United KingdomSecurity Duties of Operators of Essential Services
The Network and Information Systems Regulations 2018, SI 2018/506, reg. 10
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to an operator of an essential service: a person whose essential service of a kind listed in Schedule 2 (electricity, oil, gas, air, water, rail and road transport, health care settings, drinking water supply and distribution, and digital infrastructure) relies on network and information systems and meets the Schedule 2 threshold, or whom a competent authority designates under regulation 8(3). Reached by declaring that you operate an essential service, and, for a health care setting, that you handle health records.
- Take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of the network and information systems on which your essential service relies (regulation 10(1)).
- Take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting those systems, with a view to ensuring the continuity of your essential service (regulation 10(2)).
- Ensure, having regard to the state of the art, a level of security of network and information systems appropriate to the risk posed (regulation 10(3)).
- Have regard to any relevant guidance issued by your designated competent authority when carrying out these duties (regulation 10(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Regulation 18(6) caps a penalty at 1,000,000 pounds for a contravention that is not a material contravention, at 8,500,000 pounds for a material contravention that does not meet the criteria of paragraph (d), and at 17,000,000 pounds for a material contravention that has or could have created a significant risk to, or significant impact on, the service provision.
- Rule
- Fixed only
- As of
- Currency
- GBP
- Fixed cap
- 17,000,000
Who enforces it
Enforcement body
The designated competent authority for the operator's subsector under regulation 3(1) and Schedule 1 (for electricity, the Secretary of State for Energy Security and Net Zero and the Gas and Electricity Markets Authority acting jointly), which may serve an enforcement notice under regulation 17(1) and a penalty notice under regulation 18.
Settledness
- As of
What this law does
Regulation 10 requires an operator of an essential service to take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which its essential service relies. Regulation 10 also requires an operator of an essential service to take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting those systems, with a view to ensuring the continuity of the service.
A person who provides an essential service listed in Schedule 2, whose service relies on network and information systems and meets the threshold requirement for that kind of service, is deemed designated as an operator of an essential service under regulation 8.
When LexLint raises it
When your app profile says your app handles health records or runs an essential service.