Watchtower/Law library/Network and Information Systems Regulations 2018
As last captured

legislation

Network and Information Systems Regulations 2018

Network and Information Systems Regulations 2018 requires relevant digital service providers to manage network security and report incidents under reg. 12, submit registration details under reg. 14, and nominate UK representatives under reg. 14A.

Verified at publication, 2026-11-12 11:39 UTC

40 provisions in 7 parts · official text ↗

trbfpseuipsvmemccm
impact by vertical

Summary

What this law does

Establishes cybersecurity risk management and incident reporting obligations for operators of essential services and relevant digital service providers, setting national governance structures, competent authority oversight, information sharing frameworks, and enforcement powers across the United Kingdom.

Why it matters to Signicat and its customers

No Signicat-specific relevance narrative is stored for this instrument; the stored applicability is shown below.

Who is bound: A RDSP; The Information Commission; the operator; The digital service provider · Regulators: Information Commission; competent authorities; GCHQ; Drinking Water Quality Regulator for Scotland

Transportation
Applies security requirements and incident reporting duties to operators of essential services in transport subsectors meeting designated thresholds.
Public Sector Health
Applies cybersecurity obligations and incident reporting to healthcare providers and water authorities designated as operators of essential services.
Energy Utility Telco
Applies security management and incident reporting obligations to operators of essential services across energy and digital infrastructure subsectors.
Commerce
Imposes cybersecurity risk management, incident reporting, and registration requirements on relevant digital service providers operating online marketplaces.

Key obligations each linked to the provision it comes from

A RDSP must take appropriate and proportionate security measures under (1) to manage risks to network and information systems for online marketplaces, search engines, or cloud computing services. Under (3), it must notify the Information Commission in writing about any substantial impact incident without undue delay and no later than 72 hours after becoming aware, providing the details listed in (5). Under (9), an OES reliant on a RDSP must notify its designated competent authority of significant impacts without undue delay.
reg. 12
evidence.audit_trail

Part summaries

0 of 0 parts have a verified summary.

L1 unavailable for current verification: the overall summary needs every part verified. Provisions and the verified summaries remain readable.

Verification findings (48)

synthesis coverage: missing/unverified L2 part-1

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-1

synthesis coverage: missing/unverified L2 part-2

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-2

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-3

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-4

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-5

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-6

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-7

synthesis coverage: missing/unverified L2 part-3

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-8

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-8A

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-9

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-10

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-11

synthesis coverage: missing/unverified L2 part-4

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-12

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-13

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-14

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-14A

synthesis coverage: missing/unverified L2 part-5

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-15

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-16

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-17

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-18

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-19

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-19A

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-19B

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-A20

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-20

synthesis coverage: missing/unverified L2 part-6

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-21

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-22

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-23

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-24

synthesis coverage: missing evaluation uk:uksi/2018/506#regulation-25

synthesis coverage: missing/unverified L2 schedule-2

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-1

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-2

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-3

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-4

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-5

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-6

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-7

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-8

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-9

synthesis coverage: missing evaluation uk:uksi/2018/506#schedule-2-paragraph-10

Instrument tier unavailable

Change history as published

Reg. 19 omitted (31.12.2020) by virtue of The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 15 (with reg. 21)

Pending effects amendments not yet applied to this text

Sch. 2 para. 4(5)(b) substituted by The Aviation Security (Amendment, Revocation and Consequential Provision) Regulations 2026 reg. 7(2) · Effective date unknown · Sch. 2 para. 4

Full TOC · table of contents Expand all parts

7 parts · 40 provisions. Open a provision for its text and, where available, its one-line summary.

PART 1 Introduction · 1 provisions
1 Citation, commencement, interpretation and application
PART 2 The National Framework · 6 provisions
2 The NIS national strategy
3 Designation of national competent authorities
4 Designation of the single point of contact
5 Designation of computer security incident response team
6 Information sharing – enforcement authorities
7 Information sharing – Northern Ireland
PART 3 Operators of essential services · 5 provisions
8 Identification of operators of essential services
8A Nomination by an OES of a person to act on its behalf in the United Kingdom
9 Revocation
10 The security duties of operators of essential services
11 The duty to notify incidents
PART 4 Digital Services · 4 provisions
12 Relevant digital service providers
13 Co-operation with the European Union
14 Registration with the Information Commission
14A Representatives of digital service providers established outside the United Kingdom
PART 5 Enforcement and penalties · 9 provisions
15 Information notices
16 Power of inspection
17 Enforcement notices for breach of duties
18 Penalties
19 Independent review of designation decisions and penalty decisions
19A Appeal by an OES or RDSP to the First-tier Tribunal
19B Decision of the First-tier Tribunal
A20 Enforcement by civil proceedings
20 Enforcement of penalty notices
PART 6 Miscellaneous · 5 provisions
21 Fees
22 Proceeds of penalties
23 Enforcement action – general considerations
24 Service of documents
25 Review and report
SCHEDULE 2 · 10 provisions
1 The electricity subsector
2 The oil subsector
3 The gas subsector
4 The air transport subsector
5 The water transport subsector
6 The rail transport subsector
7 The road transport subsector
8 The healthcare subsector
9 The drinking water supply and distribution subsector
10 The digital infrastructure subsector

Impact profile

Transportation
2
Banking finance
1
Public sector health
2
Energy, utilities & telco
2
Insurance pensions
0
Services
1
Media entertainment
1
Manufacturing construction
0
Commerce
2

Dimensions

Mechanism strength
1
Signicat obligation
1
Urgency
Pending

Key dates

10th May 2018come into force
reg. 1

Penalties

not supplied

Definitions

cloud computing service
“a digital service that enables access to a scalable and elastic pool of shareable computing resources;”
reg. 1
digital service provider
“any person who provides a digital service;”
reg. 1
essential service
“a service which is essential for the maintenance of critical societal or economic activities;”
reg. 1
incident
“any event having an actual adverse effect on the security of network and information systems;”
reg. 1
representative
“any natural or legal person established in the United Kingdom who is able to act on behalf of a digital service provider established outside the United Kingdom with regard to its obligations under these Regulations;”
reg. 1
risk
“any reasonably identifiable circumstance or event having a potential adverse effect on the security of network and information systems.”
reg. 1

References

uk:eudr/1978/660 (unregistered reference)

uk:eudr/1983/349 (unregistered reference)

uk:eudr/2003/54 (unregistered reference)

uk:eudr/2003/55 (unregistered reference)

uk:eudr/2006/43 (unregistered reference)

uk:eudr/2009/22 (unregistered reference)

uk:eudr/2009/72 (unregistered reference)

uk:eudr/2009/73 (unregistered reference)

uk:eur/2004/2006 (unregistered reference)

uk:eur/2008/300 (unregistered reference)