Meet your duties under the NIS Regulations

The Network and Information Systems Regulations 2018 (the NIS Regulations) put security and incident reporting duties on two kinds of organisation: operators of essential services (OES) and relevant digital service providers (RDSP).

Check whether the Regulations cover you

You are an OES if you provide an essential service in energy, transport, health, drinking water supply or digital infrastructure, the service relies on network and information systems, and you meet the threshold set for that kind of service. Thresholds are in Schedule 2 to the Regulations and are measured in things like customers supplied, throughput or capacity. If you meet one, you are treated as designated without being told. You must notify your competent authority in writing within 3 months of meeting it.

A competent authority can also designate you below the threshold if an incident affecting your service would be likely to have significant disruptive effects. It does this by written notice, giving reasons. Each integrated care board in England is an OES. If you believe you no longer qualify, you must tell your competent authority as soon as practicable and send evidence.

You are an RDSP if you provide an online marketplace, an online search engine or a cloud computing service in the UK and you are not a micro or small enterprise. You must register with the Information Commission (formerly the ICO), here called the Commission, within 3 months of meeting those conditions. An RDSP based outside the UK that offers these services here must nominate a UK representative.

Know who regulates you

Each sector has a competent authority that supervises you, publishes guidance you must have regard to and can enforce the Regulations. The Commission supervises RDSPs. The National Cyber Security Centre (NCSC) is the UK's technical authority and national incident response team; it is not a regulator.

Secure your network and information systems

If you are an OES, you must take appropriate and proportionate technical and organisational measures to manage the risks to the systems your essential service relies on, and to prevent and minimise the impact of incidents so the service continues. The measures must reflect the state of the art and be right for the level of risk. You must have regard to your competent authority's guidance.

Most competent authorities assess OES against the NCSC Cyber Assessment Framework (CAF). It sets 14 outcome-based principles under four objectives: managing security risk, protecting against cyber attack, detecting cyber security events, and minimising the impact of incidents. You can self-assess against it, or your regulator or an assessor working for it may do so. The NCSC advises regulated organisations to check with their regulator whether to use the CAF, so ask your competent authority what it expects.

If you are an RDSP, you must identify and manage the risks to the systems your service relies on, to a level appropriate to the risk. The measures must cover the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards.

Your regulator can serve an information notice and inspect you. You must provide the information, co-operate with the inspector and give access to premises, documents and staff. It can require you to pay the reasonable costs of an inspection.

Report significant incidents

An RDSP need only notify if it has the information to assess the impact, and you need only give what you can reasonably be expected to know. An OES that depends on an RDSP must also tell its competent authority, without undue delay, about any significant impact on its service caused by an incident at that RDSP.

If the incident involves a personal data breach, report it separately to the Commission under UK GDPR. That report is also due within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. A NIS notification does not replace it.

What happens if you do not comply

Your regulator can serve an information notice, inspect you and serve an enforcement notice setting out what you must put right and by when. Before it does, it must tell you the alleged failure and how to make representations. A penalty is a separate step: the regulator serves a notice of intention, considers your representations, then a penalty notice with a payment period.

The maximum depends on the breach. It is £1 million for a contravention that is not material, and £8.5 million for a material one, such as not taking the steps in an enforcement notice. The highest tier applies where a material contravention has or could have created a significant risk to, or impact on, the service. You can appeal a designation or a penalty decision to the First-tier Tribunal.