What is a 'Relevant Managed Service Provider'? A closer look at the CSR Bill's new category

6 August 2026

Tuesday's post covered the Cyber Security and Resilience Bill in full. This one answers the question we'd expect people to actually search for once that's live: what does it mean, in practice, to be caught by the Bill's new 'Relevant Managed Service Provider' category?

The short version
If a business manages another organisation's IT systems on an ongoing, contracted basis, network management, cloud administration, security monitoring, that's the shape of activity the Bill is targeting. It's not about one-off project work or selling hardware, it's about ongoing operational control over someone else's systems. That's precisely the relationship Maple has with every client we support.

Why the definition matters more than it looks like it should
A lot of the commentary on the Bill has focused on the headline obligations, incident reporting, risk management, and skipped past the definition question. But the definition is what decides whether any of that applies to a given provider at all. Two IT companies can look similar from the outside and land on opposite sides of the line depending on the exact nature of their contracts and how much ongoing access and control they hold.

What this means if you're evaluating a provider
If you're a finance sector firm choosing or reviewing an IT provider, this is a genuinely useful filter. Ask directly: does this provider consider themselves in scope for the CSR Bill, and why or why not? A provider who's thought this through and can answer clearly is telling you something about how seriously they take regulatory change generally, not just this one Bill.

Where we land
Maple's relationship with clients, ongoing management, security monitoring, direct access to systems, sits squarely inside the intended scope. We'd rather be ahead of that than arguing about definitions after the fact.

We'll post again once the secondary legislation clarifies the exact thresholds.