UK NIS Regulations
Network and Information Systems Regulations 2018
The UK's implementation of the original EU NIS Directive, kept after Brexit. The UK did not adopt NIS2.
In force: In force from May 2018; reform is planned through the Cyber Security and Resilience Bill
Who it applies to
Operators of essential services in energy, transport, health, drinking water and digital infrastructure, and relevant digital service providers (online marketplaces, online search engines and cloud computing services).
Key requirements
- Appropriate and proportionate technical and organisational measures to manage security risks.
- Measures to prevent and minimise the impact of incidents.
- Incident reporting to the competent authority (or the ICO for digital service providers).
- Cooperation with sector competent authorities, which may use the NCSC Cyber Assessment Framework.
Breach and incident notification
Operators of essential services and relevant digital service providers notify the relevant authority of qualifying incidents without undue delay and no later than 72 hours after becoming aware.
Penalties
Fines of up to GBP 17 million for the most serious failures.
Related frameworks
Shows up on these exams
Official source
legislation.gov.uk: SI 2018/506Not legal advice
This is a study summary, not legal advice. Laws and their guidance change, and obligations depend on your facts and jurisdiction. Check the official source and the current, dated text, and consult a qualified lawyer before acting.
Go deeper
OT security lab
Practise this topic hands-on.
Breach timeline lab
Practise this topic hands-on.
UK GDPR / DPA 2018
United Kingdom - Privacy & data protection
Computer Misuse Act
United Kingdom - Cybercrime
PECR
United Kingdom - Privacy & data protection
CER Directive
European Union - Critical infrastructure
CIRCIA
United States (federal) - Critical infrastructure
SOCI Act
Australia - Critical infrastructure