How this links to the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill writes the telecoms carve-out into all three NIS regimes. Public networks and services already have their own security framework under the Communications Act 2003, so the Bill avoids regulating the same activity twice. The exclusion is tied to the activity, not the company, so a telecoms group can still be caught for its other services.
- Clause 3(3) substitutes reg 8(1A): OES status does not apply to the provision of a public electronic communications network or service.
- Clause 7(9) inserts reg 1(3A): providing one is not providing a relevant digital service.
- Clause 9(5) inserts reg 1(3D)(b): providing one is not providing a managed service.
- All three use the definitions in section 151(1) of the Communications Act 2003.
What exactly is excluded?
The Bill excludes the provision of a public electronic communications network or a public electronic communications service, each as defined in section 151(1) of the Communications Act 2003. In broad terms, that means fixed and mobile networks and the connectivity services offered over them to the public, such as broadband, mobile and telephony.
The exclusion is worded around the provision of the network or service. A telecoms provider is not an operator of essential services because of its public network, but it is not exempt for everything else it does.
Can a telecoms provider still be in scope?
Yes, for activities outside its public network and services. A telecoms group can still be caught if it:
- Provides a cloud computing service, online marketplace or search engine, making it an RDSP.
- Provides managed IT services to business customers, making it an RMSP.
- Operates a data centre service above the 1 MW or 10 MW threshold.
- Provides digital infrastructure listed in NIS Schedule 2, such as DNS or an internet exchange point, for which Ofcom is already the competent authority.
- Is designated as a critical supplier, once that power commences.
Does the exclusion extend to Part 3 and Part 4?
Not expressly. The exclusions amend the NIS Regulations definitions. Part 3 of the Bill uses its own definition of network and information system, which includes an electronic communications network under section 32(1) of the Communications Act 2003. Whether future Part 3 regulations will cover telecoms activities is not settled and will depend on how those regulations are drafted.
Telecoms providers should therefore watch the Part 3 consultations. Clause 42 requires the Government to consult before regulations impose requirements on regulated persons, and a draft of those regulations must be approved by each House.
Where it appears in the Bill
- Clause 3(3)Substitutes NIS reg 8(1A): telecoms excluded from OES status.
- Clause 7(9)Inserts NIS reg 1(3A): telecoms excluded from relevant digital services.
- Clause 9(5)Inserts NIS reg 1(3D)(b): telecoms excluded from managed services.
- Clause 24(1)Part 3 definition of network and information system includes electronic communications networks.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Are mobile and broadband providers regulated under the Cyber Security and Resilience Bill?
Not for their public networks and services. The Bill excludes public electronic communications networks and services from OES, digital service provider and managed service provider status. Those networks are already subject to security duties under the Communications Act 2003, overseen by Ofcom. A provider can still be caught for other services, such as cloud, managed IT or data centres.
Is a telecoms company that runs a data centre in scope?
It can be. The telecoms exclusion applies only to providing a public electronic communications network or service. A data centre service is a separate essential service under the new data infrastructure subsector. If the data centre meets the 1 MW threshold, or 10 MW for an enterprise data centre, the operator is an operator of essential services regulated by Ofcom.
Where is "public electronic communications network" defined?
In section 151(1) of the Communications Act 2003. The Cyber Security and Resilience Bill does not create its own definition. Each of its three exclusions, for operators of essential services, relevant digital services and managed services, refers directly to that section, so the scope of the carve-out follows existing telecoms law.