{
  "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018",
  "json_url": "https://openlegislation.uk/network-and-information-systems-regulations-2018.json",
  "id": "uksi/2018/506",
  "title": "The Network and Information Systems Regulations 2018",
  "short_title": "Network and Information Systems 2018",
  "long_title": "These Regulations implement Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union (OJ No L194, 19.7.2016, p1).",
  "citation": "S.I. 2018/506",
  "type": "uksi",
  "year": "2018",
  "number": "506",
  "version": "current",
  "date": "2018-04-19",
  "revised": true,
  "valid_from": "2026-09-30",
  "extent": "E+W+S+N.I.",
  "unapplied_effects": 1,
  "provisions": [
    {
      "path": "introduction",
      "kind": "introduction",
      "number": null,
      "heading": "Introductory text",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/introduction",
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "part/1",
      "kind": "part",
      "number": "1",
      "heading": "Introduction",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/1",
      "kind": "regulation",
      "number": "1",
      "heading": "Citation, commencement, interpretation and application",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-1",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/1"
    },
    {
      "path": "part/2",
      "kind": "part",
      "number": "2",
      "heading": "The National Framework",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/2",
      "kind": "regulation",
      "number": "2",
      "heading": "The NIS national strategy",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-2",
      "extent": null,
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "regulation/3",
      "kind": "regulation",
      "number": "3",
      "heading": "Designation of national competent authorities",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-3",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "regulation/4",
      "kind": "regulation",
      "number": "4",
      "heading": "Designation of the single point of contact",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-4",
      "extent": null,
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "regulation/5",
      "kind": "regulation",
      "number": "5",
      "heading": "Designation of computer security incident response team",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-5",
      "extent": null,
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "regulation/6",
      "kind": "regulation",
      "number": "6",
      "heading": "Information sharing – enforcement authorities",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-6",
      "extent": null,
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "regulation/7",
      "kind": "regulation",
      "number": "7",
      "heading": "Information sharing – Northern Ireland",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-7",
      "extent": null,
      "status": null,
      "parent": "part/2"
    },
    {
      "path": "part/3",
      "kind": "part",
      "number": "3",
      "heading": "Operators of essential services",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/8",
      "kind": "regulation",
      "number": "8",
      "heading": "Identification of operators of essential services",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-8",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/3"
    },
    {
      "path": "regulation/8A",
      "kind": "regulation",
      "number": "8A",
      "heading": "Nomination by an OES of a person to act on its behalf in the United Kingdom",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-8A",
      "extent": null,
      "status": null,
      "parent": "part/3"
    },
    {
      "path": "regulation/9",
      "kind": "regulation",
      "number": "9",
      "heading": "Revocation",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-9",
      "extent": null,
      "status": null,
      "parent": "part/3"
    },
    {
      "path": "regulation/10",
      "kind": "regulation",
      "number": "10",
      "heading": "The security duties of operators of essential services",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-10",
      "extent": null,
      "status": null,
      "parent": "part/3"
    },
    {
      "path": "regulation/11",
      "kind": "regulation",
      "number": "11",
      "heading": "The duty to notify incidents",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-11",
      "extent": null,
      "status": null,
      "parent": "part/3"
    },
    {
      "path": "part/4",
      "kind": "part",
      "number": "4",
      "heading": "Digital Services",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/12",
      "kind": "regulation",
      "number": "12",
      "heading": "Relevant digital service providers",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-12",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/4"
    },
    {
      "path": "regulation/13",
      "kind": "regulation",
      "number": "13",
      "heading": "Co-operation with the European Union",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-13",
      "extent": null,
      "status": null,
      "parent": "part/4"
    },
    {
      "path": "regulation/14",
      "kind": "regulation",
      "number": "14",
      "heading": "Registration with the Information Commission",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-14",
      "extent": null,
      "status": null,
      "parent": "part/4"
    },
    {
      "path": "regulation/14A",
      "kind": "regulation",
      "number": "14A",
      "heading": "Representatives of digital service providers established outside the United Kingdom",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-14A",
      "extent": null,
      "status": null,
      "parent": "part/4"
    },
    {
      "path": "part/5",
      "kind": "part",
      "number": "5",
      "heading": "Enforcement and penalties",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/15",
      "kind": "regulation",
      "number": "15",
      "heading": "Information notices",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-15",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/16",
      "kind": "regulation",
      "number": "16",
      "heading": "Power of inspection",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-16",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/17",
      "kind": "regulation",
      "number": "17",
      "heading": "Enforcement notices for breach of duties",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-17",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/18",
      "kind": "regulation",
      "number": "18",
      "heading": "Penalties",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-18",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/19",
      "kind": "regulation",
      "number": "19",
      "heading": "Independent review of designation decisions and penalty decisions",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-19",
      "extent": "E+W+S+N.I.",
      "status": "repealed",
      "parent": "part/5"
    },
    {
      "path": "regulation/19A",
      "kind": "regulation",
      "number": "19A",
      "heading": "Appeal by an OES or RDSP to the First-tier Tribunal",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-19A",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/19B",
      "kind": "regulation",
      "number": "19B",
      "heading": "Decision of the First-tier Tribunal",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-19B",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/A20",
      "kind": "regulation",
      "number": "A20",
      "heading": "Enforcement by civil proceedings",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-A20",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "regulation/20",
      "kind": "regulation",
      "number": "20",
      "heading": "Enforcement of penalty notices",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-20",
      "extent": null,
      "status": null,
      "parent": "part/5"
    },
    {
      "path": "part/6",
      "kind": "part",
      "number": "6",
      "heading": "Miscellaneous",
      "url": null,
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": null
    },
    {
      "path": "regulation/21",
      "kind": "regulation",
      "number": "21",
      "heading": "Fees",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-21",
      "extent": null,
      "status": null,
      "parent": "part/6"
    },
    {
      "path": "regulation/22",
      "kind": "regulation",
      "number": "22",
      "heading": "Proceeds of penalties",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-22",
      "extent": null,
      "status": null,
      "parent": "part/6"
    },
    {
      "path": "regulation/23",
      "kind": "regulation",
      "number": "23",
      "heading": "Enforcement action – general considerations",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-23",
      "extent": null,
      "status": null,
      "parent": "part/6"
    },
    {
      "path": "regulation/24",
      "kind": "regulation",
      "number": "24",
      "heading": "Service of documents",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-24",
      "extent": null,
      "status": null,
      "parent": "part/6"
    },
    {
      "path": "regulation/25",
      "kind": "regulation",
      "number": "25",
      "heading": "Review and report",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-25",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "part/6"
    },
    {
      "path": "signature",
      "kind": "signature",
      "number": null,
      "heading": "Signature",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/signature",
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "schedule/1",
      "kind": "schedule",
      "number": "1",
      "heading": "Designated Competent Authorities",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-1",
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "schedule/2",
      "kind": "schedule",
      "number": "2",
      "heading": "Essential Services and Threshold Requirements",
      "url": null,
      "extent": null,
      "status": null,
      "parent": null
    },
    {
      "path": "schedule/2/paragraph/1",
      "kind": "paragraph",
      "number": "1",
      "heading": "The electricity subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-1",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/2",
      "kind": "paragraph",
      "number": "2",
      "heading": "The oil subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-2",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/3",
      "kind": "paragraph",
      "number": "3",
      "heading": "The gas subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-3",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/4",
      "kind": "paragraph",
      "number": "4",
      "heading": "The air transport subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-4",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/5",
      "kind": "paragraph",
      "number": "5",
      "heading": "The water transport subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-5",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/6",
      "kind": "paragraph",
      "number": "6",
      "heading": "The rail transport subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-6",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/7",
      "kind": "paragraph",
      "number": "7",
      "heading": "The road transport subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-7",
      "extent": "E+W+S+N.I.",
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/8",
      "kind": "paragraph",
      "number": "8",
      "heading": "The healthcare subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-8",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/9",
      "kind": "paragraph",
      "number": "9",
      "heading": "The drinking water supply and distribution subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-9",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "schedule/2/paragraph/10",
      "kind": "paragraph",
      "number": "10",
      "heading": "The digital infrastructure subsector",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/schedule-2/paragraph-10",
      "extent": null,
      "status": null,
      "parent": "schedule/2"
    },
    {
      "path": "note",
      "kind": "note",
      "number": null,
      "heading": "Explanatory note",
      "url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/note",
      "extent": null,
      "status": null,
      "parent": null
    }
  ],
  "outstanding_effects": [
    {
      "type": "substituted",
      "affected_provisions": "Sch. 2 para. 4(5)(b)",
      "affecting": "uksi/2026/230",
      "affecting_title": "The Aviation Security (Amendment, Revocation and Consequential Provision) Regulations 2026",
      "affecting_provisions": "reg. 7(2)"
    }
  ],
  "made_under": [],
  "changes_made_to": 211,
  "changes_made_to_url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/changes.json",
  "changes_made_by": 2,
  "changes_made_by_url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/changes/by-it.json",
  "instruments_made_under": 0,
  "instruments_made_under_url": "https://openlegislation.uk/network-and-information-systems-regulations-2018/instruments.json",
  "provenance": {
    "source": "legislation.gov.uk",
    "source_url": "https://www.legislation.gov.uk/uksi/2018/506",
    "retrieved_at": "2026-10-28T22:58:45.652382+00:00"
  },
  "licence": "Open Government Licence v3.0",
  "licence_url": "https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/",
  "attribution": "Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives."
}