15 Information notices

(1) In order to assess whether a person should be an OES, a designated competent authority may serve an information notice in writing upon any person requiring that person to provide it with all such information as it reasonably requires to establish whether—

(a) a threshold requirement described in ... Schedule 2 is met; or

(b) the conditions mentioned in regulation 8(3) are met.

(2) A designated competent authority may serve an information notice in writing upon an OES requiring the OES to provide it with all such information as it reasonably requires for one or more of the following purposes—

(a) to assess the security of the OES’s network and information systems;

(b) to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c) to identify any failure of the OES to comply with any duty set out in these Regulations;

(d) to assess the implementation of the OES’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(3) The Information Commission may serve upon a RDSP an information notice in writing requiring that RDSP to provide the Information Commission with all such information as the Information Commission reasonably requires for one or more of the following purposes—

(a) to assess the security of the RDSP’s network and information systems;

(b) to establish whether there have been any events that the Information Commission has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c) to identify any failure of the RDSP to comply with any duty set out in these Regulations;

(d) to assess the implementation of the RDSP’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) An information notice must—

(a) describe the information that is required by the designated competent authority or the Information Commission;

(b) provide the reasons for requesting such information;

(c) specify the form and manner in which the requested information is to be provided; and

(d) specify the time period within which the information must be provided.

(5A) A person upon whom an information notice has been served under this regulation must comply with the requirements of the notice.

(6) In a case falling within paragraph (1) the information notice may—

(a) be served by publishing it in such manner as the designated competent authority considers appropriate in order to bring it to the attention of any persons who are described in the notice as the persons from whom the information is required; and

(b) take the form of a general request for a certain category of persons to provide the information that is specified in the notice.

(7) A competent authority or the Information Commission may withdraw an information notice by written notice to the person on whom it was served.

(8) An information notice under paragraph (1) may not be served upon the SPOC or CSIRT.