--- title: Preparing for the Cyber Security and Resilience Bill... description: A discussion of the UK's proposed Cyber Security and Resilience Bill (CSRB), which updates NIS regulations to expand coverage of critical infrastructure... canonical: https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Preparing for the Cyber Security and Resilience Bill (CSRB): Compliance Insights from the Field | daily.dev og:description: A discussion of the UK's proposed Cyber Security and Resilience Bill (CSRB), which updates NIS regulations to expand coverage of critical infrastructure... og:url: https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli og:image: https://api.daily.dev/og/posts/6BdIeUCLI.png og:image:alt: Preparing for the Cyber Security and Resilience Bill (CSRB): Compliance Insights from the Field og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Preparing for the Cyber Security and Resilience Bill (CSRB): Compliance Insights from the Field **[Teleport](https://daily.dev/sources/teleport)** · 7 min read · 0 upvotes · 0 comments ## Summary A discussion of the UK's proposed Cyber Security and Resilience Bill (CSRB), which updates NIS regulations to expand coverage of critical infrastructure sectors, tighten incident reporting timelines (24-hour initial notification, 72-hour full report), and demand stronger supply chain security and access auditability. Drawing on customer conversations, the piece highlights common gaps like shared VPN credentials, stale SSH keys, and lack of visibility into who accessed what. It then presents Teleport's certificate-based authentication, unified access management, just-in-time access, and audit trail features as ways organizations are addressing these requirements, including a case study of a financial services firm cutting third-party access provisioning from days to minutes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are the incident reporting deadlines under the UK Cyber Security and Resilience Bill? Organizations will need to submit an initial notification within 24 hours of a cyber incident and a full incident report within 72 hours. This includes detailed information about the incident and, in some cases, notifying affected customers. Many organisations currently lack the access logging needed to reconstruct who accessed what before a breach within that window. _Teams tracking regulatory deadlines like this follow compliance and security developments on daily.dev._ ### What are common access control problems that make organizations non-compliant with cyber security regulations like the CSRB? Typical issues include shared VPN credentials among third-party vendors, SSH keys that remain active years after an employee leaves, database passwords stored in configuration files, and Kubernetes service account tokens that never expire. One organization reported managing 47 third-party vendors through shared credentials and VPNs rather than individual, auditable access, a pattern regulators are now targeting. _Engineers hardening access controls against real-world gaps like these follow security practices on daily.dev._ ## Similar posts on daily.dev - [Canada’s Bill C-8 redefines critical infrastructure security](https://daily.dev/posts/canada-s-bill-c-8-redefines-critical-infrastructure-security-hmnhwwo2e) · Tenable Blog · 0 upvotes · 0 comments - [EU’s Cyber Resiliency Act will put IT leaders to the test](https://daily.dev/posts/eu-s-cyber-resiliency-act-will-put-it-leaders-to-the-test-ufqkjfyfz) · CSO Online · 0 upvotes · 0 comments - [The Cyber Resilience Act and SaaS: Why Compliance is Only Half the Battle](https://daily.dev/posts/the-cyber-resilience-act-and-saas-why-compliance-is-only-half-the-battle-l7kcacs4t) · Security Boulevard · 0 upvotes · 0 comments - [Cyber Resilience Act Compliance \(CRA\) with Aikido Security](https://daily.dev/posts/cyber-resilience-act-compliance-cra-with-aikido-security-0yzywsub3) · Aikido Security · 0 upvotes · 0 comments --- Tags: [#compliance](https://daily.dev/tags/compliance) [View this post on daily.dev](https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Preparing for the Cyber Security and Resilience Bill (CSRB): Compliance Insights from the Field","url":"https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli"},"datePublished":"2026-08-23T12:23:04.069Z","dateModified":"2026-08-23T12:47:12.564Z","description":"A discussion of the UK's proposed Cyber Security and Resilience Bill (CSRB), which updates NIS regulations to expand coverage of critical infrastructure...","image":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","thumbnailUrl":"https://media.daily.dev/image/upload/s--CxzD6vbw--/f_auto/v1722860399/public/Placeholder%2005","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"compliance","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Preparing for the Cyber Security and Resilience Bill (CSRB): Compliance Insights from the Field"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/preparing-for-the-cyber-security-and-resilience-bill-csrb-compliance-insights-from-the-field-6bdieucli#faq","mainEntity":[{"@type":"Question","name":"What are the incident reporting deadlines under the UK Cyber Security and Resilience Bill?","acceptedAnswer":{"@type":"Answer","text":"Organizations will need to submit an initial notification within 24 hours of a cyber incident and a full incident report within 72 hours. This includes detailed information about the incident and, in some cases, notifying affected customers. Many organisations currently lack the access logging needed to reconstruct who accessed what before a breach within that window. Teams tracking regulatory deadlines like this follow compliance and security developments on daily.dev."}},{"@type":"Question","name":"What are common access control problems that make organizations non-compliant with cyber security regulations like the CSRB?","acceptedAnswer":{"@type":"Answer","text":"Typical issues include shared VPN credentials among third-party vendors, SSH keys that remain active years after an employee leaves, database passwords stored in configuration files, and Kubernetes service account tokens that never expire. One organization reported managing 47 third-party vendors through shared credentials and VPNs rather than individual, auditable access, a pattern regulators are now targeting. Engineers hardening access controls against real-world gaps like these follow security practices on daily.dev."}}]} ```