UK Reinforces Cyber Defenses: New Rules for Data Hubs

UK plans cyber rules for data centres and MSPs

At a glance

• New Regulations: The UK’s Cyber Security and Resilience policy statement, published April 1, 2025, plans to bring managed service providers (MSPs) under the NIS regulations and proposes adding data centres.
• Focus on Risk Assessment: In-scope firms would have to manage risks and protect their networks and data.
• Accountability and Response: Companies would have to report more incidents to regulators.
• Industry Adaptation: Third-party suppliers would face stronger security requirements.
• Global Implications: The plans follow similar moves in the EU under NIS2.

What the UK announced

On April 1, 2025, the UK government published its Cyber Security and Resilience policy statement, setting out what a coming bill would do. Managed service providers would be brought into the scope of the Network and Information Systems (NIS) regulations, and data centres would be added as an essential service under a measure still being considered. The aim is to protect the services the economy runs on as attacks on suppliers grow.

What the measures require

Firms brought into scope would have to take appropriate and proportionate measures to manage risks to their networks. The government said third-party suppliers would need to improve their security in areas such as risk assessment, data protection and network defences.

Incident reporting gets wider. Regulators would get more tools, and companies would have to report more incidents, giving the government a better picture of threats. For data centres, the statement proposes coverage at or above 1MW capacity, or 10MW for enterprise data centres that serve only their own business.

What changes for providers

For MSPs and data centre operators, the plans mean new duties and closer oversight by regulators. The government said it did not expect responsible operators to face large compliance costs and promised a full impact assessment when it legislates. Other countries are watching how the UK handles these rules.

Industry groups have broadly welcomed the direction. Compliance will cost something. Providers that already follow recognised standards should find the change manageable, though smaller MSPs with thin security teams may need outside help to document how they manage risk.

Beyond the UK

The UK move follows the EU’s NIS2 directive, which already covers managed service providers and data centre services. Similar rules may spread to other countries trying to protect their critical infrastructure.

Closer alignment between national rules would make life easier for providers operating across borders, and it could make information sharing between governments simpler.

What providers should do now

UK data centres were designated as critical national infrastructure in September 2024, and these plans would give that designation legal teeth. MSPs and operators near the 1MW threshold should map their services against the proposed definitions now rather than wait for the bill.

The government said the final wording will come with the bill. Until then, the policy statement is the best guide to what UK providers will be asked to do.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.