NIS Regulations: compliance for operators of essential services

The Network and Information Systems (NIS) Regulations 2018 impose cyber security and incident reporting obligations on operators of essential services (OES) and relevant digital service providers (RDSP). These regulations aim to protect the UK's critical national infrastructure from cyber threats.

If you operate in energy, transport, water, health, or digital infrastructure sectors, you may be designated as an OES with specific compliance obligations. This guide explains how to determine if you are in scope, what compliance requires, and how to meet your incident notification duties.

Who the NIS Regulations apply to

The regulations create two categories of regulated entities with different obligations:

• Operators of essential services (OES) - Organisations designated by a competent authority as providing essential services that depend on network and information systems
• Relevant digital service providers (RDSP) - Online marketplaces, online search engines, and cloud computing services above certain thresholds

OES are subject to more stringent requirements and oversight than RDSP. Your sector competent authority will notify you if you are designated as an OES.

Competent authorities and the CAF

Each sector has a designated competent authority responsible for identifying OES, setting sector-specific guidance, and enforcing compliance:

NCSC role: The National Cyber Security Centre (NCSC) is the UK's single point of contact for NIS matters and the Computer Security Incident Response Team (CSIRT), providing technical guidance and incident response support across all sectors.

The NCSC Cyber Assessment Framework (CAF)

Competent authorities use the NCSC CAF to assess OES compliance across 14 core principles:

What CAF assessment involves:

• Your competent authority may conduct assessments directly or require self-assessment against CAF principles
• Assessment considers your specific context, threat environment, and the criticality of your services
• You must demonstrate appropriate and proportionate security measures for your risk profile
• CAF uses a maturity model approach - the expected level depends on your sector and service criticality

Preparing for CAF assessment:

1. Review the NCSC CAF guidance and understand the 14 principles
2. Conduct a gap analysis against each principle's Indicators of Good Practice
3. Document your security measures and evidence of their effectiveness
4. Identify and address gaps before formal assessment
5. Engage with your competent authority early to understand sector-specific expectations

Incident notification requirements

OES and RDSP must notify their competent authority of significant incidents affecting service continuity or security. This is separate from (and additional to) GDPR data breach notification.

What constitutes a reportable incident

For OES: An incident with significant impact on essential service continuity. For RDSP: An incident with substantial impact on digital service provision. Consider: number of users affected, duration, geographic spread, and economic impact.

When in doubt, report: Competent authorities prefer precautionary notifications over unreported significant incidents.

Dual notification obligations

A single cyber incident may trigger notification requirements under both NIS Regulations and UK GDPR:

Practical implication: A ransomware attack on an NHS trust, for example, could require notification to NHS England (NIS competent authority), the ICO (GDPR data breach), and affected patients (if high risk to their rights). Establish clear incident response procedures that address both regulatory frameworks.

Penalties and enforcement

Competent authorities have significant enforcement powers under the NIS Regulations. While the focus is on improving security posture rather than punitive action, persistent non-compliance carries serious consequences.

Enforcement in practice

Competent authorities typically take a proportionate approach:

1. Assessment and guidance - Initial focus on identifying gaps and providing improvement guidance
2. Improvement plans - Where deficiencies exist, you may be required to submit and implement an improvement plan with defined timescales
3. Follow-up inspection - Verification that improvements have been made
4. Enforcement notices - If improvement plans are not followed, formal enforcement action
5. Penalty notices - Reserved for serious, persistent, or wilful non-compliance

Organisations that engage constructively with their competent authority, acknowledge shortcomings, and demonstrate genuine efforts to improve are unlikely to face maximum penalties.

Compliance roadmap for OES

If you have been designated as an OES or believe you may be in scope, follow this roadmap: