How this links to the Cyber Security and Resilience Bill
The Cyber Security and Resilience Bill amends Schedule 2 to the NIS Regulations in two places only: a new data infrastructure subsector for data centres, and a new load control service in the electricity subsector. It does not reproduce the table, so every other threshold still comes from the 2018 Regulations. The Bill’s own Schedule 2 is headed "Minor and consequential amendments" and contains no thresholds.
- Clause 4(3) inserts paragraph 11 into NIS Schedule 2: a 1 MW threshold for data centre services and 10 MW for an enterprise data centre.
- Clause 4(2) makes Ofcom the competent authority for the new data infrastructure subsector.
- Clause 6(2) inserts paragraph 1(5A): a large load controller with potential electrical control of 300 MW or more.
- Clause 24(5)(b)(i) treats every Schedule 2 essential service as an essential activity for Part 3.
How do Schedule 2 thresholds decide OES status?
Under regulation 8(1) of the NIS Regulations, a person that provides an essential service of a kind listed in Schedule 2, and meets the threshold for that service, is deemed to be an operator of essential services. No designation is needed. The operator must notify its designated competent authority.
Competent authorities can also designate an operator below the threshold under regulation 8(3). Clause 3 of the Bill confirms that both routes apply whether or not the person is established in the United Kingdom.
Which sectors have no Schedule 2 threshold?
Financial services, universities, local government and public services generally are not in NIS Schedule 2 at all. Health has no numeric threshold: scope is by type of body, such as NHS Trusts and Foundation Trusts in England and Health Boards in Scotland and Wales.
Organisations in unlisted sectors can still be caught another way: as a relevant digital service provider or relevant managed service provider, as a designated critical supplier, or under future Part 3 regulations. Telecoms is a special case, because public electronic communications networks and services are expressly excluded from OES status.
Selected NIS Schedule 2 thresholds. The first three rows are inserted by the Cyber Security and Resilience Bill; the rest are unchanged from the 2018 Regulations.
| Subsector | Threshold | Source |
|---|---|---|
| Data centre (not enterprise) | Rated IT load of 1 MW or more | Bill cl.4(3); NIS Sch 2 para 11(2) |
| Data centre (enterprise basis) | Rated IT load of 10 MW or more | Bill cl.4(3); NIS Sch 2 para 11(3) |
| Electricity: load control | Potential electrical control of 300 MW or more | Bill cl.6(2); NIS Sch 2 para 1(5A) |
| Electricity supply (GB) | More than 250,000 final customers | NIS Sch 2 para 1 |
| Gas supply | More than 250,000 final customers (GB); more than 2,000 (NI) | NIS Sch 2 |
| Aerodromes | More than 10 million annual terminal passengers | NIS Sch 2 |
| Metro, tram and light rail | More than 50 million annual passenger journeys | NIS Sch 2 |
| Drinking water | Supply to 200,000 or more people | NIS Sch 2 |
| DNS resolver service | 500,000 or more UK IP addresses in any 168-hour period | NIS Sch 2 |
| TLD name registry | 14 billion or more UK queries in any 168-hour period | NIS Sch 2 |
| Internet exchange point | 30% or more UK market share | NIS Sch 2 |
| Health care | No numeric threshold; scope by type of body | NIS Sch 2 |
Common misconceptions
Myth: The Bill’s Schedule 2 sets out the sector thresholds.
Reality: It does not. The Bill’s Schedule 2 contains minor and consequential amendments. The thresholds are in Schedule 2 to the NIS Regulations 2018.
Myth: The Bill resets all the NIS thresholds.
Reality: It changes only data centres and load control. Every other threshold stays as it has been since 2018, although the Secretary of State can amend the Regulations later.
Where it appears in the Bill
- Clause 4(2)-(3)Adds the data infrastructure subsector and NIS Sch 2 para 11 (1 MW and 10 MW).
- Clause 6(2)Adds NIS Sch 2 para 1(5A)-(5E): load control at 300 MW.
- Clause 3Amends reg 8: OES status applies whether or not established in the UK; telecoms excluded.
- Clause 24(5)(b)(i)Schedule 2 essential services are treated as essential activities for Part 3.
References are to HL Bill 32 as brought from the Commons. Read the Bill.
Frequently asked questions
Does the Cyber Security and Resilience Bill change the drinking water threshold?
No. The drinking water threshold remains supply to 200,000 or more people, as set in Schedule 2 to the NIS Regulations 2018. The Bill amends Schedule 2 only to add data centres and electricity load control. Other thresholds, including energy, transport and digital infrastructure, stay as they are unless changed later by regulations.
Can an organisation below a threshold still be an operator of essential services?
Yes. Under regulation 8(3) of the NIS Regulations a competent authority can designate a person below the threshold as an operator of essential services where an incident affecting the service would be likely to have significant disruptive effects. The Cyber Security and Resilience Bill confirms that designation can apply whether or not the person is established in the UK.
Why are financial services not in Schedule 2?
Banking and financial market infrastructure were left out of the UK NIS Regulations in 2018 because they already had their own regulators and resilience rules. The Cyber Security and Resilience Bill does not add them. A financial firm can still be caught as a digital or managed service provider, a designated critical supplier, or under future Part 3 regulations.