A 24-hour clock, and your IT supplier is in scope.

There is a specific way that a regulation aimed at large infrastructure arrives at a twelve-person brokerage, and it is worth naming because it is entirely predictable.

It arrives as an email from your IT provider, eight months from now, attaching a revised service schedule. The schedule contains new obligations on you: to report suspected incidents to them within a fixed period, to maintain particular controls, to permit audit, and to notify them of changes to your systems. You will read it in four minutes and sign it, because the alternative is finding another IT provider.

Who comes into scope

Three new categories, plus a mechanism. Medium and large data centres, including enterprise data centres meeting the thresholds. Medium and large managed service providers — the outsourced IT function a great many UK professional firms rely on entirely. Large load controllers, which manage electrical load for smart appliances. And the mechanism: regulators gain the ability to designate critical suppliers, bringing an important supplier into scope by decision rather than by category.

That last one is the interesting one, because it means scope is no longer fully knowable from a list. A supplier can become regulated because of who it supplies.

What reportable actually means

For most regulated entities the test has three parts: the incident has adversely affected the operation or security of network or information systems; the impact is, or is likely to be, significant; and it relates to the whole or part of the UK. The factsheet is explicit that ransomware is reportable, and — this is the part people miss — so are pre-positioning attacks that are likely to have significant impacts even if they have not had one yet.

"Likely to" is doing a great deal of work in that sentence. An organisation that discovers an intruder has been present for six weeks without doing anything visible has a reportable incident, and it has twenty-four hours.

Three things a small firm should do, none of which are expensive

1. Find out which of your suppliers will be in scope. Your IT provider, your hosting, your practice management system's hosting. Ask them directly, in writing, whether they expect to be a relevant managed service provider and what they expect to require of clients. The quality of the answer is itself a supplier check — and the supplier signals we watch are the other half of it.
2. Write down who gets the call at 2am on a Saturday. A 24-hour clock that starts on awareness means someone must be able to be made aware. One name, one number, one deputy.
3. Know what you have. The most common reason a firm cannot report inside 24 hours is not slowness; it is that nobody can say what systems exist or what they connect to. The stack check and the cleanup work both start here, because you cannot assess an impact on an inventory you do not have.

What this does not tell you

It is a bill, not an Act. The detail, the thresholds for "medium and large", and the commencement dates will move, and anyone quoting you a compliance date today is guessing. The government's own estimate is that the legislation costs less than £150 million per year across everyone in scope, which is a small number for a national regime and tells you the direct burden is concentrated on relatively few organisations.

What is not a guess is the direction: the obligations flow down the supply chain by contract faster than they arrive by statute, and they arrive at the small firm as paperwork it did not negotiate. The firms that handle this well are the ones that already know what they run and who answers the phone. That is not a security project; it is an operations one.