the highest standards.
When he’s not solving complex technical challenges, Andy enjoys building scale model aircraft and playing guitar, showcasing his creativity and precision both in and outside of the workplace.
