How this links to the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill adds public authority oversight as a new exemption from the digital and managed service provider regimes. It stops councils, universities, NHS bodies and their shared services being regulated as providers simply because they run IT for others. The test has no effect on whether a body is an operator of essential services.
- Clause 11 inserts new regulation 1(3E), which defines when a person is subject to public authority oversight.
- Clause 7(8) makes the test limb (iv) of the relevant digital service provider definition in new reg 1(3)(e).
- Clause 9(4) makes the same test limb (iv) of the relevant managed service provider definition in new reg 1(3)(ea).
- The test sits alongside, and is separate from, the micro or small enterprise exemption in limb (iii).
- Nothing in regulation 8 or clause 3 excludes public bodies from OES status, which still turns on the Schedule 2 thresholds.
What does the public authority oversight test say?
New regulation 1(3E) says a person is subject to public authority oversight if it is subject to the management or control of one or more UK public authorities, or of a board more than half of whose members are appointed by one or more UK public authorities. A "UK public authority" means any person exercising functions of a public nature in the United Kingdom.
That is a broad definition. It will usually catch local authorities, their wholly owned companies, NHS bodies, most universities with publicly appointed governing bodies, and joint ventures between public bodies. It does not depend on legal form, so a company limited by shares can be under oversight if councils control it.
How does the exemption work for digital and managed service providers?
Limb (iv) of both the RDSP and RMSP definitions requires that the provider either is not subject to public authority oversight, or is subject to it but derives more than half of its income from activities of a commercial nature. Put the other way round, a body under oversight that earns half or less of its income commercially cannot be an RDSP or RMSP.
So the exemption has two conditions, and both must be met:
- The body is under the management or control of UK public authorities, or of a board they mostly appoint.
- Half or less of its income comes from activities of a commercial nature.
What is still unsettled?
The Bill does not define "activities of a commercial nature" or say how income is measured. Whether fees one council charges another for a shared IT service count as commercial income is not settled, and nor is the period over which the income split is assessed.
A council-owned company that sells most of its managed IT services on the open market, and is not a micro or small enterprise, may be an RMSP and have to register with the Information Commission. Bodies near the half-way line should take advice on their income mix before the duties commence.
A company wholly owned by three councils provides managed IT support to its owners and to local academies and charities. It has 180 staff. It is under public authority oversight because the councils control it. If 40% of its income comes from contracts that count as commercial, it is outside RMSP status. If that share rises to 60%, it is not exempt and, being above the small enterprise ceiling, is likely to be an RMSP. This is an illustration, not legal advice.
Common misconceptions
Myth: Public bodies are exempt from the Cyber Security and Resilience Bill.
Reality: The oversight test only affects RDSP and RMSP status. A public body that provides an essential service above a NIS Schedule 2 threshold, such as a water supplier or an NHS trust, can still be an operator of essential services.
Myth: Any company owned by a council is exempt.
Reality: Ownership or control is only half the test. A council-owned company that earns more than half its income from commercial activities is not exempt.
Where it appears in the Bill
- Clause 11Inserts NIS reg 1(3E), the definition of public authority oversight.
- Clause 7(8)New reg 1(3)(e)(iv): oversight limb of the RDSP definition.
- Clause 9(4)New reg 1(3)(ea)(iv): oversight limb of the RMSP definition.
- Clause 3OES identification; excludes only public electronic communications, not public bodies.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
No. The test appears only in the definitions of relevant digital service provider and relevant managed service provider. OES status under regulation 8 of the NIS Regulations depends on providing an essential service above a Schedule 2 threshold, and the Cyber Security and Resilience Bill does not exclude public bodies from it. A public water supplier or NHS trust can still be an OES.
New regulation 1(3E) defines a UK public authority as any person exercising functions of a public nature in the United Kingdom. That covers central government, local authorities, NHS bodies and many other public organisations. A body is under oversight if one or more of them manage or control it, or appoint more than half of its board.
The Cyber Security and Resilience Bill does not define "activities of a commercial nature" or explain how income should be measured. Whether charges between public bodies for shared services count as commercial is not settled. Bodies close to the half-way point should keep evidence of their income split and take advice, since secondary legislation or regulator guidance may clarify it.