United KingdomNotification of Incidents by Operators of Essential Services
The Network and Information Systems Regulations 2018, SI 2018/506, reg. 11
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- Applies to the operators of essential services described in the security duties of regulation 10: a person whose essential service of a kind listed in Schedule 2 relies on network and information systems and meets the Schedule 2 threshold, or whom a competent authority designates. Reached by declaring that you operate an essential service, and, for a health care setting, that you handle health records.
- Notify your designated competent authority in writing about any incident that has a significant impact on the continuity of the essential service you provide (regulation 11(1)).
- Give the notification without undue delay and in any event no later than 72 hours after you are aware that the incident has occurred, in the form and manner the competent authority determines (regulation 11(3)(b)).
- In judging the significance of the impact, have regard to the number of users affected by the disruption, the duration of the incident and the geographical area affected (regulation 11(2)).
- State in the notification your name and the essential services you provide, the time and duration of the incident, its nature and impact, any cross-border impact, and any other information that may help the competent authority (regulation 11(3)(a)).
- Where you rely on a relevant digital service provider to provide the essential service, notify your competent authority without undue delay of any significant impact on the continuity of the service caused by an incident affecting that provider (regulation 12(9)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Regulation 18(6) caps a penalty at 1,000,000 pounds for a contravention that is not a material contravention, at 8,500,000 pounds for a material contravention that does not meet the criteria of paragraph (d), and at 17,000,000 pounds for a material contravention that has or could have created a significant risk to, or significant impact on, the service provision.
- Rule
- Fixed only
- As of
- Currency
- GBP
- Fixed cap
- 17,000,000
Who enforces it
Enforcement body
The designated competent authority for the operator's subsector under regulation 3(1) and Schedule 1 (for electricity, the Secretary of State for Energy Security and Net Zero and the Gas and Electricity Markets Authority acting jointly), which may serve an enforcement notice under regulation 17(1) and a penalty notice under regulation 18.
Settledness
- As of
What this law does
Regulation 11 requires an operator of an essential service to notify its designated competent authority in writing about any incident which has a significant impact on the continuity of the essential service it provides. The notification must be given without undue delay and in any event no later than 72 hours after the operator is aware that a NIS incident has occurred.
Regulation 12(9) separately requires an operator that relies on a relevant digital service provider to notify its competent authority, without undue delay, of any significant impact on the continuity of its service caused by an incident affecting that provider.
When LexLint raises it
When your app profile says your app handles health records or runs an essential service.