Legalize / United Kingdom / Statutory-Instrument

The Network and Information Systems Regulations 2018

Type Statutory-Instrument

Publication 2018-04-19

Last updated 2024-05-25

State In force

Department King's Printer of Acts of Parliament

Source legislation.gov.uk

PDF Download

articles Not indexed

Reform history JSON API

Made: 19th April 2018

Laid before Parliament: 20th April 2018

Coming into force: 10th May 2018

The Secretary of State is a Minister designated for the purposes of section 2(2) of the European Communities Act 1972 (“the 1972 Act”) in relation to electronic communications.

These Regulations make provision for a purpose mentioned in section 2(2) of the 1972 Act and it appears to the Secretary of State that it is expedient for certain references to provisions of EU instruments to be construed as references to those provisions as amended from time to time.

The Secretary of State makes the following Regulations in exercise of the powers conferred by section 2(2) of, and paragraph 1A of Schedule 2 to, the 1972 Act and by section 56 of the Finance Act 1973 (“the 1973 Act”) and, in the case of section 56 of the 1973 Act, with the consent of the Treasury.

PART 1 — Introduction

Citation, commencement, interpretation and application

1

(1) These Regulations may be cited as the Network and Information Systems Regulations 2018 and come into force on 10th May 2018.

(2) In these Regulations—

“cloud computing service” means a digital service that enables access to a scalable and elastic pool of shareable computing resources;

“the Commission” means the Commission of the European Union;

“EU Regulation 2018/151” means Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact;

“Cooperation Group” means the group established under Article 11(1);

“CSIRTs network” means the network established under Article 12(1);

“digital service” means a service within the meaning of point (b) of Article 1(1) of Directive 2015/1535 which is of any the following kinds—online marketplace;online search engine;cloud computing service;

“digital service provider” means any person who provides a digital service;

“Directive 2013/11” means Directive 2013/11/EU of the European Parliament and of the Council on alternative dispute resolution for consumer disputes , and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC, as amended from time to time;

“Directive 2015/1535” means Directive (EU) 2015/1535 of the European Parliament and of the Council laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services , as amended from time to time;

“Directive 2016/1148” means Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union , as amended from time to time;

“Drinking Water Quality Regulator for Scotland” means the person appointed by the Scottish Ministers under section 7(1) of the Water Industry (Scotland) Act 2002 ;

“essential service” means a service which is essential for the maintenance of critical societal or economic activities;

“First-tier Tribunal” has the meaning given by section 3(1) of the Tribunals, Courts and Enforcement Act 2007;

“GCHQ” means the Government Communications Headquarters within the meaning of section 3 of the Intelligence Services Act 1994 ;

“incident” means any event having an actual adverse effect on the security of network and information systems;

“network and information system” (“NIS”) means—an electronic communications network within the meaning of section 32(1) of the Communications Act 2003 ;any device or group of interconnected or related devices, one or more of which, pursuant to a program, perform automatic processing of digital data; ordigital data stored, processed, retrieved or transmitted by elements covered under paragraph (a) or (b) for the purposes of their operation, use, protection and maintenance;

“OES” (“operator of an essential service”) means a person who is deemed to be designated as an operator of an essential service under regulation 8(1) or (2A) or is designated as an operator of an essential service under regulation 8(3);

“online marketplace” means a digital service that allows consumers and/or traders as respectively defined in point (a) and in point (b) of Article 4(1) of Directive 2013/11 to conclude online sales or service contracts with traders either on the online marketplace's website or on a trader's website that uses computing services provided by the online marketplace;

“online search engine” means a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found;

“relevant law-enforcement authority” has the meaning given in section 63A(1A) of the Police and Criminal Evidence Act 1984 ; and

“representative” means any natural or legal person established in the United Kingdom who is able to act on behalf of a digital service provider established outside the United Kingdom with regard to its obligations under these Regulations; and

“risk” means any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems.

(3) In these Regulations a reference to—

(a) an Article, Annex or paragraph of an Article or Annex is a reference to the Article, Annex or paragraph as numbered in Directive 2016/1148.

(b) a numbered regulation, paragraph or Schedule is a reference to the regulation, paragraph or Schedule as numbered in these Regulations;

(c) “the relevant authorities in a Member State” is a reference to the designated single point of contact (“SPOC”), computer security incident response team (“CSIRT”) or national competent authorities for that Member State;

(d) the “designated competent authority for an OES” is a reference to the competent authority that is designated under regulation 3(1) for the subsector in relation to which that OES provides an essential service;

(e) a “relevant digital service provider” (“RDSP”) is a reference to a person who provides a digital service in the United Kingdom and satisfies the following conditions—

(i) the head office for that provider is in the United Kingdom or that provider has nominated a representative who is established in the United Kingdom;

(ii) the provider is not a micro or small enterprise as defined in Commission Recommendation 2003/361/EC ;

(f) the “NIS enforcement authorities” is a reference to the competent authorities designated under regulation 3(1) and the Information Commissioner;

(g) “security of network and information systems” means the ability of network and information systems to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems.

(4) Expressions and words used in these Regulations which are also used in Directive 2016/1148 have the same meaning as in Directive 2016/1148.

(5) Nothing in these Regulations prevents a person from taking an action (or not taking an action) which that person considers is necessary for the purposes of safeguarding the United Kingdom's essential State functions, in particular—

(a) safeguarding national security, including protecting information the disclosure of which the person considers is contrary to the essential interests of the United Kingdom's security; and

(b) maintaining law and order, in particular, to allow for the investigation, detection and prosecution of criminal offences .

(6) These Regulations apply to—

(a) the United Kingdom, including its internal waters;

(b) the territorial sea adjacent to the United Kingdom;

(c) the sea (including the seabed and subsoil) in any area designated under section 1(7) of the Continental Shelf Act 1964 .

PART 2 — The National Framework

The NIS national strategy

2

(1) A Minister of the Crown must designate and publish a strategy to provide strategic objectives and priorities on the security of network and information systems in the United Kingdom (“the NIS national strategy”).

(2) The strategic objectives and priorities set out in the NIS national strategy must be aimed at achieving and maintaining a high level of security of network and information systems in—

(a) the sectors specified in column 1 of the table in Schedule 1 (“the relevant sectors”); and

(b) digital services.

(3) The NIS national strategy may be published in such form and manner as the Minister considers appropriate.

(4) The NIS national strategy may be reviewed by the Minister at any time and, if it is revised following such a review, the Minister must designate and publish a revised NIS national strategy as soon as reasonably practicable following that review.

(5) The NIS national strategy must, in particular, address the following matters—

(a) the regulatory measures and enforcement framework to secure the objectives and priorities of the strategy;

(b) the roles and responsibilities of the key persons responsible for implementing the strategy;

(c) the measures relating to preparedness, response and recovery, including cooperation between public and private sectors;

(d) education, awareness-raising and training programmes relating to the strategy;

(e) research and development plans relating to the strategy;

(f) a risk assessment plan identifying any risks; and

(g) a list of the persons involved in the implementation of the strategy.

(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7) Before publishing the NIS national strategy ..., the Minister may redact any part of it which relates to national security.

(8) In this regulation “a Minister of the Crown” has the same meaning as in section 8(1) of the Ministers of the Crown Act 1975 .

Designation of national competent authorities

3

(1) The person specified in column 3 of the table in Schedule 1 is designated as the competent authority, for the territorial jurisdiction indicated in that column, and for the subsector specified in column 2 of that table (“the designated competent authorities”).

(2) The Information Commissioner is designated as the competent authority for the United Kingdom for RDSPs.

(3) In relation to the subsector for which it is designated under paragraph (1), the competent authority must—

(a) review the application of these Regulations;

(b) prepare and publish guidance;

(c) keep a list of all the operators of essential services who are designated, or deemed to be designated, under regulation 8 ...;

(d) keep a list of all the revocations made under regulation 9;

(e) send a copy of the lists mentioned in sub-paragraphs (c) and (d) to GCHQ, as the SPOC designated under regulation 4, to enable it to prepare the report mentioned in regulation 4(3);

(f) consult and co-operate with the Information Commissioner when addressing incidents that result in breaches of personal data; and

(g) in order to fulfil the requirements of these Regulations, consult and co-operate with—

(i) relevant law-enforcement authorities;

(ii) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(iii) other competent authorities in the United Kingdom;

(iv) the SPOC that is designated under regulation 4; and

(v) the CSIRT that is designated under regulation 5.

(3A) In relation to the subsector for which it is designated under paragraph (1), the competent authority may consult and co-operate with a public authority in the EU if it is in the interests of effective regulation of that subsector (whether inside or outside the United Kingdom).

(4) In relation to digital services, the Information Commissioner must—

(a) review the application of these Regulations;

(b) prepare and publish guidance; and

(c) consult and co-operate with the persons mentioned in paragraph (3)(g), in order to fulfil the requirements of these Regulations.

(5) The guidance that is published ... under paragraph (3)(b) or (4)(b) may be—

(a) published in such form and manner as the competent authority or Information Commissioner considers appropriate; and

(b) reviewed at any time, and if it is revised following such a review, the competent authority or Information Commissioner must publish revised guidance as soon as reasonably practicable.

(6) The competent authorities designated under paragraph (1) and the Information Commissioner must have regard to the national strategy that is published under regulation 2(1) when carrying out their duties under these Regulations.

Designation of the single point of contact

4

(1) GCHQ is designated as the SPOC on the security of network and information systems for the United Kingdom.

(2) The SPOC may liaise with the relevant authorities in any Member State of the EU, the Cooperation Group and the CSIRTs network if it considers it appropriate.

(2A) The SPOC must—

(a) consult and co-operate, as it considers appropriate, with relevant law enforcement authorities;

(b) co-operate with the NIS enforcement authorities to enable the enforcement authorities to fulfil their obligations under these Regulations.

(3) The SPOC may, if it considers it appropriate to do so submit reports to—

(a) the Cooperation Group based on the incident reports it received under regulation 11(9) and 12(15), including the number of notifications and the nature of notified incidents; and

(b) the Commission identifying the number of operators of essential services for each subsector listed in Schedule 2 ....

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Designation of computer security incident response team

5

(1) GCHQ is designated as the CSIRT for the United Kingdom in respect of the relevant sectors and digital services.

(2) The CSIRT must—

(a) monitor incidents in the United Kingdom;

(b) provide early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents;

(d) provide dynamic risk and incident analysis and situational awareness;

(e) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(f) establish relationships with the private sector to facilitate co-operation with that sector;

(g) promote the adoption and use of common or standardised practices for—

(i) incident and risk handling procedures, and

(ii) incident, risk and information classification schemes; and

(h) co-operate with NIS enforcement authorities to enable the enforcement authorities to fulfil their obligations under these Regulations.

(3) The CSIRT may co-operate with or participate in international co-operation networks (including the CSIRTs network) if the CSIRT considers it appropriate to do so.

6

(1) The NIS enforcement authorities may share information with each other, relevant law-enforcement authorities, the CSIRT, and public authorities in the EU if that information sharing is—

(a) necessary for—

(i) the purposes of these Regulations or of facilitating the performance of any functions of a NIS enforcement authority under or by virtue of these Regulations or any other enactment;

(ii) national security purposes; or

(iii) purposes related to the prevention or detection of crime, the investigation of an offence or the conduct of a prosecution;

(b) limited to information which is relevant and proportionate to the purpose of the information sharing.

(1A) Information shared under paragraph (1) may not be further shared by the person with whom it is shared under that paragraph for any purpose other than a purpose mentioned in that paragraph unless otherwise agreed by the NIS enforcement authority.

(2) When sharing information with a public authority in the EU under paragraph (1), the NIS enforcement authorities are not required to share—

(a) confidential information, or

(b) information which may prejudice the security or commercial interests of operators of essential services or digital service providers.

7

(1) In order to facilitate the exercise of the Northern Ireland competent authority's functions under these Regulations—

(a) a Northern Ireland Department may share information with the Northern Ireland competent authority; and

(b) the Northern Ireland competent authority may share information with a Northern Ireland Department.

(2) In this regulation—

(a) “the Northern Ireland competent authority” means the competent authority that is specified for Northern Ireland in column 3 of the table in Schedule 1 in relation to the subsectors specified in column 2 of that table; and

(b) “a Northern Ireland Department” means a department mentioned in Schedule 1 to the Departments Act (Northern Ireland) 2016 .

PART 3 — Operators of essential services

Identification of operators of essential services

8

(1) If a person provides an essential service of a kind referred to in ... Schedule 2 and that service—

(a) relies on network and information systems; and

(b) satisfies a threshold requirement described for that kind of essential service,

that person is deemed to be designated as an OES for the subsector that is specified with respect to that essential service in that Schedule.

(1A) Paragraph (1) does not apply to a network provider or service provider who is subject to the requirements of sections 105A to 105C of the Communications Act 2003 and in this paragraph “network provider” and “service provider” have the meanings given in section 105A(5) of that Act.

(2) A person who falls within paragraph (1) must notify the designated competent authority in writing of that fact before the notification date.

(2A) Each integrated care board is deemed to be designated as an OES for the healthcare settings subsector and, in relation to an integrated care board, any services provided by it (including the making of arrangements for the provision of services by others) are deemed to be essential services.

(3) Even if a person does not meet the threshold requirement mentioned in paragraph (1)(b), a competent authority may designate that person as an OES for the subsector in relation to which that competent authority is designated under regulation 3(1), if the following conditions are met—

(a) that person provides an essential service of a kind specified in ... Schedule 2 for the subsector in relation to which the competent authority is designated under regulation 3(1);

(b) the provision of that essential service by that person relies on network and information systems; and

(c) the competent authority concludes that an incident affecting the provision of that essential service by that person is likely to have significant disruptive effects on the provision of the essential service.

(4) In order to arrive at the conclusion mentioned in paragraph (3)(c), the competent authority must have regard to the following factors—

(a) the number of users relying on the service provided by the person;

(b) the degree of dependency of the other relevant sectors on the service provided by that person;

(c) the likely impact of incidents on the essential service provided by that person, in terms of its degree and duration, on economic and societal activities or public safety;

(d) the market share of the essential service provided by that person;

(e) the geographical area that may be affected if an incident impacts on the service provided by that person;

(f) the importance of the provision of the service by that person for maintaining a sufficient level of that service, taking into account the availability of alternative means of essential service provision;

(g) the likely consequences for national security if an incident impacts on the service provided by that person; and

(h) any other factor the competent authority considers appropriate to have regard to, in order to arrive at a conclusion under this paragraph.

(5) A competent authority must designate an OES under paragraph (3) by notice in writing served on the person who is to be designated and provide reasons for the designation in the notice.

(6) Before a competent authority designates a person as an OES under paragraph (3), the authority may—

(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(b) invite the person to submit any written representations about the proposed decision to designate it as an OES.

(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(7A) If a person has reasonable grounds to believe that they no longer fall within paragraph (1) or that the conditions for designation under paragraph (3) are no longer met in relation to them, they must as soon as practicable notify the designated competent authority in writing and provide with that notification evidence supporting that belief.

(7B) A competent authority that receives from a person a notification and supporting evidence referred to in paragraph (7A) must have regard to that notification and evidence in considering whether to revoke that person’s designation.

(8) A competent authority must maintain a list of all the persons who are deemed to be designated under paragraph (1) or (2A) or designated under paragraph (3) for the subsectors in relation to which that competent authority is designated under regulation 3(1).

(9) The competent authority must review the list mentioned in paragraph (8) at regular intervals and in accordance with paragraph (10).

(10) The first review under paragraph (9) must take place before 9th May 2020, and subsequent reviews must take place, at least, biennially.

(11) In this regulation the “notification date” means—

(a) 10th August 2018, in the case of a person who falls within paragraph (1) on the date these Regulations come into force; or

(b) in any other case, the date three months after the date on which the person falls within that paragraph.

Revocation

9

(1) Even if a person is deemed to be designated as an OES under regulation 8(1), the designated competent authority for the OES may revoke the deemed designation , by notice in writing, if the authority concludes that an incident affecting the provision of that essential service by that person is not likely to have significant disruptive effects on the provision of the essential service.

(2) The designated competent authority for an OES may revoke the designation of that OES under regulation 8(3), by notice in writing, if the conditions mentioned in that regulation are no longer met by that person.

(3) Before revoking a deemed designation of a person as an OES under regulation 8(1), or a designation of a person as an OES under regulation 8(3), the competent authority must—

(a) serve a notice in writing of proposed revocation on that person;

(b) provide reasons for the proposed decision;

(c) invite that person to submit any written representations about the proposed decision within such time period as may be specified by the competent authority; and

(d) consider any representations submitted by the person under sub-paragraph (c) before a final decision is taken to revoke the designation.

(4) In order to arrive at the conclusion mentioned in paragraph (1), the competent authority must have regard to the factors mentioned in regulation 8(4).

(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

The security duties of operators of essential services

10

(1) An OES must take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies.

(2) An OES must take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of an essential service, with a view to ensuring the continuity of those services.

(3) The measures taken under paragraph (1) must, having regard to the state of the art, ensure a level of security of network and information systems appropriate to the risk posed.

(4) Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) and (2).

The duty to notify incidents

11

(1) An OES must notify the designated competent authority for the OES in writing about any incident which has a significant impact on the continuity of the essential service which that OES provides (“a network and information systems (“NIS”) incident”).

(2) In order to determine the significance of the impact of an incident an OES must have regard to the following factors—

(a) the number of users affected by the disruption of the essential service;

(b) the duration of the incident; and

(3) The notification mentioned in paragraph (1) must—

(a) provide the following—

(i) the operator's name and the essential services it provides;

(ii) the time the NIS incident occurred;

(iii) the duration of the NIS incident;

(iv) information concerning the nature and impact of the NIS incident;

(v) information concerning any, or any likely, cross-border impact of the NIS incident; and

(vi) any other information that may be helpful to the competent authority; and

(b) be provided to the competent authority—

(i) without undue delay and in any event no later than 72 hours after the operator is aware that a NIS incident has occurred; and

(ii) in such form and manner as the competent authority determines.

(4) The information to be provided by an OES under paragraph (3)(a) is limited to information which may reasonably be expected to be within the knowledge of that OES.

(5) After receipt of a notification under paragraph (1), the competent authority must—

(a) assess what further action, if any, is required in respect of that incident; and

(b) share the NIS incident information with the CSIRT as soon as reasonably practicable.

(6) After receipt of the NIS incident information under paragraph (5)(b), and based on that information, the CSIRT may inform the relevant authorities in a Member State if the CSIRT considers that the incident has a significant impact on the continuity of an essential service provision in that Member State.

(7) After receipt of a notification under paragraph (1), the competent authority or CSIRT may inform—

(a) the OES who provided the notification about any relevant information that relates to the NIS incident, including how it has been followed up, in order to assist that operator to deal with that incident more effectively or prevent a future incident; and

(b) the public about the NIS incident, as soon as reasonably practicable, if the competent authority or CSIRT is of the view that public awareness is necessary in order to handle that incident or prevent a future incident.

(8) Before the competent authority or CSIRT informs the public about a NIS incident under paragraph (7)(b), the competent authority or CSIRT must consult each other and the OES who provided the notification under paragraph (1).

(9) The competent authority must provide an annual report to the SPOC identifying the number and nature of NIS incidents notified to it under paragraph (1).

(10) The first report mentioned in paragraph (9) must be submitted on or before 1st July 2018 and subsequent reports must be submitted at annual intervals.

(11) The CSIRT is not required to share information under paragraph (6) if the information contains—

(a) confidential information; or

(b) information which may prejudice the security or commercial interests of an OES.

(12) Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) to (4).

PART 4 — Digital Services

Relevant digital service providers

12

(1) A RDSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which it relies to provide, within the United Kingdom, the following services—

(a) online marketplace;

(b) online search engine; or

(2) The measures taken by a RDSP under paragraph (1) must—

(a) (having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed;

(b) prevent and minimise the impact of incidents affecting their network and information systems with a view to ensuring the continuity of those services; and

(i) the security of systems and facilities;

(ii) incident handling;

(iii) business continuity management;

(iv) monitoring auditing and testing; and

(v) compliance with international standards.

(3) A RDSP must notify the Information Commissioner in writing about any incident having a substantial impact on the provision of any of the digital services mentioned in paragraph (1) that it provides.

(4) The requirement to notify in paragraph (3) applies only if the RDSP has access to information which enables it to assess whether the impact of an incident is substantial.

(5) The notification mentioned in paragraph (3) must provide the following information—

(a) the RDSP’s name and the digital services that it provides;

(b) the time the ... incident occurred;

(d) information concerning the nature and impact of the ... incident;

(e) information concerning any, or any likely, cross-border impact of the ... incident; and

(f) any other information that may be helpful to the Information Commissioner.

(6) The notification under paragraph (3) must—

(a) be made without undue delay and in any event no later than 72 hours after the RDSP is first aware that an incident has occurred; and

(b) contain sufficient information to enable the Information Commissioner to determine the significance of any cross-border impact.

(7) In order to determine whether the impact of an incident is substantial the RDSP must—

(a) take into account the following parameters, as specified in Article 3 of EU Regulation 2018/151—

(i) the number of users affected by the incident and, in particular, the users relying on the digital service for the provision of their own services;

(ii) the duration of the incident;

(iii) the geographical area affected by the incident;

(iv) the extent of the disruption to the functioning of the service;

(v) the extent of the impact on economic and societal activities; and

(b) have regard to any relevant guidance published by the Information Commissioner.

(8) After receipt of a notification under paragraph (3) the Information Commissioner must share the incident notification with the CSIRT as soon as reasonably practicable.

(9) If an OES is reliant on a RDSP to provide an essential service, the operator must notify the designated competent authority for the OES in writing in relation to it about any significant impact on the continuity of the service it provides caused by an incident affecting the RDSP without undue delay.

(10) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(11) The Information Commissioner is not required to share information under these Regulations if the information contains—

(a) confidential information; or

(b) information which may prejudice the security or commercial interests of a RDSP.

(12) If the Information Commissioner or CSIRT—

(a) consults with the RDSP responsible for an incident notification under paragraph (3), and

(b) is of the view that public awareness about that incident is necessary to prevent or manage it, or is in the public interest,

the Information Commissioner or CSIRT may inform the public about that incident or the Commissioner may direct the RDSP responsible for the notification to do so.

(13) Before the Information Commissioner or CSIRT informs the public about an incident notified under paragraph (3), the Information Commissioner or CSIRT must consult each other and the RDSP who provided the notification.

(14) The Information Commissioner may inform the public about an incident affecting digital services in a Member State of the EU if—

(a) the relevant authorities in the affected Member State notify the Information Commissioner about the incident;

(b) the Commissioner consults with those relevant authorities; and

(15) The Information Commissioner must provide an annual report to the SPOC identifying the number and nature of incidents notified to it under paragraph (3).

(16) The first report mentioned in paragraph (15) must be submitted on or before 1st July 2018 and subsequent reports must be submitted at annual intervals after that date.

(17) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Co-operation and action across Member State boundaries

13

The Information Commissioner may give information and assistance to, and otherwise co-operate with, a public authority in the EU if the Information Commissioner considers that to do so would be in the interests of effective supervision of digital service providers (whether inside or outside the United Kingdom), including in the event of an incident notified under regulation 12(3).

Registration with the Information Commissioner

14

(1) The Information Commissioner must maintain a register of all RDSPs that have been notified to it.

(2) A RDSP must submit the following details to the Information Commissioner before the registration date for the purpose of maintaining the register mentioned in paragraph (1)—

(a) the name of the RDSP;

(b) the address of its head office, or of its nominated representative; and

(3) A RDSP must notify the Information Commissioner in writing about any changes to the details it submitted under paragraph (2) as soon as possible, and in any event within three months of the date on which the change took effect.

(4) In this regulation, the “registration date” means—

(a) 1st November 2018, in the case of a RDSP who satisfies the conditions mentioned in regulation 1(3)(e) on the coming into force date of these Regulations, or

(b) in any other case, the date three months after the RDSP satisfies those conditions.

PART 5 — Enforcement and penalties

Information notices

15

(1) In order to assess whether a person should be an OES, a designated competent authority may serve an information notice in writing upon any person requiring that person to provide it with all such information as it reasonably requires to establish whether—

(a) a threshold requirement described in ... Schedule 2 is met; or

(b) the conditions mentioned in regulation 8(3) are met.

(2) A designated competent authority may serve an information notice in writing upon an OES requiring the OES to provide it with all such information as it reasonably requires for one or more of the following purposes—

(a) to assess the security of the OES’s network and information systems;

(b) to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(d) to assess the implementation of the OES’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(3) The Information Commissioner may serve upon a RDSP an information notice in writing requiring that RDSP to provide the Information Commissioner with all such information as the Information Commissioner reasonably requires for one or more of the following purposes—

(a) to assess the security of the RDSP’s network and information systems;

(b) to establish whether there have been any events that the Commissioner has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(d) to assess the implementation of the RDSP’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) An information notice must—

(a) describe the information that is required by the designated competent authority or the Information Commissioner;

(b) provide the reasons for requesting such information;

(d) specify the time period within which the information must be provided.

(5A) A person upon whom an information notice has been served under this regulation must comply with the requirements of the notice.

(6) In a case falling within paragraph (1) the information notice may—

(a) be served by publishing it in such manner as the designated competent authority considers appropriate in order to bring it to the attention of any persons who are described in the notice as the persons from whom the information is required; and

(b) take the form of a general request for a certain category of persons to provide the information that is specified in the notice.

(7) A competent authority or the Information Commissioner may withdraw an information notice by written notice to the person on whom it was served.

(8) An information notice under paragraph (1) may not be served upon the SPOC or CSIRT.

Power of inspection

16

(1) The designated competent authority for an OES may—

(a) conduct all or any part of an inspection;

(b) appoint a person to conduct all or any part of an inspection on its behalf; ...

(c) direct the OES to appoint a person who is approved by that authority to conduct all or any part of an inspection on its behalf,

....

(2) The Information Commissioner may—

(a) conduct all or any part of an inspection;

(b) appoint a person to conduct all or any part of an inspection on its behalf; ...

(c) direct that a RDSP appoint a person who is approved by the Information Commissioner to conduct all or any part of an inspection on its behalf,

....

(3) For the purposes of carrying out the inspection under paragraph (1) or (2), the OES or RDSP (as the case may be) must—

(a) pay the reasonable costs of the inspection if so required by the relevant competent authority or the Information Commissioner;

(b) co-operate with the inspector;

(d) allow the inspector to examine, print, copy or remove any document or information, and examine or remove any material or equipment, in accordance with paragraph (5)(d);

(e) allow the inspector access to any person from whom the inspector seeks relevant information for the purposes of the inspection;

(f) not intentionally obstruct an inspector performing their functions under these Regulations; and

(g) comply with any request made by, or requirement of, an inspector performing their functions under these Regulations.

(4) The relevant competent authority or Information Commissioner may appoint a person to conduct all or any part of an inspection under paragraph (1)(b) or (2)(b) on its behalf on such terms and in such a manner as it considers appropriate.

(5) An inspector may—

(a) at any reasonable time enter the premises of an OES or RDSP (except any premises used wholly or mainly as a private dwelling) if the inspector has reasonable grounds to believe that entry to those premises may be necessary or helpful for the purpose of the inspection;

(b) require an OES or RDSP to leave undisturbed and not to dispose of, render inaccessible or alter in any way any material, document, information, in whatever form and wherever it is held (including where it is held remotely), or equipment which is, or which the inspector considers to be, relevant for such period as is, or as the inspector considers to be, necessary for the purposes of the inspection;

(c) require an OES or RDSP to produce and provide the inspector with access, for the purposes of the inspection, to any such material, document, information or equipment which is, or which the inspector considers to be, relevant to the inspection, either immediately or within such period as the inspector may specify;

(d) examine, print, copy or remove any document or information, and examine or remove any material or equipment (including for the purposes of printing or copying any document or information) which is, or which the inspector considers to be, relevant for such period as is, or as the inspector considers to be, necessary for the purposes of the inspection;

(e) take a statement or statements from any person;

(f) conduct, or direct the OES or RDSP to conduct, tests;

(g) take any other action that the inspector considers appropriate and reasonably required for the purposes of the inspection.

(6) The inspector must—

(a) produce proof of the inspector’s identity if requested by any person present at the premises; and

(b) take appropriate and proportionate measures to ensure that any material, document, information or equipment removed in accordance with paragraph (5)(d) is kept secure from unauthorised access, interference and physical damage.

(7) Before exercising any power under paragraph (5)(b) to (d) or (g), the inspector—

(a) must take such measures as appear to the inspector appropriate and proportionate to ensure that the ability of the OES or RDSP, as the case may be, to comply with any duty set out in these Regulations will not be affected; and

(b) may consult such persons as appear to the inspector appropriate for the purpose of ascertaining the risks, if any, there may be in doing anything which the inspector proposes to do under that power.

(8) Where under paragraph (5)(d) an inspector removes any document, material or equipment, the inspector must provide, to the extent practicable, a notice giving—

(a) sufficient particulars of that document, material or equipment for it to be identifiable; and

(b) details of any procedures in relation to the handling or return of the document, material or equipment.

(9) In this regulation—

(a) a reference to a “test” is a reference to any process which is—

(i) employed to verify assertions about the security of a network or information system; and

(ii) based on interacting with that system, including components of that system,

and includes the exercising of any relevant security or resilience management process;

(b) “inspection” means any activity carried out (including any steps mentioned in paragraph (5)) for the purpose of—

(i) verifying compliance with the requirements of these Regulations; or

(ii) assessing or gathering evidence of potential or alleged failures to comply with the requirements of these Regulations,

including any necessary follow-up activity for either purpose;

Enforcement for breach of duties

17

(1) Subject to paragraph (2A), the designated competent authority for an OES may serve an enforcement notice upon that OES if the ... authority has reasonable grounds to believe that the OES has failed to—

(za) notify it under regulation 8(2);

(zb) comply with the requirements stipulated in regulation 8A;

(a) fulfil the security duties under regulation 10(1) and (2);

(b) notify a NIS incident under regulation 11(1);

(d) notify an incident as required by regulation 12(9);

(e) comply with an information notice issued under regulation 15; or

(f) comply with—

(i) a direction given under regulation 16(1)(c), or

(ii) the requirements stipulated in regulation 16(3).

(2) Subject to paragraph (2A), the Information Commissioner may serve an enforcement notice upon a RDSP if the Commissioner has reasonable grounds to believe that the RDSP has failed to—

(a) fulfil its duties under regulation 12(1) or (2);

(b) notify an incident under regulation 12(3);

(d) comply with a direction made by the Information Commissioner under regulation 12(12);

(da) comply with the requirements stipulated in regulation 14A;

(e) comply with an information notice issued under regulation 15; or

(f) comply with—

(i) a direction given under regulation 16(2)(c), or

(ii) the requirements stipulated in regulation 16(3).

(2A) Before serving an enforcement notice under paragraph (1) or (2), the relevant competent authority or the Information Commissioner must inform the OES or RDSP, in such form and manner as it considers appropriate having regard to the facts and circumstances of the case, of—

(a) the alleged failure; and

(b) how and by when representations may be made in relation to the alleged failure and any related matters.

(2B) When the relevant competent authority or the Information Commissioner informs the OES or RDSP in accordance with paragraph (2A), it may also provide notice of its intention to serve an enforcement notice.

(2C) The relevant competent authority or the Information Commissioner may serve an enforcement notice on the OES or RDSP within a reasonable time, irrespective of whether it has provided any notice in accordance with paragraph (2B), having regard to the facts and circumstances of the case, after it has informed the OES or RDSP in accordance with paragraph (2A).

(2D) The relevant competent authority or the Information Commissioner must have regard to any representations made under paragraph (2A)(b).

(3) An enforcement notice that is served under paragraph (1) or (2) must be in writing and must specify the following—

(a) the reasons for serving the notice;

(b) the alleged failure which is the subject of the notice; and

(c) what steps, if any, must be taken to rectify the alleged failure and the time period during which such steps must be taken; ...

(d) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3A) An OES or RDSP upon whom an enforcement notice has been served under paragraph (1) or (2) must comply with the requirements, if any, of the notice regardless of whether the OES or RDSP has paid any penalty imposed on it under regulation 18.

(4) If the relevant competent authority or Information Commissioner is satisfied that no further action is required, having considered—

(a) any representations submitted in accordance with paragraph (2A); or

(b) any steps taken to rectify the alleged failure;

it must inform the OES or the RDSP, as the case may be, in writing, as soon as reasonably practicable.

(5) The OES or RDSP may request reasons for a decision to take no further action under paragraph (4) within 28 days of being informed of that decision.

(6) Upon receipt of a request under paragraph (5), the relevant competent authority or Information Commissioner must provide written reasons for a decision under paragraph (4) within a reasonable time and in any event no later than 28 days.

Penalties

18

(1) The designated competent authority for an OES may serve a notice of intention to impose a penalty on the OES if it has reasonable grounds to believe that the OES has failed to comply with a duty referred to in regulation 17(1) or the duty set out in regulation 17(3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(2) The Information Commissioner may serve a notice of intention to impose a penalty on a RDSP if it has reasonable grounds to believe that the RDSP has failed to comply with a duty referred to in regulation 17(2) or the duty set out in regulation (3A) and considers that a penalty is warranted having regard to the facts and circumstances of the case.

(3) A notice of intention to impose a penalty must be in writing and must specify the following—

(a) the reasons for imposing a penalty;

(b) the sum that is intended to be imposed as a penalty and how it is to be paid;

(d) the period within which a penalty will be required to be paid if a penalty notice is served;

(e) that the payment of a penalty under a penalty notice (if any) is without prejudice to the requirements of any enforcement notice (if any); and

(f) how and when representations may be made about the content of the notice of intention to impose a penalty and any related matters.

(3A) The relevant competent authority may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the OES with a final penalty decision if the authority is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3B) The Information Commissioner may, after considering any representations submitted in accordance with paragraph (3)(f), serve a penalty notice on the RDSP with a final penalty decision if the Commissioner is satisfied that a penalty is warranted having regard to the facts and circumstances of the case.

(3C) The relevant competent authority or the Information Commissioner may serve a notice of intention to impose a penalty or a penalty notice irrespective of whether it has served or is contemporaneously serving an enforcement notice on the OES or RDSP under regulation 17(1) or (2).

(3D) A penalty notice must—

(a) be given in writing to the OES or RDSP;

(b) include reasons for the final penalty decision;

(i) the penalty specified in the notice of intention to impose a penalty; or

(ii) such penalty as the relevant competent authority or the Information Commissioner considers appropriate in the light of any representations made by the OES or RDSP and any steps taken by the OES or RDSP to rectify the failure or to do one or more of the things required by an enforcement notice under regulation 17(3);

(d) specify the period within which the penalty must be paid (“the payment period”) and the date on which the payment period is to commence;

(e) provide details of the appeal process under regulation 19A; and

(f) specify the consequences of failing to make payment within the payment period.

(3E) It is the duty of the OES or RDSP to comply with any requirement imposed by a penalty notice.

(4) A competent authority or the Information Commissioner may withdraw a penalty notice by informing the person upon whom it was served in writing.

(5) The sum of any penalty imposed under this regulation must be an amount that—

(a) the competent authority or Information Commissioner determines is appropriate and proportionate to the failure in respect of which it is imposed; and

(b) is in accordance with paragraph (6).

(6) The amount ... must—

(a) not exceed £1,000,000 for any contravention which the NIS enforcement authority determines was not a material contravention;

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(c) not exceed £8,500,000 for a material contravention which the NIS enforcement authority determines does not meet the criteria set out in sub-paragraph (d); and

(d) not exceed £17,000,000 for a material contravention which the NIS enforcement authority determines has or could have created a significant risk to, or significant impact on, or in relation to, the service provision by the OES or RDSP.

(7) In this regulation—

(a) “a material contravention” means—

(i) a failure to take, or adequately take, one or more of the steps required under an enforcement notice within the period specified in that notice to rectify a failure described in one or more of—

(aa) sub-paragraphs (a) to (d) of regulation 17(1); or

(bb) sub- paragraphs (a) to (d) of regulation 17(2); or

(ii) where an enforcement notice was not served or where no steps were required to be taken under an enforcement notice, a failure described in one or more of—

(aa) sub-paragraphs (a) to (d) of regulation 17(1); or

(bb) sub-paragraphs (a) to (d) of regulation 17(2).

(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Independent review of designation decisions and penalty decisions

19

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Enforcement of penalty notices

20

(1) This paragraph applies where a sum is payable to an enforcement authority as a penalty under regulation 18.

(2) In England and Wales the penalty is recoverable as if it were payable under an order of the county court or of the High Court.

(3) In Scotland the penalty may be enforced in the same manner as an extract registered decree arbitral bearing a warrant for execution issued by the sheriff court of any sheriffdom.

(4) In Northern Ireland the penalty is recoverable as if it were payable under an order of a county court or of the High Court.

(5) Where action is taken under this paragraph for the recovery of a sum payable as a penalty under regulation 18, the penalty is —

(a) in relation to England and Wales, to be treated for the purposes of section 98 of the Courts Act 2003 (register of judgments and order etc.) as if it were a judgment entered in the county court;

(b) in relation to Northern Ireland, to be treated for the purposes of Article 116 of the Judgments Enforcement (Northern Ireland) Order 1981 (register of judgments) as if it were a judgment in respect of which an application has been accepted under Article 22 or 23(1) of that Order.

(6) No action may be taken under this paragraph for the recovery of a sum payable as a penalty under regulation 18 if an appeal has been brought under regulation 19A and the appeal has not been determined or withdrawn.

PART 6 — Miscellaneous

Fees

21

(1) A fee is payable by an OES or a RDSP to an enforcement authority, to recover the reasonable costs incurred by, or on behalf of, that authority in carrying out a NIS function in relation to that OES or RDSP.

(2) The fee mentioned in paragraph (1) must be paid to the enforcement authority within 30 days after receipt of the invoice sent by the authority.

(3) The invoice must state the work done and the reasonable costs incurred by, or on behalf of, the enforcement authority, including the time period to which the invoice relates.

(4) An enforcement authority may determine not to charge a fee under paragraph (1) in any particular case.

(5) A fee payable under this regulation is recoverable as a civil debt.

(6) In this regulation—

(a) a “NIS function” means a function that is carried out under these Regulations except any function under regulations 17(1) to (4) and 18 to 20; and

(b) “enforcement authority” has the same meaning as in regulation 18(7)(b).

Proceeds of penalties

22

(1) The sum that is received by a NIS enforcement authority as a result of a penalty notice served under regulation 18 must be paid into the Consolidated Fund unless paragraph (2) applies.

(2) The sum that is received as a result of a penalty notice served under regulation 18 by—

(a) the Welsh Ministers must be paid into the Welsh Consolidated Fund established under section 117 of the Government of Wales Act 2006 ; and

(b) the Scottish Ministers or the Drinking Water Quality Regulator for Scotland, must be paid into the Scottish Consolidated Fund established under section 64 of the Scotland Act 1998 .

Enforcement action – general considerations

23

(1) Before a NIS enforcement authority takes any action under regulation 17(1) or (2), 18(3A) or (3B) or A20, the enforcement authority must consider whether it is reasonable and proportionate, on the facts and circumstances of the case, to take action in relation to the contravention.

(2) The NIS enforcement authority must, in particular, have regard to the following matters—

(a) any representations made by the OES or RDSP, as the case may be, about the contravention and the reasons for it, if any;

(b) any steps taken by the OES or RDSP to comply with the requirements set out in these Regulations;

(d) whether the OES or RDSP had sufficient time to comply with the requirements set out in these Regulations; and

(e) whether the contravention is also liable to enforcement under another enactment.

Service of documents

24

(1) Any document or notice required or authorised by these Regulations to be served on a person may be served by—

(a) delivering it to that person in person;

(b) leaving it at the person's proper address; or

(2) In the case of a body corporate, a document may be served on a director of that body.

(3) In the case of a partnership, a document may be served on a partner or person having control or management of the partnership business.

(4) If a person has specified an address in the United Kingdom (other than that person's proper address) at which that person or someone on that person's behalf will accept service, that address must also be treated as that person's proper address.

(5) For the purposes of this regulation “proper address” means—

(a) in the case of a body corporate or its director—

(i) the registered or principal office of that body; or

(ii) the email address of the secretary or clerk of that body;

(b) in the case of a partnership, a partner or person having control or management of the partnership business—

(i) the principal office of the partnership; or

(ii) the email address of a partner or a person having that control or management;

(6) In this regulation, “partnership” includes a Scottish partnership.

Review and report

25

(1) The Secretary of State must—

(a) carry out a review of the regulatory provision contained in these Regulations and in EU Regulation 2018/151; and

(b) publish a report setting out the conclusions of that review.

(2) The first report must be published on or before 9th May 2020 , the second report must be published on or before 9th May 2022 and subsequent reports must be published at intervals not exceeding five years.

(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(4) Section 30(4) of the Small Business, Enterprise and Employment Act 2015 requires that reports published under this regulation must, in particular—

(a) set out the objectives intended to be achieved by the regulatory provision referred to in paragraph (1)(a);

(b) assess the extent to which those objectives are achieved;

(d) if those objectives remain appropriate, assess the extent to which they could be achieved in another way which involves less onerous regulatory provision.

(5) In this regulation “regulatory provision” has the same meaning as in sections 28 to 32 of that Act.

SCHEDULE 1 — Designated Competent Authorities

Column 1 Relevant sectors	Column 2 subsectors	Column 3 designated competent authorities
Energy	Electricity	The Secretary of State for Business, Energy and Industrial Strategy (England and Wales and Scotland) and the Gas and Electricity Markets Authority (acting jointly).
Energy	Electricity	The Department of Finance (Northern Ireland)
Energy	Oil	The Secretary of State for Business, Energy and Industrial Strategy (England and Wales and Scotland)
Energy	Oil	The Department of Finance (Northern Ireland)
Energy	Gas	The Secretary of State for Business, Energy and Industrial Strategy for the essential services specified in Schedule 2, paragraph 3, sub-paragraphs (5) to (8) (England and Wales and Scotland). Otherwise, the Secretary of State for Business, Energy and Industrial Strategy and The Gas and Electricity Markets Authority (acting jointly).
Energy	Gas	The Department of Finance (Northern Ireland)
Transport	Air Transport	The Secretary of State for Transport and The Civil Aviation Authority (acting jointly) (United Kingdom).
Transport	Rail Transport	The Secretary of State for Transport (England and Wales and Scotland)
Transport	Rail Transport	The Department of Finance (Northern Ireland)
Transport	Water Transport	The Secretary of State for Transport (United Kingdom)
Transport	Road Transport	The Secretary of State for Transport (England and Wales)
Transport	Road Transport	The Scottish Ministers (Scotland)
Transport	Road Transport	The Department of Finance (Northern Ireland)
Health Sector	Health care settings (including hospitals, private clinics and online settings)	The Secretary of State for Health (England)
Health Sector	Health care settings (including hospitals, private clinics and online settings)	The Welsh Ministers (Wales)
Health Sector	Health care settings (including hospitals, private clinics and online settings)	The Scottish Ministers (Scotland)
Health Sector	Health care settings (including hospitals, private clinics and online settings)	The Department of Finance (Northern Ireland)
Drinking water supply and distribution	Drinking water supply and distribution	The Secretary of State for Environment, Food and Rural Affairs (England)
Drinking water supply and distribution	Drinking water supply and distribution	The Welsh Ministers (Wales)
Drinking water supply and distribution	Drinking water supply and distribution	The Drinking Water Quality Regulator for Scotland (Scotland)
Drinking water supply and distribution	Drinking water supply and distribution	The Department of Finance (Northern Ireland)
Digital Infrastructure	Digital Infrastructure	Office of Communications (United Kingdom)

SCHEDULE 2 — Essential Services and Threshold Requirements

The electricity subsector

1

(1) This paragraph describes the threshold requirements which apply to specified kinds of essential services in the electricity subsector.

(2) For the essential service of electricity supply the threshold requirements are—

(a) in Great Britain—

(i) electricity undertakings that carry out the function of supply to more than 250,000 final customers; or

(ii) electricity undertakings that carry out the function of supply, and generation via generators that when cumulated with the generators operated by affiliated undertakings would have a total capacity, in terms of input to a transmission system, greater than or equal to 2 gigawatts;

(b) in Northern Ireland—

(i) the holder of a supply licence under Article 10(1)(c) of the Electricity (Northern Ireland) Order 1992 who supplies electricity to more than 8,000 consumers; and

(ii) the holder of a generation licence under Article 10(1)(a) of the Electricity (Northern Ireland) Order 1992 with a generating capacity equal to or greater than 350 megawatts.

(3) For the essential service of the single electricity market in Northern Ireland, the threshold requirement is the holder of a Single Electricity Market operator licence under Article 10(1)(d) of the Electricity (Northern Ireland) Order 1992 .

(4) For the essential service of electricity transmission, the threshold requirements are—

(a) in Great Britain—

(i) transmission system operators with a potential to disrupt delivery of electricity to more than 250,000 final customers;

(ii) holders of offshore transmission licences where the offshore transmission systems of that licence holder and its affiliated undertakings are directly connected to generators that have a total cumulative capacity, in terms of input to a transmission system, greater than or equal to 2 gigawatts; or

(iii) holders of interconnector licences where the electricity interconnector to which the licence relates has a capacity, in terms of input to a transmission system, greater than or equal to 1 gigawatt;

(b) in Northern Ireland, the holder of a transmission licence under Article 10(1)(b) of the Electricity (Northern Ireland) Order 1992 .

(5) For the essential service of electricity distribution, the threshold requirements are—

(a) in Great Britain, distribution system operators with the potential to disrupt delivery of electricity to more than 250,000 final customers;

(b) in Northern Ireland, the holder of a distribution licence under Article 10(1)(bb) of the Electricity (Northern Ireland) Order 1992 .

(6) Nuclear electricity generators and generators that are not connected to a transmission system are excluded from the threshold described in sub-paragraph (2)(a)(ii).

(7) Transmission systems for which an offshore transmission licence or interconnector licence applies are excluded from the threshold described in sub-paragraph (4)(a)(i).

(8) In this paragraph—

(a) “affiliated undertaking” has the meaning given by Article 2(12) of Directive 2013/34/EU of the European Parliament and of the Council on the annual financial statements, consolidated financial statements and related reports of certain types of undertakings, amending Directive 2006/43/EC of the European Parliament and of the Council and repealing Council Directives 78/660/EEC and 83/349/EEC;

(b) “distribution” has the meaning given by Article 2(5) of Directive 2009/72/EC of the European Parliament and of the Council concerning common rules for the internal market in electricity and repealing Directive 2003/54/EC , (“the Electricity Directive”);

(d) “electricity undertaking” has the meaning given by Article 2(35) of the Electricity Directive;

(e) “final customer” has the meaning given by Article 2(9) of the Electricity Directive;

(f) “generation” has the meaning given by Article 2(1) of the Electricity Directive and includes the generation of electricity from stored energy, and “generator” must be interpreted accordingly;

(g) “interconnector licence” means a licence granted under section 6(1)(e) of the Electricity Act 1989 ;

(h) “offshore transmission licence” and “offshore transmission” have the meaning given by section 6F(8) of the Electricity Act 1989 ...;

(i) “stored energy” means energy that—

(aa) was converted from electricity, and

(bb) is stored for the purpose of its future reconversion into electricity;

(j) “supply” has the meaning given by Article 2(19) of the Electricity Directive;

(k) “transmission” has the meaning given by Article 2(3) of the Electricity Directive; and

(l) “transmission system operator” has the meaning given by Article 2(4) of the Electricity Directive.

The oil subsector

2

(1) This paragraph describes the threshold requirements which apply to specified kinds of essential services in the oil subsector.

(2) For the essential service of the conveyance of oil through relevant upstream petroleum pipelines, the threshold requirement, in the United Kingdom is the operator of a relevant upstream petroleum pipeline which has a throughput of more than 3,000,000 tonnes of oil equivalent per year excluding natural gas, if that operator does not fall within another threshold requirement in relation to this pipeline under this Schedule.

(3) For the essential service of oil transmission by pipeline, the threshold requirements are—

(a) in Great Britain, operators of any pipeline with throughput ... of more than 500,000 tonnes of crude oil based fuel per year not including transmission of crude oil; and

(b) in Northern Ireland, operators of any pipeline with throughput ... of more than 50,000 tonnes of crude oil based fuel per year.

(4) For the essential service of the operation of relevant oil processing facilities, the threshold requirement in the United Kingdom is in the case of—

(a) a relevant oil processing facility, an operator of a facility with a throughput of more than 3,000,000 tonnes of oil equivalent per year, or

(b) a relevant upstream petroleum pipeline which is connected to and operated from a relevant oil processing facility, an operator of a pipeline with a throughput of more than 3,000,000 tonnes of oil equivalent per year.

...

(5) For the essential service of crude oil based fuel production, refining, onshore storage and transmission the threshold requirements are—

(a) in Great Britain, operators of any facility where that facility has a capacity greater than any of the following values—

(i) storage of 500,000 tonnes of crude oil based fuel;

(ii) production of 500,000 tonnes of crude oil based fuel per year; or

(iii) supply of 500,000 tonnes of crude oil based fuel per year;

(b) in Northern Ireland, the operator of a facility which has a storage capacity of greater than 50,000 tonnes of crude oil based fuel.

(6) For the essential service of the operation of petroleum production projects (other than projects which are primarily used for the storage of gas), the threshold requirement in the United Kingdom is, in the case of—

(i) a relevant offshore installation which is part of a petroleum production project , an operator of an installation with a throughput of more than 3,000,000 tonnes of oil equivalent per year, or

(ii) a relevant upstream petroleum pipeline which is connected to and operated from such an installation, an operator of a pipeline with a throughput of more than 3,000,000 tonnes of oil equivalent per year

....

(7) In sub-paragraph (5), the following are included within the description of the essential service—

(a) storage of crude oil based fuel;

(b) production of crude oil based fuels through a range of refining or blending processes, but excluding processes for rendering the oil suitable for transportation; and

(8) In this paragraph—

(a) “carbon dioxide pipeline” has the meaning given by section 90(2) of the Energy Act 2011 ;

(b) “crude oil” means any liquid hydrocarbon mixture occurring naturally in the earth whether or not treated to render it suitable for transportation, and includes—

(i) crude oils from which distillate fractions have been removed, and

(ii) crude oils to which distillate fractions have been added;

(d) “foreign sector of the continental shelf” has the meaning given by section 90(1) of the Energy Act 2011 ;

(e) “gas processing facility” has the meaning given by section 12(6) of the Gas Act 1995;

(f) “gas processing operation” means any of the following operations—

(i) purifying, blending, odorising or compressing gas for the purpose of enabling it to be introduced into a pipeline system operated by a gas transporter or to be conveyed to an electricity generating station, a gas storage facility or any place outside the United Kingdom;

(ii) removing from gas for that purpose any of its constituent gases, or separating from gas for that purpose any oil or water;

(iii) determining the quantity or quality of gas which is or is to be so introduced, or so conveyed, whether generally or by, or on behalf of, a particular person;

(iv) separating, purifying, blending, odorising or compressing gas for the purpose of—

(aa) converting it into a form in which a purchaser is willing to accept delivery from a seller, or

(bb) enabling it to be loaded for conveyance to another place (whether inside or outside the United Kingdom); or

(v) loading gas—

(aa) at a facility which carries out operations of a kind mentioned in paragraph (iv), or

(bb) piped from such a facility

for the purpose of enabling the gas to be conveyed to another place (whether inside or outside the United Kingdom);

(g) “gas transporter” has the meaning given by section 7(1) of the Gas Act 1986 ;

(h) “oil equivalent” means petroleum and, for the purposes of assessments of throughput, where petroleum is in a gaseous state 1,100 cubic meters of this petroleum at a temperature of 15 degrees Celsius and pressure of one atmosphere is counted as equivalent to one tonne;

(i) “oil processing facility” means any facility which carries out oil processing operations;

(j) “oil processing operations” means any of the following operations—

(i) initial blending and such other treatment of petroleum as may be required to produce stabilised crude oil to the point at which a seller could reasonably make a delivery to a purchaser of such oil;

(ii) receiving stabilised crude oil piped from an oil processing facility carrying out operations of a kind mentioned in sub-paragraph (i), or storing oil so received, prior to their conveyance to another place (whether inside or outside the United Kingdom);

(iii) loading stabilised crude oil piped from a facility carrying out operations of a kind mentioned in sub-paragraph (i) or (ii) for conveyance to another place (whether inside or outside the United Kingdom);

(ja) “operator” means—

(i) in relation to a pipeline—

(aa) the person who is to have or (once any fluid or any mixture of fluids is conveyed) has control over the conveyance of any fluid or any mixture of fluids in the pipeline;

(bb) until that person is known, the person who is to commission or (where commissioning has started) commissions the design and construction of the pipeline; or

(cc) when a pipeline is no longer used or is not for the time being used, the person last having control over the conveyance of fluid or any mixture of fluids in it;

(ii) in relation to a production installation—

(aa) the person appointed by the licensee of the operator or by any other person to manage and control directly the execution of the main functions of a production installation; or

(bb) the licensee, where it is not clear to the designated competent authority that one person has been appointed to perform the functions described in paragraph (aa) or, in the opinion of that authority, the person appointed to perform the functions described in that paragraph is incapable of performing those functions satisfactorily;

(k) “petroleum” has the same meaning as in section 1 of the Petroleum Act 1998 , and includes petroleum that has undergone any processing;

(l) “petroleum production project” means a project carried out by virtue of a licence granted under—

(i) section 3 of the Petroleum Act 1998 ,

(ii) section 2 of the Petroleum (Production) Act 1934 , or

(iii) section 2 of the Petroleum (Production) Act (Northern Ireland) 1964 ,

and includes such a project which is used for the storage of gas;

(m) “piped gas” means gas which—

(i) originated from a petroleum production project (or an equivalent project in a foreign sector of the continental shelf), and

(ii) has been conveyed only by means of pipes;

(n) “pipeline” means a pipe or system of pipes for the conveyance of anything;

(na) “production installation” has the meaning given by regulation 2(1) of the Offshore Installations (Safety Case) Regulations 2005;

(o) “relevant offshore installation” means an offshore installation within the meaning of section 44 of the Petroleum Act 1998 which carries on the activities mentioned in subsection (3)(a) or (c) of that section and is a relevant offshore installation only to the extent it is used to carry on those activities;

(p) “terminal” includes—

(i) facilities for such initial blending and other treatment as may be required to produce stabilised crude oil to the point at which a seller could reasonably make a delivery to a purchaser of such oil;

(ii) oil processing facilities;

(iii) gas processing facilities; and

(iv) a facility for the reception of gas prior to its conveyance to a place outside the United Kingdom;

(q) “upstream petroleum pipeline” means a pipeline or one of a network of pipelines which is—

(i) operated or constructed as part of a petroleum production project (or an equivalent project in a foreign sector of the continental shelf) and is not a carbon dioxide pipeline;

(ii) used to convey petroleum from the site of one or more such projects—

(aa) directly to premises, in order for that petroleum to be used at those premises for power generation or for an industrial process;

(bb) directly to a place outside the United Kingdom;

(cc) directly to a terminal; or

(dd) indirectly to a terminal by way of one or more other terminals, whether or not such intermediate terminals are of the same kind as the final terminal; or

(iii) used to convey gas directly from a terminal to a pipeline system operated by a gas transporter or to any premises.

(9) In sub-paragraph (8)(f), (l), (m), (p) and (q) “gas” means any substance which is or, if it were in a gaseous state, would be gas within the meaning of Part 1 of the Gas Act 1986 .

(10) In this paragraph an upstream petroleum pipeline, oil processing facility, or gas processing facility is “relevant” if and in so far as it is situated in—

(a) the United Kingdom;

(b) the territorial sea adjacent to the United Kingdom; or

(c) the sea (including the seabed and subsoil) in any area designated under section 1(7) of the Continental Shelf Act 1964 .

(11) In this paragraph, “Great Britain” includes—

(a) Great Britain;

(b) the territorial sea adjacent to Great Britain; and

(c) the sea (including the seabed and subsoil) in any area designated under section 1(7) of the Continental Shelf Act 1964.

The gas subsector

3

(1) This paragraph describes the threshold requirements which apply to specified kinds of essential services in the gas subsector.

(2) For the essential service of gas supply the threshold requirements are—

(a) in Great Britain, supply undertakings that supply gas to more than 250,000 final customers;

(b) in Northern Ireland, the holder of a supply licence under Article 8(1)(c) of the Gas (Northern Ireland) Order 1996 who supplies gas to more than 2,000 customers.

(3) For the essential service of gas transmission the threshold requirements are—

(a) in Great Britain—

(i) transmission system operators with a potential to disrupt delivery to more than 250,000 final customers; or

(ii) holders of interconnector licences where the gas interconnector to which the licence relates has the technological capacity to input more than 20 million cubic metres of gas per day to a transmission system; and

(b) in Northern Ireland, the holder of a gas conveyance licence under Article 8(1)(a) of the Gas (Northern Ireland) Order 1996.

(4) For the essential service of gas distribution the threshold requirements are—

(a) in Great Britain, distribution system operators with a potential to disrupt delivery to more than 250,000 final customers; and

(b) in Northern Ireland the holder of a licence under Article 8(1)(a) of the Gas (Northern Ireland) Order 1996.

(5) For the essential service of the operation of gas storage facilities, the threshold requirements are—

(a) in Great Britain, storage system operators where the storage facility has the technological capacity to input more than 20 million cubic metres of gas per day to a transmission system; and

(b) in Northern Ireland the holder of a licence under Article 8(1)(b) of the Gas (Northern Ireland) Order 1996 .

(6) For the essential service of the operation of LNG facilities, the threshold requirements are—

(a) in Great Britain, LNG system operators where the LNG facility has the technological capacity to input more than 20 million cubic metres of gas per day to a transmission system; and

(b) in Northern Ireland the holder of a licence under Article 8(1)(d) of the Gas (Northern Ireland) Order 1996 .

(7) For the essential service of the operation of relevant gas processing facilities, the threshold requirement in the United Kingdom is in the case of—

(a) an operator of a relevant gas processing facility, an operator of a facility with a throughput of more than 3,000,000 tonnes of oil equivalent per year; or

(b) a relevant upstream pipeline and associated infrastructure that is connected to and operated from such a relevant gas processing facility, and critical to the continued operation of that facility, an operator of a pipeline with a throughput of more than 3,000,000 tonnes of oil equivalent per year,

an operator of a facility or pipeline with a throughput of more than 3,000,000 tonnes of oil equivalent per year.

(8) For the essential service of the operation of petroleum production projects (other than projects which are primarily used for the storage of gas), the threshold requirement in the United Kingdom is—

(a) in the case of—

(i) a relevant offshore installation which is part of a petroleum production project (other than a project which is primarily used for the storage of gas), or

(ii) a relevant upstream petroleum pipeline which is connected to and operated from such an installation,

an operator of an installation or pipeline with a throughput of more than 3,000,000 tonnes of oil equivalent per year.

(9) In sub-paragraph (3)(a)(i) the threshold requirement does not include transmission systems for which an interconnector licence applies.

(10) In this paragraph—

(a) “carbon dioxide pipeline” has the meaning given by section 90(2) of the Energy Act 2011 ;

(b) “crude oil” means any liquid hydrocarbon mixture occurring naturally in the earth whether or not treated to render it suitable for transportation, and includes—

(i) crude oils from which distillate fractions have been removed, and

(ii) crude oils to which distillate fractions have been added;

(c) “distribution” has the meaning given by Article 2(5) of Directive 2009/73/EC of the European Parliament and of the Council concerning common rules for the internal market in natural gas and repealing Directive 2003/55/EC , “the Gas Directive”;

(d) “distribution system operator” has the meaning given by Article 2(6) of the Gas Directive;

(e) “final customer” has the meaning given by Article 2(27) of the Gas Directive;

(f) “foreign sector of the continental shelf” has the meaning given by section 90(1) of the Energy Act 2011 ;

(g) “gas processing facility” means any facility which—

(i) carries out gas processing operations in relation to piped gas;

(ii) is operated otherwise than by a gas transporter; and

(iii) is not an LNG import or export facility (within the meaning of section 12 of the Gas Act 1995 );

(h) “gas processing operation” means any of the following operations—

Reading this document does not replace reading the official text published on legislation.gov.uk. Contains public sector information licensed under the Open Government Licence v3.0. We assume no responsibility for any inaccuracies arising from the conversion of the original CLML XML to this format.

This text is published under legislation.gov.uk's own terms of reuse, not a Legalize or public-domain licence. legislation.gov.uk
Open Government Licence v3.0 (attribution required)
© Crown and database right. Derived from content available under the Open Government Licence v3.0 from legislation.gov.uk.

The Network and Information Systems Regulations 2018

PART 1 — Introduction

Citation, commencement, interpretation and application

1

PART 2 — The National Framework

The NIS national strategy

2

Designation of national competent authorities

3

Designation of the single point of contact

4

Designation of computer security incident response team

5

Information sharing – enforcement authorities

6

Information sharing – Northern Ireland

7

PART 3 — Operators of essential services

Identification of operators of essential services

8

Revocation

9

The security duties of operators of essential services

10

The duty to notify incidents

11

PART 4 — Digital Services

Relevant digital service providers

12

Co-operation and action across Member State boundaries

13

Registration with the Information Commissioner

14

PART 5 — Enforcement and penalties

Information notices

15

Power of inspection

16

Enforcement for breach of duties

17

Penalties

18

Independent review of designation decisions and penalty decisions

19

Enforcement of penalty notices

20

PART 6 — Miscellaneous

Fees

21

Proceeds of penalties

22

Enforcement action – general considerations

23

Service of documents

24

Review and report

25

SCHEDULE 1 — Designated Competent Authorities

SCHEDULE 2 — Essential Services and Threshold Requirements

The electricity subsector

1

The oil subsector

2

The gas subsector

3