Ofgem, GEMA and the Cyber Security and Resilience Bill
Ofgem does not regulate energy cyber security under the Cyber Security and Resilience Bill (CSRB) alone. In Great Britain, the Energy Secretary and GEMA act jointly for electricity and most gas, the Energy Secretary alone covers oil, and the Department of Finance covers Northern Ireland.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Who actually regulates energy
Schedule 1 of the NIS Regulations 2018 splits energy regulation by subsector and by nation.
| Subsector | Great Britain | Northern Ireland |
|---|---|---|
| Electricity | Energy Secretary and GEMA, jointly | Department of Finance |
| Gas | Energy Secretary and GEMA jointly, except specified services for the Energy Secretary alone | Department of Finance |
| Oil | Energy Secretary | Department of Finance |
GEMA is the Gas and Electricity Markets Authority, and Ofgem is the office that supports it. The Cyber Security and Resilience Bill (CSRB) does not change this basic split in the text we reviewed.
Main thresholds
| Service | Threshold in Great Britain |
|---|---|
| Electricity supply | More than 250,000 final customers, or a supplier also generating with 2 GW or more of capacity |
| Electricity transmission and distribution | Could disrupt supply to more than 250,000 customers |
| Interconnector | 1 GW or more capacity |
| Gas supply | More than 250,000 final customers |
| Gas storage and LNG | Can input over 20 million cubic metres a day |
| Load control (added by the Bill) | 300 MW or more of potential electrical control |
Northern Ireland thresholds are often lower or based on licences. See our devolved nations guide.
The new load control duty
Section 6 of the Bill adds load control to the electricity paragraph of Schedule 2. It counts relevant energy smart appliances you control by signal, namely EV chargers, EVs, electric heating, batteries and virtual power plants. An intermediary authorised to adjust the signals can also count as a load controller. Our reading is that the electricity authorities would oversee this, subject to the final Act and any further detail.
What is published, and what isn't
| Item | Status when checked |
|---|---|
| Ofgem NIS guidance for downstream gas and electricity | Published, updated 14 January 2026 |
| Security assurance guidance | Published April 2025, as referred to in Ofgem's guidance |
| Oil subsector guidance | Check with the Department for Energy Security and Net Zero |
| Load controller guidance | Not found |
| Charging scheme under the Bill | Not found |
Checked 2 November 2026. Regulators may publish more once the Bill passes, so check their own pages.
What changes for existing energy operators
Existing operators of essential services will need to prepare for the shorter reporting timetable: an initial notification within 24 hours and full notification within 72 hours, both from first awareness of a reportable incident. They should also expect closer scrutiny of supply chains through the critical supplier power, and possible cost recovery through a charging scheme.
What to do
- Confirm which authority covers each licensed activity.
- Re-check any growth that could cross a threshold.
- If you manage smart appliances, calculate potential electrical control using manufacturer ratings.
- Update incident plans to reflect the new timelines.
Sources
Frequently asked questions
Partly. GEMA, which Ofgem supports, acts jointly with the Secretary of State for Energy Security and Net Zero for electricity and most gas in Great Britain. It has no role for oil.
Ofgem publishes NIS guidance for downstream gas and electricity operators, updated in January 2026, along with security assurance guidance. Check that guidance for its current CAF expectations.
The Bill adds load control to the electricity paragraph of Schedule 2. On our reading that points to the electricity authorities, but check the final Act and implementing material.
The Department of Finance is the competent authority for the Northern Ireland energy subsectors listed in Schedule 1.