Drinking water regulators and the Cyber Security and Resilience Bill
Drinking water suppliers serving 200,000 or more people are regulated under the NIS Regulations 2018, which the Cyber Security and Resilience Bill (CSRB) updates. The regulator differs by nation: Defra in England and Welsh Ministers in Wales, working through the DWI, DWQR in Scotland and the Department of Finance in Northern Ireland.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Report Stage update: VinciWorks reports that Government amendments on 26 October 2026 narrowed the incident definition to incidents that have actually adversely affected systems, and removed mandatory near-miss reporting for data centre operators. We could not check this against the amended Bill, so the wording below reflects HL Bill 32 and may be out of date. See what Parliament changed.
Who regulates drinking water
From Schedule 1 of the NIS Regulations 2018. The Cyber Security and Resilience Bill (CSRB) doesn't alter this table in the text we reviewed.
| Nation | Designated competent authority | Operational note |
|---|---|---|
| England | Secretary of State for Environment, Food and Rural Affairs | Drinking Water Inspectorate acts operationally |
| Wales | Welsh Ministers | Drinking Water Inspectorate acts operationally |
| Scotland | Drinking Water Quality Regulator for Scotland | Publishes its own enforcement policy |
| Northern Ireland | Department of Finance | Publishes NIS oversight information |
Who is in scope
The threshold is the supply of drinking water to 200,000 or more people in the UK. Wastewater on its own isn't in this subsector, though a combined business should check its drinking water activity.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| DWI implementation guidance | Published on behalf of Defra and the Welsh Ministers; a 2025 version is on the DWI site |
| DWI NIS enforcement policy | Published |
| DWQR enforcement policy | Published, December 2023 |
| Update reflecting the Bill's reporting duties | Not found |
| Notification form under the Bill | Not found |
| Charging scheme under the Bill | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages.
The DWI's guidance covers both operational technology and IT systems, and refers to use of the Cyber Assessment Framework. Read the current version for exact expectations, as we saw this only in extract.
What the Bill changes for water suppliers
Faster reporting. Reportable incidents will need an initial notification within 24 hours and a full notification within 72 hours, both from first awareness, with copies to the CSIRT.
A broader meaning of incident. The definition extends to events capable of having an adverse effect on operation or security. For water suppliers, the reporting test still asks whether the incident has affected or is affecting those systems and whether its impact is or is likely to be significant. See our significant incident guide.
Supply chain. Regulators can designate direct suppliers, for example of hard-to-replace treatment control systems, as critical suppliers if the statutory tests are met.
Costs. A regulator may charge regulated organisations under a scheme. Bear in mind that this would depend on the scheme that each authority makes.
The operational technology question
Water incidents often involve systems that safety and operations teams own rather than IT. Decide in advance who tells the incident lead that a plant event may be a cyber incident, because the reporting clock runs from awareness. Keep a route for that call outside normal IT systems, in case they are the ones affected.
What to do
- Confirm population served, including any recent growth or mergers.
- Check your regulator's latest guidance.
- Update incident procedures for the 24-hour and 72-hour timelines.
- Review suppliers with remote access to operational systems.
Sources
Frequently asked questions
Supplying drinking water to 200,000 or more people in the UK.
Defra and the Welsh Ministers are the competent authorities for England and Wales. The Drinking Water Inspectorate carries out the operational regulatory work on their behalf.
The DWI’s guidance says the relevant definition can apply to both operational technology and IT systems. Read its current version for how this applies to you.
The NIS subsector is drinking water supply and distribution. The government’s summary lists wastewater among sectors outside the regime that can use free guidance. Check if your business also supplies drinking water.