Critical supplier designation notices: what to expect

The short version

No format has been published for a critical supplier designation letter under the Cyber Security and Resilience Bill (CSRB), so any "template" you see is guesswork. The Bill does set out what a regulator must tell you and when.

The process has two notices: one before the decision, inviting your response, and one confirming the decision. You also have a right of appeal.

No designations can happen yet. Section 12 starts on the same day as the first regulations imposing requirements on providers of activity-critical supplies, and neither exists at the time of writing.

Who can be designated

Under regulation 14H, a regulator may designate a person if all of these are met:

1. Direct supply. You supply goods or services directly to an operator of essential services (OES), a relevant digital service provider (RDSP) or a relevant managed service provider (RMSP).
2. Reliance on systems. You rely on network and information systems for that supply.
3. Disruption potential. An incident affecting those systems could disrupt services.
4. Significant impact. That disruption is likely to significantly affect the economy or day-to-day functioning of society, in all or part of the UK.
5. No bar applies. Regulation 14I does not prevent the designation.

The regulator must particularly consider whether customers could get the goods or services elsewhere, and the likely nature, scale and duration of disruption. It must also consider whether the risk could be managed through the customer's own duties, and whether another regulator already covers you.

You can be designated even if you are not established in the UK. The test has no size exclusion like the one for digital and managed service providers.

What the two notices must contain

Notice of proposed designation (regulation 14J(1))

Before deciding, the regulator must give you written notice that:

• gives its reasons for the proposed designation
• specifies a reasonable period for written representations

It must then consider what you send. It must also consult other relevant regulators and anyone else it considers appropriate.

Confirmation notice (regulation 14J(5))

If it goes ahead, the regulator must give you a notice setting out:

• the reasons for the decision
• the date the designation takes effect

The regulator can later push that date back by giving notice to everyone who received the original.

What is still unknown

The Bill does not specify:

• the format, wording or delivery route of either notice
• how long a "reasonable period" for representations will be
• the full security and reporting duties, which will come through regulations made under Part 3

Check regulator publications as they appear. Treat anything more specific as unconfirmed.

What to do if you receive a proposed designation

This is our suggested approach, not a statutory process. Take legal advice early, because the period for representations may be short.

In the first few days

• Log the date you received it and the deadline for representations.
• Tell your legal team, senior leadership and security lead.
• Confirm which regulator sent it. Several may be involved, and regulation 14L requires them to co-ordinate.
• Check the customers and services it names.

Before the deadline

Test each element of the regulator's reasons:

Question	Evidence that may help
Do you supply the named customer directly?	Contracts and supply chain maps
Do you rely on systems for that supply?	Service architecture and manual fallback plans
Could customers switch to someone else?	Competitor lists, contract terms and switching times
Would disruption have a significant wider impact?	Volumes, customer dependency and continuity arrangements
Could the customer's own duties manage the risk?	Customer controls and contractual security terms
Does another regulator already cover you?	Existing authorisations and supervisory arrangements
Does regulation 14I bar this designation?	Your existing OES, RDSP or RMSP status for that service

Send written representations before the deadline, and keep a record of them.

If you are designated

• Diarise the date the designation takes effect.
• Assign an accountable owner.
• Prepare for information notices, which regulators can issue to people they have designated.
• Review duties in the relevant regulations once published.
• Consider an appeal.

Your right to appeal

Schedule 1 of the Bill lets you appeal a designation to the First-tier Tribunal. The grounds in regulation 19A are:

• a material error of fact
• a procedural failure that substantially prejudiced you
• an error of law
• other material irrationality, such as unreasonableness or lack of proportionality, that substantially prejudiced you

Check time limits with your legal adviser.

Getting a designation revoked

A regulator may revoke a designation if the tests are no longer met. If you have reasonable grounds to believe you could no longer be designated, regulation 14K says you must tell the regulator in writing as soon as practicable, with evidence.

That makes this an ongoing duty, not only an option. If customers move to other suppliers or the service changes, review your position. Before deciding to revoke, the regulator must follow the same consultation process.

Prepare before any notice arrives

If you think you may be a candidate, keep these ready:

• a list of OES, RDSP and RMSP customers
• a map of which systems support them
• continuity and fallback plans
• evidence of how easily customers could switch

The same material helps if customers ask about the Bill before any regulator does.

Sources

• The Bill as brought from the Commons, HL Bill 32: section 12, section 60 and Schedule 1
• NIS Regulations 2018, regulation 19A: appeals