Glossary · Enforcement and powers

Inspection

Definition

An inspection is a regulator’s examination of whether a regulated organisation is meeting its duties, under regulation 16 of the NIS Regulations 2018. The Cyber Security and Resilience Bill (Schedule 1) extends it to managed service providers, adds a notice requirement and territorial limits, and puts inspection failures in the higher penalty band.

How does a NIS inspection work?

Under reg 16 of the 2018 Regulations, a competent authority (for OESs) or the Information Commission (for digital and, under the Bill, managed service providers) can carry out an inspection itself, appoint someone to do it, or direct the organisation to appoint an inspector the regulator has approved. The Bill does not change these three routes.

During an inspection the organisation must pay the reasonable costs if required, co-operate, give access to premises, allow documents and equipment to be examined, give access to staff, not obstruct the inspector, and comply with the inspector’s requests (reg 16(3)). Inspectors can enter premises, require material to be preserved, take statements and carry out tests (reg 16(5)). These duties come from the 2018 Regulations rather than the Bill.

What does the Bill add?

Beyond extending inspections to RMSPs, the Bill adds three safeguards. The inspector must give advance notice of the consequences of non-compliance (new reg 16(4A)). Privileged legal communications cannot be demanded (new reg 16(8A)). Entry and seizure powers cannot be used outside the UK, although documents and information stored abroad remain within reach (new reg 16(8B)).

Inspection findings also feed the new information notice power: reg 15(4)(g) and (5)(g) let a regulator demand information to assess security measures, including as a result of an inspection.

Are there other inspection powers in the Bill?

Yes. Clause 47 creates a separate inspection power for Part 4 national security directions, used by the Secretary of State or a regulator monitoring a direction. A regulated person that contravenes a Part 4 inspection requirement faces up to £10 million, and up to £50,000 a day if the contravention continues (cl.49(2)(c), (3)(b)). Clause 31(3) also lets future Part 3 regulations give inspectors powers of entry, search and seizure, and cl.31(4) allows those powers to be made subject to conditions such as a warrant.

Worked example (illustrative)

An inspection of a managed service provider

Illustrative only. After a customer incident, the Information Commission directs an RMSP to appoint an approved third-party inspector under reg 16(2)(c). The inspector gives the reg 16(4A) notice, reviews access controls and asks to test a remote management platform. The RMSP must co-operate and, if required, pay the reasonable costs. Refusing access would be a higher band failure.

Where it appears in the Bill

  • Sch 1 para 2Amends reg 16 to cover RMSPs and adds new paragraphs (4A), (8A) and (8B).
  • New reg 18(11)(a)(viii), (b)(vi), (c)(vi)-(vii)Inspection failures in the higher band.
  • cl.47Separate inspection power for Part 4 national security directions.
  • cl.31(3)-(4)Inspection and entry powers that future Part 3 regulations may confer.

References are to HL Bill 32 as brought from the Commons. Read the Bill.

Frequently asked questions

Do we have to pay for a regulator’s inspection?

You may. Regulation 16(3)(a) of the NIS Regulations 2018 requires the inspected organisation to pay the reasonable costs of the inspection if the competent authority or the Information Commission requires it. The Bill keeps that duty and extends it to managed service providers. Regulators will also be able to recover wider costs through charging schemes under new regs 20A to 20C.

Can an inspector enter our offices outside the UK?

No. New reg 16(8B) says the inspection powers are not exercisable in relation to premises, material, equipment or individuals outside the United Kingdom. They can, however, reach documents and information wherever they are stored, so data held in an overseas cloud region is still within scope of an inspection.

What is the penalty for obstructing an inspection?

Failing to comply with an inspection direction under reg 16(1)(c) or 16(2)(c), or with the duties in reg 16(3), is listed in new reg 18(11). The maximum is therefore the higher band: the greater of £17 million and 4% of worldwide turnover for an undertaking. The regulator can also serve an enforcement notice.

Related guidance

Official sources

More in Enforcement and powers

Full glossary