How this links to the Cyber Security and Resilience Bill
Inspection powers already exist in regulation 16 of the 2018 Regulations. Schedule 1 paragraph 2 brings managed service providers within them and adds safeguards. Clause 21 then puts failure to comply with an inspection direction or with the inspection duties in the higher band, so obstructing an inspection now carries the same ceiling as a security failure.
- Sch 1 para 2(2), (3), (5), (6): extends reg 16 to relevant managed service providers.
- New reg 16(4A): the inspector must first give a notice explaining the consequences of failing to comply with the reg 16(3) duties.
- New reg 16(8A) and (8B): privileged communications are protected; physical powers stop at the UK border, but documents and information can be reached wherever they are stored.
- New reg 18(11): failures under reg 16(1)(c), 16(2)(c) and 16(3) fall in the higher maximum penalty band.
How does a NIS inspection work?
Under reg 16 of the 2018 Regulations, a competent authority (for OESs) or the Information Commission (for digital and, under the Bill, managed service providers) can carry out an inspection itself, appoint someone to do it, or direct the organisation to appoint an inspector the regulator has approved. The Bill does not change these three routes.
During an inspection the organisation must pay the reasonable costs if required, co-operate, give access to premises, allow documents and equipment to be examined, give access to staff, not obstruct the inspector, and comply with the inspector’s requests (reg 16(3)). Inspectors can enter premises, require material to be preserved, take statements and carry out tests (reg 16(5)). These duties come from the 2018 Regulations rather than the Bill.
What does the Bill add?
Beyond extending inspections to RMSPs, the Bill adds three safeguards. The inspector must give advance notice of the consequences of non-compliance (new reg 16(4A)). Privileged legal communications cannot be demanded (new reg 16(8A)). Entry and seizure powers cannot be used outside the UK, although documents and information stored abroad remain within reach (new reg 16(8B)).
Inspection findings also feed the new information notice power: reg 15(4)(g) and (5)(g) let a regulator demand information to assess security measures, including as a result of an inspection.
Are there other inspection powers in the Bill?
Yes. Clause 47 creates a separate inspection power for Part 4 national security directions, used by the Secretary of State or a regulator monitoring a direction. A regulated person that contravenes a Part 4 inspection requirement faces up to £10 million, and up to £50,000 a day if the contravention continues (cl.49(2)(c), (3)(b)). Clause 31(3) also lets future Part 3 regulations give inspectors powers of entry, search and seizure, and cl.31(4) allows those powers to be made subject to conditions such as a warrant.
Worked example (illustrative)
An inspection of a managed service provider
Illustrative only. After a customer incident, the Information Commission directs an RMSP to appoint an approved third-party inspector under reg 16(2)(c). The inspector gives the reg 16(4A) notice, reviews access controls and asks to test a remote management platform. The RMSP must co-operate and, if required, pay the reasonable costs. Refusing access would be a higher band failure.
Where it appears in the Bill
- Sch 1 para 2Amends reg 16 to cover RMSPs and adds new paragraphs (4A), (8A) and (8B).
- New reg 18(11)(a)(viii), (b)(vi), (c)(vi)-(vii)Inspection failures in the higher band.
- cl.47Separate inspection power for Part 4 national security directions.
- cl.31(3)-(4)Inspection and entry powers that future Part 3 regulations may confer.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Do we have to pay for a regulator’s inspection?
You may. Regulation 16(3)(a) of the NIS Regulations 2018 requires the inspected organisation to pay the reasonable costs of the inspection if the competent authority or the Information Commission requires it. The Bill keeps that duty and extends it to managed service providers. Regulators will also be able to recover wider costs through charging schemes under new regs 20A to 20C.
Can an inspector enter our offices outside the UK?
No. New reg 16(8B) says the inspection powers are not exercisable in relation to premises, material, equipment or individuals outside the United Kingdom. They can, however, reach documents and information wherever they are stored, so data held in an overseas cloud region is still within scope of an inspection.
What is the penalty for obstructing an inspection?
Failing to comply with an inspection direction under reg 16(1)(c) or 16(2)(c), or with the duties in reg 16(3), is listed in new reg 18(11). The maximum is therefore the higher band: the greater of £17 million and 4% of worldwide turnover for an undertaking. The regulator can also serve an enforcement notice.