How this links to the Cyber Security and Resilience Bill
The NIS Regulations 2018 already regulate cloud providers, but the Cyber Security and Resilience Bill replaces the definition with a longer, more precise one. It spells out what broad remote access, scalable, elastic and shareable mean, excludes services built solely for the provider’s own business, and draws a clear line between cloud and managed services.
- Cl.7(3) substitutes the definition of cloud computing service in reg 1(2).
- Cl.7(7) inserts reg 1(2A), defining broad remote access, scalable, elastic and shareable.
- Limb (a)(iv) excludes a service provided solely for the purposes of the provider’s own business or activity.
- Limb (b) excludes managed services, so a service cannot be both.
What are the conditions in the new definition?
The service must enable access to a scalable and elastic pool of shareable computing resources, such as networks, servers, software and storage, where all four of these apply:
- There is broad remote access: it can be used from any authorised location by any capable device.
- It is capable of being provided on demand and on a self-service basis.
- The pool of resources may be distributed across two or more locations.
- It is not provided solely for use for the purposes of the provider’s own business or activity.
How do scalable, elastic and shareable work?
Reg 1(2A) defines each term. Resources are scalable if the provider allocates them flexibly, irrespective of location, to handle fluctuations in demand. They are elastic if provided and released according to demand to rapidly increase and decrease capacity. They are shareable if multiple users share common access to the service from the same equipment, with processing carried out separately for each user.
Together these capture public IaaS, PaaS and most multi-tenant SaaS. A provider of such a service in the UK is a relevant digital service provider unless it is a micro or small enterprise or exempt under the public authority oversight limb. A service that is instead ongoing management of a customer’s own systems is a managed service.
Where it appears in the Bill
- cl.7(3), reg 1(2)New definition of cloud computing service.
- cl.7(7), reg 1(2A)Meaning of broad remote access, scalable, elastic and shareable.
- cl.7(5), reg 1(2)Cloud is one of the three relevant digital services.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Is SaaS a cloud computing service under the Bill?
Often, yes. Software is listed as a computing resource, so a multi-tenant SaaS product offered remotely, on demand and on a self-service basis, drawing on scalable and elastic infrastructure, is likely to meet the definition. A bespoke single-customer deployment, or one built solely for the provider’s own business, is less likely to.
Is a private cloud run for my own company in scope?
No. Limb (a)(iv) of the new definition excludes a service that is provided by a person solely for use for the purposes of a business or other activity carried on by that person. An internal cloud platform used only by the organisation that runs it is therefore not a cloud computing service.
Can a service be both a cloud and a managed service?
No. The new cloud definition expressly requires that the service is not a managed service. A provider can offer both types, for example a hosted platform alongside managed IT support, and may then be both an RDSP and an RMSP, but each individual service falls into one category only.