Which regulator covers you under the Cyber Security and Resilience Bill?
It depends on your activity and sometimes your location. Under the Cyber Security and Resilience Bill (CSRB), the Information Commission covers cloud, marketplaces, search engines and managed services, and Ofcom covers data centres and digital infrastructure. Sector authorities cover energy, transport, health and water.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
The short version
Under the Cyber Security and Resilience Bill (CSRB), your regulator depends on what you do and sometimes where you do it. The Information Commission regulates digital and managed service providers. Ofcom regulates digital infrastructure and data centres. Sector authorities cover energy, transport, health and drinking water.
The legal term is "designated competent authority". Note that several entries are government departments rather than the regulator you may expect.
The regulator table
| Activity | England | Wales | Scotland | Northern Ireland |
|---|---|---|---|---|
| Electricity, including large load controllers | Secretary of State for Energy Security and Net Zero, jointly with GEMA | Same | Same | Department of Finance |
| Oil | Secretary of State for Energy Security and Net Zero | Same | Same | Department of Finance |
| Gas | Secretary of State for Energy Security and Net Zero, jointly with GEMA, or alone for certain services | Same | Same | Department of Finance |
| Air transport | Secretary of State for Transport, jointly with the Civil Aviation Authority | Same | Same | Same |
| Water transport | Secretary of State for Transport | Same | Same | Same |
| Rail | Secretary of State for Transport | Same | Same | Department of Finance |
| Road | Secretary of State for Transport | Same | Scottish Ministers | Department of Finance |
| Health care settings | Secretary of State for Health | Welsh Ministers | Scottish Ministers | Department of Finance |
| Drinking water | Secretary of State for Environment, Food and Rural Affairs | Welsh Ministers | Drinking Water Quality Regulator for Scotland | Department of Finance |
| Digital infrastructure | Ofcom | Same | Same | Same |
| Data centres | Ofcom | Same | Same | Same |
| Cloud, online marketplaces, search engines | Information Commission | Same | Same | Same |
| Managed service providers | Information Commission | Same | Same | Same |
GEMA is the Gas and Electricity Markets Authority, which acts through Ofgem. Schedule 1 of the 2018 Regulations has more detail, including which gas services fall to the Secretary of State alone.
Common mistakes
Assuming Ofcom regulates all telecoms under this regime. Public electronic communications networks and services are carved out of some categories in the Bill. Telecoms security has its own regime, so check the telecommunications page.
Assuming NHS England is the regulator. The 2018 Regulations name the Secretary of State for Health for health care in England. Delegated arrangements may affect who you deal with day to day.
Assuming Ofgem acts alone. For most electricity and gas services, the authority is GEMA acting jointly with the Secretary of State.
Assuming financial regulators are in this table. They are not. Banking isn't a subsector in Schedule 2. Financial firms answer to the FCA and PRA for financial regulation, but could fall under the Bill through another activity, such as providing a cloud or managed service.
Looking for the ICO by its old name. The Bill refers to the Information Commission, which replaces the Information Commissioner.
If you do more than one thing
You can have more than one regulator. A group might be regulated by:
- Ofcom for a data centre
- the Information Commission for a managed service
- a sector authority as an operator of essential services
Incident reports go to the regulator for the affected service. Plan for one incident needing more than one notification.
Critical suppliers can also be designated by more than one regulator. Regulation 14L requires those regulators to co-ordinate.
Who else you may need to tell
The regulator is rarely the only recipient:
| Who | When |
|---|---|
| The CSIRT | A copy of each incident notification under the Bill. The National Cyber Security Centre carries out this function in the UK. |
| The Information Commission (data protection) | Separately, for notifiable personal data breaches under UK GDPR. |
| Affected UK customers | Data centres, RDSPs and RMSPs must notify them after the full notification. |
| Sector regulators | Other reporting rules may apply, for example from the FCA and PRA. |
See breach vs incident vs near miss for how these fit together.
What your regulator can do
The powers are broadly the same across regulators:
- request information and documents
- inspect, or appoint an inspector
- issue enforcement notices
- impose financial penalties
- charge for regulatory costs under a charging scheme
Each regulator can publish its own guidance, reporting forms and charging scheme. Those are not all available yet, so expect some practical differences.
How to prepare
- List each regulated activity and where it takes place.
- Identify the regulator for each using the table.
- Assign a named contact for each regulator.
- Keep regulator contact routes in your incident plan.
- Monitor each regulator's guidance as it appears.
If you aren't sure which category you are in, start with OES vs RDSP vs RMSP.
Sources
Frequently asked questions
The Information Commission regulates relevant managed service providers, as well as relevant digital service providers.
Ofcom is the designated competent authority for the new data infrastructure subsector, across the UK.
It is the body named in Schedule 1 of the NIS Regulations 2018 to regulate a particular subsector. It can request information, inspect, enforce and impose penalties.
Yes. Regulators attach to activities, so a group running several regulated activities may deal with several regulators.
The FCA is not named in the Schedule 1 table of the 2018 Regulations, and banking is not a Schedule 2 subsector. Financial firms still answer to their financial regulators under separate rules.