The UK Cyber Security and Resilience Bill is reshaping supply-chain security for SMEs. Plain-English guide to scope, the 24/72-hour rule, and 5 things to do now.