How this links to the Cyber Security and Resilience Bill
The NIS Regulations 2018 had no separate early warning; reports were due without undue delay and within 72 hours. The Bill introduces a two-stage process in which a short initial notification is due within 24 hours of first awareness. It is the tightest deadline in the regime and needs a tested decision process.
- Reg 11(2)(a) and 11(6)(a): OES initial notification within 24 hours.
- Reg 11A(2)(a) and 11A(5)(a): data centre equivalent.
- Reg 12A(1)(a) and 12A(5)(a): RDSP equivalent, to the Information Commission.
- Reg 14E(1)(a) and 14E(5)(a): RMSP equivalent, to the Information Commission.
- Regs 11(8), 11A(7), 12A(7) and 14E(7): copy to the CSIRT at the same time.
When does the 24-hour clock start?
The period begins "with the time at which" the organisation is first aware that a reportable incident has occurred or is occurring. It does not start when the incident began, and it does not wait until the investigation is complete.
In practice the risk is the gap between a technical alert and a decision that the event passes the significant incident test. Awareness is not defined, so organisations should assume a regulator will look at when the relevant people had enough information to recognise a reportable incident, not when a formal meeting confirmed it.
What must the initial notification contain?
The content is deliberately short, so that it can be sent before the facts are clear. It must be in writing and in the form and manner the regulator determines. Regulators have not yet published forms for the new regime, so organisations should prepare a template now and adapt it later. The Bill lists three items:
- the organisation's name;
- the essential service, data centre service, relevant digital service or managed service to which the incident relates;
- brief details of the incident.
Who receives it?
Operators of essential services, including data centre operators, notify their designated competent authority. Digital and managed service providers notify the Information Commission. In every case a copy must go to the CSIRT at the same time.
Failure to notify, or failure to meet the timing and written-form rules, is in the higher penalty band. Failing to send the CSIRT copy is in the standard band. The fuller account follows as the full incident report, due within 72 hours of the same moment of awareness.
Incident notification rules compared: OES, data centre, RDSP and RMSP
| Rule | OES (non-data centre) | Data centre OES | RDSP | RMSP |
|---|---|---|---|---|
| Regulation | Reg 11 | Reg 11A | Reg 12A | Reg 14E |
| Who you notify | Designated competent authority for the OES | Designated competent authority (Ofcom, cl.4(2)) | Information Commission | Information Commission |
| What makes it reportable | Has affected or is affecting the operation or security of the systems, and impact has been, is or is likely to be significant (reg 11(3)-(4)) | Could have had, has had, is having or is likely to have a significant impact (reg 11A(3)) | Has affected or is affecting the systems, and impact is or is likely to be significant, with 7 factors (reg 12A(2)-(3)) | Has affected or is affecting the systems, and impact is or is likely to be significant, with 7 factors (reg 14E(2)-(3)) |
| 24-hour initial notification | From first awareness (reg 11(6)(a)) | From first awareness (reg 11A(5)(a)) | From first awareness (reg 12A(5)(a)) | From first awareness (reg 14E(5)(a)) |
| 72-hour full notification | From the same moment of first awareness (reg 11(6)(b)) | From the same moment (reg 11A(5)(b)) | From the same moment (reg 12A(5)(b)) | From the same moment (reg 14E(5)(b)) |
| Customer notification duty | None in the Bill | Yes, reg 11C | Yes, reg 12C | Yes, reg 14G |
| Copy to the CSIRT (NCSC) | At the same time, reg 11(8) | At the same time, reg 11A(7) | At the same time, reg 12A(7) | At the same time, reg 14E(7) |
Where it appears in the Bill
- New reg 11(2)(a), 11(6)(a)OES initial notification and 24-hour deadline.
- New reg 11A(2)(a), 11A(5)(a)Data centre initial notification.
- New reg 12A(1)(a), 12A(5)(a)RDSP initial notification.
- New reg 14E(1)(a), 14E(5)(a)RMSP initial notification.
- New reg 18(10)-(11)CSIRT copy in standard band; notification and timing in higher band.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Does the 24-hour clock start when the incident happens?
No. It starts at the time the organisation is first aware that a reportable incident has occurred or is occurring. An intrusion that began weeks earlier but was only discovered today starts the clock today. The practical pressure is on the time between detection and recognising that the incident is significant, which is why triage needs to be fast and documented.
Can the initial notification be incomplete?
Yes, by design. It only requires your name, the affected service and brief details of the incident. The fuller information, including timing, nature, cause and impact, belongs in the full notification due within 72 hours of first awareness. Send the initial notification on what you know rather than delaying it to gather more facts.
Do we have to notify the NCSC separately?
You must send a copy of the notification to the CSIRT at the same time as notifying your regulator. The CSIRT function under the NIS Regulations is performed by the NCSC, part of GCHQ. The Bill does not create a single joint portal in its text, so check your regulator's form and manner requirements once they are published.