OES vs RDSP vs RMSP: which one are you?
An OES runs an essential service above a set threshold, an RDSP provides cloud computing, an online marketplace or a search engine, and an RMSP provides ongoing IT management to customers. The Cyber Security and Resilience Bill (CSRB) gives each its own duties, and one organisation can fall into more than one.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The categories side by side
The Cyber Security and Resilience Bill (CSRB) amends the NIS Regulations 2018, which sort regulated organisations by what they provide.
| OES | RDSP | RMSP | Critical supplier | |
|---|---|---|---|---|
| Stands for | Operator of essential services | Relevant digital service provider | Relevant managed service provider | No acronym |
| What it covers | Essential services above a threshold, now including data centres and large load controllers | Cloud computing, online marketplaces and online search engines | Ongoing management of a customer's IT systems, with access to them | Direct suppliers designated by a regulator |
| How you get in | Meeting a Schedule 2 threshold, or designation | Meeting the definition | Meeting the definition | Designation only |
| Micro or small excluded? | Not by this exclusion | Yes | Yes | Not by this exclusion |
| Regulator | Depends on sector; Ofcom for data centres | Information Commission | Information Commission | The regulator that designated you |
| Security duty | Regulation 10 | Regulation 12 | Regulation 14B | To be set in regulations |
| Incident reporting | Regulation 11, or 11A for data centres | Regulation 12A | Regulation 14E | To be set in regulations |
| Customer notification | Data centres only (regulation 11C) | Regulation 12C | Regulation 14G | To be set in regulations |
All of these can apply to providers based outside the UK if they provide the service in the UK.
Work out which applies
Answer these in order, and keep going, because you can meet more than one.
1. Do you provide an essential service?
Check the sectors in Schedule 2 of the NIS Regulations: electricity, oil, gas, air, water, rail and road transport, healthcare, drinking water and digital infrastructure. The Bill adds data centres and load control. If you meet the threshold, you are treated as designated as an OES. A regulator can also designate an organisation that is below a threshold.
The specific figures that matter most under the Bill are:
- Data centres: rated IT load of 1 MW, or 10 MW for an enterprise data centre, which serves only its owner's or manager's own undertaking.
- Load controllers: potential electrical control of 300 MW across the relevant energy smart appliances they manage.
Banking and financial market infrastructure are not subsectors in Schedule 2.
2. Do you provide a relevant digital service?
That means one of three things: an online marketplace, an online search engine or a cloud computing service. Cloud has a specific definition. It covers scalable, elastic, shareable resources with broad remote access, on demand and on a self-service basis. It excludes a managed service, and a service a business provides only for its own use.
3. Do you provide a managed service?
All of these must be true:
- You provide the service under a contract with a customer.
- It is for ongoing management of IT systems, such as support, maintenance, monitoring or active administration.
- You or someone on your behalf connect to or access systems the customer relies on for its business or other activity, on site or remotely.
Data centre services and public telecoms networks and services are carved out. A one-off project without ongoing management looks unlikely to meet the test. That is our reading, so wait for regulator guidance on borderline cases.
4. Apply the exclusions
For RDSP and RMSP status, you are out if you are a micro or small enterprise. A provider subject to public authority oversight is also out, unless more than half of its income comes from commercial activities.
5. Could you be a critical supplier?
You cannot apply to be one, and it is not automatic. A regulator may designate you if you directly supply a regulated organisation, you rely on network and information systems for that supply, and an incident could cause disruption with a significant impact on the economy or day-to-day functioning of society. You cannot be designated for a service that already makes you an OES, RDSP or RMSP.
The regulator must give you written reasons first and a reasonable period to respond. Specific critical supplier requirements are to be set in later regulations.
Worked examples
These examples are our reading of the Bill's text, not regulator decisions.
| Organisation | Likely category | Why |
|---|---|---|
| Mid-sized IT company running helpdesks and patching for clients | RMSP | Ongoing management, with access to customer systems |
| Colocation provider with a 2 MW facility | OES (data centre) | Above the 1 MW threshold |
| Retailer with its own 5 MW data centre, used only for its own IT | Not by that facility | Below the 10 MW enterprise threshold |
| Large company with both a cloud platform and a managed service | RDSP and RMSP | Categories attach to each service |
| 20-person MSP with no parent group | Probably out of direct scope | Micro and small enterprises are excluded |
| Specialist software supplier to a hospital | Possibly a critical supplier | Depends on regulator designation |
What to do next
Write down your answer for each service, with your reasoning and the date, then use the guide for your category: MSP compliance checklist, data centres, cloud providers or critical suppliers.
Sources
Frequently asked questions
OES stands for operator of essential services. It covers organisations providing an essential service in sectors such as energy, transport, healthcare, drinking water and digital infrastructure, where they meet the relevant threshold. The Bill adds data centres and large load controllers.
RDSP stands for relevant digital service provider. It means a provider of an online marketplace, online search engine or cloud computing service in the UK that is not a micro or small enterprise and meets the public authority oversight conditions.
RMSP stands for relevant managed service provider. It means a provider of a managed service in the UK, under a contract for the ongoing management of a customer’s IT systems with access to systems the customer relies on. Micro and small enterprises are excluded.
Yes. The categories attach to services, so a company could be an RDSP for a cloud platform and an RMSP for a separate managed service. Each category’s duties apply to the relevant service.