The Cyber Security and Resilience Bill is set to give UK ministers new powers to block “high-risk” technology suppliers from critical infrastructure, and the government tabled amendments to the Bill on 24 August 2026 that underline how urgently it wants those powers in place. The legislation has been framed around digital supply chains, cloud services and managed IT providers, but the underlying principle, that a vendor’s country of origin, ownership structure or security posture can create a systemic risk, applies just as directly to the physical security technology many organisations already have installed.
CCTV cameras, access control systems, alarm panels and visitor management platforms are all networked devices with firmware, cloud connectivity and, in many cases, remote maintenance access built in. A camera system supplied by a vendor later designated high-risk under the new powers would not be exempt simply because its primary function is physical rather than digital security.
Why this matters beyond the suppliers named in the Bill
The Bill’s initial focus is on digital infrastructure providers, but its supply-chain logic sets a precedent that security procurement teams should anticipate reaching physical security hardware before long. Several other jurisdictions have already restricted specific camera and access-control brands from government and critical-site use over similar national security concerns, and UK policy has tended to follow that direction with a lag rather than diverge from it. Organisations installing or renewing CCTV, access control or alarm systems now should treat supplier due diligence, not just product specification, as part of the procurement decision, particularly for sites that fall within scope of critical national infrastructure or essential-services regulation.
What a sensible physical security procurement review looks like
A practical audit does not require waiting for a formal government list of restricted vendors. It means knowing who manufactures and maintains the cameras, access control and alarm systems on a site, understanding what data those systems collect and where it is processed, and confirming whether remote maintenance access exists and how it is controlled. For sites already covered by NIS Regulations or handling sensitive data, this kind of supplier transparency is likely to become an explicit expectation rather than good practice left to individual operators. The government’s published material on the Cyber Security and Resilience Bill and ongoing reporting from Infosecurity Magazine are useful for tracking how the powers develop as the Bill progresses through Parliament.
Our corporate security team advises on physical security system procurement, including supplier due diligence, for organisations that need their CCTV and access control choices to withstand this level of scrutiny.
None of this means ripping out existing systems on the assumption they will eventually be caught by future restrictions. It means building supplier transparency into the next procurement cycle rather than the one after a formal restriction is announced, at which point replacement becomes a forced, urgent cost rather than a planned one. Organisations that already hold a clear record of their physical security supply chain, manufacturer, integrator and maintenance provider, will find that record far more useful than a scramble to reconstruct it once a deadline is set.
Need a security review?
If your organisation wants to review the supply chain behind its physical security systems ahead of tighter regulation, our team is happy to help. Call us on 020 3700 0967, email info@secureonsitesecurity.co.uk, or visit our contact page. Related services:
- Corporate security services for organisations reviewing physical security procurement.
- Site security for facilities within scope of critical infrastructure regulation.
- Manned guarding to complement technology-based access control.
The Cyber Security and Resilience Bill is written around digital suppliers today, but the same high-risk supplier logic is unlikely to stay confined to software for long, and organisations reviewing their physical security systems now will be better placed than those waiting for a government list to make the decision for them.
Recent Comments