Schedule 2 thresholds by sector: who counts as an operator of essential services

How to use this table

If you provide a service below and meet its threshold, you are normally deemed an operator of essential services (OES) under regulation 8(1) of the NIS Regulations 2018. The Cyber Security and Resilience Bill (CSRB) amends these Regulations rather than replacing them.

These figures are simplified from Schedule 2 on legislation.gov.uk, read on 2 November 2026. The legal wording includes definitions and exclusions, so check the original paragraph before deciding. Legislation.gov.uk also lists a pending change to one air transport definition (S.I. 2026/230), which does not affect a number.

Energy

Service	Threshold	Para
Electricity supply, Great Britain	More than 250,000 final customers	1(2)(a)
Electricity supply with affiliated generation, Great Britain	Generators with total input capacity of at least 2 GW	1(2)(a)
Electricity supply, Northern Ireland	More than 8,000 consumers	1(2)(b)
Electricity generation, Northern Ireland	At least 350 MW	1(2)(b)
Electricity transmission, Great Britain	Could disrupt delivery to more than 250,000 final customers	1(4)(a)
Offshore transmission, Great Britain	Connected generators of at least 2 GW	1(4)(a)
Electricity interconnectors, Great Britain	At least 1 GW	1(4)(a)
Electricity distribution, Great Britain	Could disrupt delivery to more than 250,000 final customers	1(5)(a)
Oil, upstream pipelines, processing and offshore installations, UK	More than 3,000,000 tonnes of oil equivalent a year	2(2), 2(4), 2(6)
Oil transmission, Great Britain	More than 500,000 tonnes a year	2(3)(a)
Oil transmission, Northern Ireland	More than 50,000 tonnes a year	2(3)(b)
Oil facilities, Great Britain	More than 500,000 tonnes of storage, production or supply	2(5)(a)
Oil storage, Northern Ireland	More than 50,000 tonnes	2(5)(b)
Gas supply, Great Britain	More than 250,000 final customers	3(2)(a)
Gas supply, Northern Ireland	More than 2,000 customers	3(2)(b)
Gas transmission and distribution, Great Britain	Could disrupt delivery to more than 250,000 final customers	3(3), 3(4)
Gas interconnectors, storage and LNG, Great Britain	More than 20 million cubic metres a day into a transmission system	3(3), 3(5), 3(6)
Gas processing and production, UK	More than 3,000,000 tonnes of oil equivalent a year	3(7), 3(8)

Transport

Service	Threshold	Para
Airports	More than 10 million annual terminal passengers	4(2)
Air traffic services at airports	Airports above 10 million annual terminal passengers	4(3)(b)
Air carriers	More than 30% of passengers at such an airport, or more than 10 million in total across UK airports	4(4)
Shipping	Over 5 million tonnes of annual freight at UK ports, or over 30% at certain ports	5(2)(a)
Passenger shipping	Over 30% of passengers at a port with more than 10 million	5(2)(b)
Harbours, port facilities and vessel traffic services	Ports with more than 10 million passengers, or ports above specified shares of UK freight traffic	5(3) to 5(5)
Metros, trams and light rail	More than 50 million annual passenger journeys	6(4)
Road authorities and intelligent transport systems	Roads carrying more than 50 billion vehicle miles	7

The freight shares in paragraph 5 are more than 15% of roll-on roll-off traffic, 15% of lift-on lift-off traffic, 10% of liquid bulk traffic, or 20% of biomass fuel traffic. Some rail and en-route air traffic entries have no number.

Healthcare and drinking water

Service	Threshold	Para
Healthcare	No numeric threshold; depends on the provider types described	8
Drinking water	Supply to 200,000 or more people	9

Digital infrastructure

Service	Threshold	Para
Top-level domain name registries	14 billion or more queries from UK devices in any 168-hour period	10(2)
DNS resolver services	500,000 or more different UK-used IP addresses in any 168-hour period	10(3)
Authoritative DNS hosting	100,000 or more domains registered to people with a UK address	10(3A)
Internet exchange points	30% or more market share among UK operators	10(4)

What the Bill would add

Service	Threshold in HL Bill 32	New para
Data centre service	Rated IT load of 1 MW or more	11(2)
Enterprise data centre service	Rated IT load of 10 MW or more	11(3)
Load control	Potential electrical control of 300 MW or more over relevant energy smart appliances	1(5A)

"Rated IT load" means the maximum electrical power available for IT equipment in the data centre. A structure can include a group of structures, so check how your site is measured.

What is not in Schedule 2

• Banks and financial market infrastructure. Neither is a subsector. See does DORA apply to UK firms? for financial rules.
• Cloud, online marketplaces and search engines. These are RDSPs with their own test.
• Managed service providers. These are RMSPs with their own test.
• Public telecoms networks and services. These are carved out of OES status under the Bill.

Sources

• NIS Regulations 2018, Schedule 2
• The Bill as brought from the Commons (HL Bill 32), sections 3, 4 and 6