# The Network and Information Systems Regulations 2018, Regulation 10: The security duties of operators of essential services


(1) An OES must take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies.
(2) An OES must take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of an essential service, with a view to ensuring the continuity of those services.
(3) The measures taken under paragraph (1) must, having regard to the state of the art, ensure a level of security of network and information systems appropriate to the risk posed.
(4) Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) and (2).

---
Source: https://www.legislation.gov.uk/uksi/2018/506/regulation/10 (the official version)
Page: https://openlegislation.uk/network-and-information-systems-regulations-2018/regulation-10
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.