How to register with your regulator under the Cyber Security and Resilience Bill

Who has to do what

Under the Cyber Security and Resilience Bill (CSRB), the route depends on your category. References below are to HL Bill 32, and may change.

Category	Goes to	Provision	Deadline
RMSP	Information Commission	Reg 14C	Three months from section 14 starting, or from first meeting the conditions
RDSP	Information Commission	Reg 14, amended	Three months from section 14 starting, or from first meeting the conditions
Data centre OES	Ofcom	Reg 8ZA	Three months from being deemed or designated an OES
Other OES	Its designated competent authority	Reg 8(2)	Notify within three months of meeting the threshold
Critical supplier	No self-registration; designated by regulator notice	Regs 14H and 14J	From the date in the notice

What to prepare

RMSPs

• Your name
• Your proper address: for a company, the registered or principal office
• For a company, the names of your directors
• For a partnership, the names of the partners or those managing the business
• Up-to-date contact details, with email addresses and telephone numbers

RDSPs

The list is similar to the RMSP list, and also includes which relevant digital services you provide. Provide contact details in the way the Regulations and the Information Commission require.

Data centres

Ofcom gets your name, proper address, directors or partners, and contact details, under regulation 8ZA.

A practical checklist

1. Record why you are in scope. Save the reasoning with a date.
2. Decide who the registering entity is. Group structures can be confusing, so identify the entity that actually provides the service.
3. Set up shared contacts. Use a monitored mailbox and phone number, not one person's details.
4. Name a process owner for the 7-day update duty. Link it to your company secretarial process, so a director change triggers an update.
5. Nominate a UK representative if your principal office is outside the UK.
6. Watch for the regulator's process. The Bill does not set out a portal or form for RMSP registration.
7. Budget for charges. Regulators can recover costs through charging schemes, and registration may be connected to fees. No amounts are set in the Bill.

When the clock starts

Section 14 is not in the fixed commencement lists in section 60, so its start date will be set by regulations. Being "in scope" on that day starts your three months. If you only meet the conditions later, for example because you grow past the small enterprise limits, your three months starts on that later date.

So check your size and services regularly, not only once.

Common mistakes to avoid

• Waiting for a reminder. The duty is on you. Nothing in the text says the regulator must first contact you.
• Registering the wrong company. Sales, contracting and delivery may sit in different group companies.
• Forgetting to re-check size. A provider can grow out of the small enterprise exclusion after an acquisition or a good year.
• Letting contact details go stale. A leaver's mailbox is not an up-to-date contact.

After registering

The Information Commission must send a copy of its register to GCHQ within four months of section 14 starting, and then each year. Registration also makes you visible to the regulator for information requests and inspections.

Penalties

Failing to give RMSP or RDSP registration details, or to update them, falls in the standard band: a maximum of the greater of £10 million and 2% of turnover for undertakings. See fines and penalties.

Sources

• The Bill as brought from the Commons (HL Bill 32), sections 13, 14, 21 and 60
• Government RMSP factsheet
• NIS Regulations 2018