The Cyber Security and Resilience Bill probably will not regulate most CCTV installers directly, but it will raise the security bar around connected systems. Clients, insurers and IT teams are already becoming more interested in how IP cameras, recorders and remote access are set up.

The Bill updates the Network and Information Systems Regulations 2018. It is mainly aimed at essential services, digital services, data centres, managed service providers, large load controllers and certain critical suppliers. A typical installer fitting CCTV for homes, shops or small offices is unlikely to be directly in scope. The knock-on effect still matters, because every IP camera, NVR and remote viewing app added to a client network becomes part of their attack surface.

That is the practical point. You are not the main target of the Bill, but the expectations it sets will ripple through procurement questions, insurance checks and customer due diligence. If you fit modern IP security cameras, the questions are coming.

What the Bill changes

The Bill was introduced to Parliament on 12 November 2025. By late June 2026, it had completed its Commons stages and was in the House of Lords. You can follow its progress on the Parliament site, and read the official overview on GOV.UK.

The Bill widens the UK cyber resilience regime and gives regulators stronger tools. It also introduces faster incident reporting for regulated entities, with an initial notice within 24 hours and a fuller report within 72 hours. These duties are for organisations in scope, not every CCTV installer, but they set the tone for suppliers who connect systems to business networks.

Why this lands on installers

Picture a job you finished last year. You fitted cameras and a recorder for a parts supplier that sells into a utility company. This summer, the supplier’s insurer sends a cyber questionnaire. One section asks about the camera network: whether default passwords were changed, whether firmware is kept current, whether remote access is exposed to the internet, and who has admin rights.

If you cannot answer cleanly, that is an awkward call. It is the sort of issue worth covering in the questions to ask before a large install.

This is really about basic cyber hygiene on the systems you already sell. It also lines up with what is changing in CCTV specs and compliance more broadly.

The basics worth getting right now

None of this needs to be overcomplicated. The UK’s product security rules already place duties on manufacturers, importers and distributors of consumer connectable products. Those rules include banning universal default and easily guessable passwords, publishing vulnerability reporting routes and stating minimum security update periods.

For installers, the practical checklist is simple:

• Change every default password and use unique credentials per device

• Keep firmware patched and avoid end-of-life cameras with no updates

• Put CCTV equipment on a separate VLAN where the client network allows it

• Avoid open port forwarding for remote access

• Use secure remote access methods, with strong passwords and multi-factor authentication where available

• Record who has admin access and remove old users when staff change

• Choose manufacturers with clear firmware support and vulnerability handling

Hardware choice matters. Reliable IP NVRs with proper user permissions and current firmware, plus the right CCTV networking accessories, make a secure setup far easier. This is also where NDAA compliant CCTV matters, because more clients now ask where their equipment comes from.

If you are moving customers away from older analogue systems, our notes on upgrading from analogue to IP cover the practical side. Cheap kit with poor support is where you run into problems from poor quality equipment. The supplier you buy from matters too, which is the difference between a box shifter and a trade partner when a client’s security questionnaire lands.

FAQs

Does the Cyber Security and Resilience Bill apply to CCTV installers?
For most installers, no. It is aimed at regulated essential and digital services, but it may affect you through clients who are in scope or supply organisations that are.

Can IP CCTV cameras be hacked?
Yes. Cameras and recorders are more exposed when they use weak passwords, old firmware or insecure remote access.

What is the safest way to set up remote CCTV access?
Avoid open port forwarding. Use a secure manufacturer service or a VPN, with unique strong credentials and multi-factor authentication where possible.

Do I need to change default camera passwords by law?
Universal default and easily guessable passwords are already restricted under UK product security rules. In practice, installers should change passwords as standard.

Stay ahead of the questions

Build your installs around secure, well-supported kit and you can answer the hard questions without breaking stride. Talk to FVS CCTV, an independent CCTV distributor that backs installers with current systems, proper support and practical technical advice.