OpenLegislation

The Network and Information Systems Regulations 2018

S.I. 2018/506 · Made 19 April 2018 · Extends to United Kingdom

Not fully up to date. 1 change made by later legislation has not yet been written into this text, which is revised to 30 September 2026.

See the changes not yet applied
ProvisionChangeMade by
Sch. 2 para. 4(5)(b)substitutedAviation Security (Amendment, Revocation and Consequential Provision) 2026 reg. 7(2)

Electronic Communications

Made 19th April 2018

Laid before Parliament 20th April 2018

Coming into force 10th May 2018

The Secretary of State is a Minister designated M1 for the purposes of section 2(2) of the European Communities Act 1972 M2 (“the 1972 Act”) in relation to electronic communications.

These Regulations make provision for a purpose mentioned in section 2(2) of the 1972 Act and it appears to the Secretary of State that it is expedient for certain references to provisions of EU instruments to be construed as references to those provisions as amended from time to time.

The Secretary of State makes the following Regulations in exercise of the powers conferred by section 2(2) of, and paragraph 1A M3 of Schedule 2 to, the 1972 Act and by section 56 of the Finance Act 1973 M4 (“the 1973 Act”) and, in the case of section 56 of the 1973 Act, with the consent of the Treasury.

Annotations to the whole text

Marginal citations

M1

S.I. 2001/3495. See article 2 of, and Schedule 1 to, these Regulations. There are amendments not relevant to these Regulations.

M2

1972 c.68. Section 2(2) was amended by section 27(1)(a) of the Legislative and Regulatory Reform Act 2006 (c.51) and by Part 1 of the Schedule to the European Union (Amendment) Act 2008 (c.7). In so far as these Regulations deal with matters that are within the devolved competence of Scottish Ministers, the power of the Secretary of State to make regulations in relation to those matters in or as regards Scotland is preserved by section 57(1) of the Scotland Act 1998 (c.46).

M3

Paragraph 1A of Schedule 2 was inserted by section 28 of the Legislative and Regulatory Reform Act 2006 and amended by Part 1 of the Schedule to the European Union (Amendment) Act 2008 and by article 3 of and paragraph 1 of Schedule 1 to SI 2007/1388.

M4

1973 c.51. Section 56 was amended by S.I. 2011/1043; there are other amendments not relevant to these Regulations.

Contents

  1. Part 1: Introduction
  2. 1Citation, commencement, interpretation and application
  3. Part 2: The National Framework
  4. 2The NIS national strategy
  5. 3Designation of national competent authorities
  6. 4Designation of the single point of contact
  7. 5Designation of computer security incident response team
  8. 6Information sharing – enforcement authorities
  9. 7Information sharing – Northern Ireland
  10. Part 3: Operators of essential services
  11. 8Identification of operators of essential services
  12. 8ANomination by an OES of a person to act on its behalf in the United Kingdom
  13. 9Revocation
  14. 10The security duties of operators of essential services
  15. 11The duty to notify incidents
  16. Part 4: Digital Services
  17. 12Relevant digital service providers
  18. 13Co-operation with the European Union
  19. 14Registration with the Information Commission
  20. 14ARepresentatives of digital service providers established outside the United Kingdom
  21. Part 5: Enforcement and penalties
  22. 15Information notices
  23. 16Power of inspection
  24. 17Enforcement notices for breach of duties
  25. 18Penalties
  26. 19Independent review of designation decisions and penalty decisions Repealed
  27. 19AAppeal by an OES or RDSP to the First-tier Tribunal
  28. 19BDecision of the First-tier Tribunal
  29. A20Enforcement by civil proceedings
  30. 20Enforcement of penalty notices
  31. Part 6: Miscellaneous
  32. 21Fees
  33. 22Proceeds of penalties
  34. 23Enforcement action – general considerations
  35. 24Service of documents
  36. 25Review and report
  37. Signature
  38. Schedule 1Designated Competent Authorities
  39. Schedule 2: Essential Services and Threshold Requirements
  40. 1The electricity subsector
  41. 2The oil subsector
  42. 3The gas subsector
  43. 4The air transport subsector
  44. 5The water transport subsector
  45. 6The rail transport subsector
  46. 7The road transport subsector
  47. 8The healthcare subsector
  48. 9The drinking water supply and distribution subsector
  49. 10The digital infrastructure subsector
  50. Explanatory note