Part 2: The NIS Regulations.

Clause 3 would amend regulation 8 of the NIS Regulations (identification of operators of essential services):

• new regulation 8(1ZA): the deeming rule in regulation 8(1) would apply whether or not the person is established in the UK;
• regulation 8(1A) would be replaced so that regulation 8(1) does not apply to the provision of a public electronic communications network or service (as defined in section 151(1) of the Communications Act 2003);
• new regulation 8(3A): a competent authority could designate a person under regulation 8(3) whether or not it is established in the UK.

Clause 4(2) would add a "Data infrastructure" subsector to the table in Schedule 1 to the NIS Regulations, with the Office of Communications (Ofcom) as designated competent authority for the United Kingdom.

Clause 4(3) would insert a new paragraph 11 into Schedule 2 to the NIS Regulations setting the thresholds:

• a data centre service provided in the UK otherwise than on an enterprise basis: rated IT load of 1 megawatt or more;
• a data centre service provided in the UK on an enterprise basis: rated IT load of 10 megawatts or more.

A "data centre service" is the provision of a physical structure that contains an area for housing, connecting and operating IT equipment and provides supporting infrastructure (electricity, environmental control, security or resilience). A service is "enterprise" if the data centre is owned or managed by a person for its own undertaking and its sole purpose is to provide IT services for that undertaking. "Rated IT load" is the maximum electrical power available for IT equipment in the data centre. A "structure" can be a building, part of a building or a group of structures.

Clause 5 would insert regulation 8(7ZA) and (7ZB) into the NIS Regulations. Regulation 8(1) and (3) would apply to data centre services provided by or on behalf of the Crown, except:

• where the provider is the Security Service, the Secret Intelligence Service or GCHQ; or
• to the extent the service is provided on a commercial basis on behalf of His Majesty's Government for storing, processing or transmitting material classified "secret" or "top secret".

Clause 6 would amend paragraph 1 of Schedule 2 to the NIS Regulations (electricity subsector). The threshold for the essential service of load control would be a load controller that carries on activities for system-balancing purposes and whose potential electrical control over the relevant energy smart appliances it manages is 300 megawatts or more.

Potential electrical control is the maximum flow into, plus the maximum flow out of, all those appliances taken together that can be achieved in response to its load control signals, using manufacturers' stated electrical capacity.

Relevant energy smart appliances are electric vehicles, charge points, electrical heating appliances (listed types of heat pump, direct electric hot water cylinders, electric storage heaters, heat batteries), battery energy storage systems and virtual power plants.

Where an intermediary sends signals on behalf of a load controller, the appliances count as managed by the load controller only, unless the intermediary can adjust or process the signals and is authorised to do so, in which case both are treated as managing them and the intermediary is also treated as a load controller.

Clause 7 would amend regulation 1 of the NIS Regulations. A "relevant digital service" would be an online marketplace, an online search engine or a cloud computing service.

A "cloud computing service" would be a digital service that enables access to a scalable and elastic pool of shareable computing resources, with broad remote access, on demand and self-service, potentially distributed across locations, and not provided solely for the provider's own business; and which is not a managed service. Each term ("broad remote access", "scalable", "elastic", "shareable") is defined in new regulation 1(2A).

A relevant digital service provider (RDSP) would be a person that provides a relevant digital service in the UK (whether or not established here), is not designated as a critical supplier for that service, is not a micro or small enterprise (Commission Recommendation 2003/361/EC), and is either not subject to public authority oversight or derives more than half its income from commercial activities.

New regulation 1(3A): providing a public electronic communications network or service does not by itself make someone a provider of a relevant digital service.

Clause 8 would amend regulation 12(2) of the NIS Regulations so the RDSP's measures must prevent and minimise the impact of incidents affecting "the security of network and information systems referred to in paragraph (1)", replacing wording about ensuring continuity of services, and would omit regulation 12(2)(c).

New regulation 12(2A): an RDSP must have regard to relevant guidance issued by the Information Commission when carrying out its regulation 12(1) duties.

Clause 9 would add new regulation 1(3B) to (3D). A "managed service" is a service provided under a contract for ongoing management of a customer's IT systems (support and maintenance, monitoring, active administration or other activities), delivered by the provider connecting to or otherwise accessing network and information systems the customer relies on. It does not matter whether access is on the customer's premises or remote.

Providing a data centre service, or a public electronic communications network or service, is not by itself a managed service.

A relevant managed service provider (RMSP) would be a person that provides a managed service in the UK (whether or not established here), is not designated as a critical supplier for that service, is not a micro or small enterprise, and is either not subject to public authority oversight or derives more than half its income from commercial activities.

Clause 9(6) to (8) would make the Information Commission the competent authority for RMSPs (regulation 3(2) and (4)).

Clause 10 would insert a new Part 4A into the NIS Regulations. New regulation 14B(1): an RMSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of the network and information systems it relies on to provide managed services in the UK.

Regulation 14B(2): the measures must, having regard to the state of the art, ensure a level of security appropriate to the risk, and prevent and minimise the impact of incidents. Regulation 14B(3): an RMSP must have regard to relevant Information Commission guidance.

Clause 11 would insert regulation 1(3E). A person is subject to public authority oversight if it is subject to the management or control of one or more UK public authorities, or of a board more than half of whose members are appointed by UK public authorities. A UK public authority is a person exercising functions of a public nature in the UK.

Clause 12 would insert a new Part 4B into the NIS Regulations. Under regulation 14H, a designated competent authority could designate a person (P) that supplies goods or services directly to an OES it regulates, relies on network and information systems for that supply, and whose systems incident could disrupt essential services (or digital or managed services) with a likely significant impact on the economy or day-to-day functioning of society. The Information Commission could do the same for suppliers to RDSPs and RMSPs.

In deciding, the regulator must have regard to whether the customer could get the goods or services elsewhere (14H(3)) and the likely nature, scale and duration of disruption (14H(4)), and must consider whether the risk could be managed through the customer's own duties or by another regulator (14H(6)). A supplier can be designated whether or not it is established in the UK, and supply outside the UK counts.

Regulation 14I: a person cannot be designated for a service for which it is already an OES, RDSP or RMSP.

Regulation 14J: before designating, the regulator must consult relevant other regulators, give P written notice with reasons and a reasonable period for representations, and have regard to them; then give a notice confirming the decision and the date it takes effect.

Regulation 14K: a regulator may revoke a designation if the criteria are no longer met. A designated supplier that has reasonable grounds to believe it could no longer be designated must notify the regulator in writing, with evidence, as soon as practicable.

Regulation 14L: regulators must co-ordinate with each other on designation and supervision, unless the burden would be disproportionate to the benefit.

Clause 13 would insert regulation 8ZA. A data centre OES must, within 3 months of becoming deemed or designated as an OES, give its designated competent authority its name, proper address, directors (or partners) and up-to-date contact details, so the authority can maintain its list of OES. Changes must be notified in writing as soon as reasonably practicable and within 7 days.

Clause 13(3) extends regulation 8A (nomination of a UK representative by an OES based outside the UK) to the data infrastructure subsector.

Clause 14(2) would update regulation 14 (RDSP registration): details must include proper address, directors or partners and which relevant digital services are provided; changes must be notified within 7 days. The registration date is 3 months after clause 14 comes into force for existing RDSPs, or 3 months after first meeting the conditions otherwise. The Information Commission must send the register to GCHQ within 4 months of commencement and annually.

Clause 14(3) to (8) would update regulation 14A: an RDSP with its principal office outside the UK must nominate a UK representative and notify the Information Commission within 3 months, with changes notified within 7 days.

Clause 14(9) would insert regulation 14C (RMSP registration, on the same pattern) and regulation 14D (UK representatives for RMSPs based outside the UK).

Clause 15(2) would widen the definition of "incident" in regulation 1(2) to cover adverse effects on the "operation or" security of network and information systems.

Clause 15(3) would replace regulation 11 (OES other than data centres) and insert regulations 11A (data centres) and 11B (what regulators and the CSIRT may do with notifications). Clause 15(5) would insert regulations 12A and 12B for RDSPs, and clause 15(7) regulations 14E and 14F for RMSPs.

For each type of regulated person, an incident is notifiable if it has affected or is affecting the operation or security of the systems relied on to provide the service and its UK impact has been, is or is likely to be significant, having regard to factors including disruption, number of users, duration, geographical area, compromise of data, impact on users' systems, and impact on the economy or day-to-day functioning of society. Data centres have their own test in regulation 11A(3): a significant impact on the operation or security of the systems relied on to provide the data centre service, or a significant impact on the operation or security of the data centre service itself through an effect on those systems or on customers' systems.

The regulated person must give its regulator an initial notification (name, service and brief details) within 24 hours of first becoming aware, and a full notification (timing, nature, impact including cross-border impact, any linked incident at another regulated person, and other helpful information, so far as known) within 72 hours of that time. Both must be in writing in the form the regulator determines, and a copy must go to the CSIRT at the same time.

The regulator or CSIRT may tell the public about an incident, or direct the reporting organisation to do so, after consultation; may share information with other regulated persons to prevent similar incidents; and must report annually to the SPOC, by 1 July, on the number and nature of incidents notified.

Clause 16 would insert regulation 11C (data centre OES), 12C (RDSPs) and 14G (RMSPs). After giving a full notification, the provider must, as soon as reasonably practicable, take reasonable steps to establish which of its UK customers are likely to be adversely affected, then notify them.

In deciding who is likely to be affected, it must take into account actual or likely disruption to the service it provides to the customer, likely compromise of data relating to the customer, and any other impact on the customer's systems. The notice must describe the nature of the incident and explain why the customer is likely to be affected. The provider must then give such updates as it considers necessary.

Clause 17 would insert a new Part 5A (regulations 20A to 20C). A NIS enforcement authority could impose periodic charges under a published charging scheme for its relevant costs, including costs of functions under Parts 3 and 4 of the Bill and preparatory costs incurred before the clause comes into force. The scheme must specify the functions, chargeable periods, amount or method, when and how to pay, and a start date at least 14 days after publication.

A charge need not relate to functions exercised in relation to the payer. Before making or revising a scheme (other than minor revisions) the authority must consult such regulated persons as it considers appropriate. Where turnover is used, the authority's figure prevails in a disagreement. Charges are recoverable as a civil debt, and the authority must publish a statement of charges received, outstanding and costs.

Regulation 20C: an authority could also invoice a regulated person for costs of exercising a function in relation to it, but not for appeals, civil proceedings it brings, or functions covered by its charging scheme.

Clause 18(1) would require competent authorities to send the lists they keep under regulation 3(3)(c) and (d) to GCHQ to help it exercise its functions, within 4 months of clause 18(1) coming into force and then annually. Clause 18(2) would let the SPOC deal with relevant authorities in any country outside the UK, not only EU member states.

Clause 18(3) would replace regulation 6 and add 6A and 6B. NIS enforcement authorities could share information with each other, the Secretary of State, relevant law-enforcement authorities, the CSIRT and other UK public authorities for purposes including the Regulations, cyber security and resilience generally, national security, and the prevention, detection, investigation and prosecution of crime. Disclosures to overseas law-enforcement or regulators are limited to Australia, Canada, EEA states, New Zealand, Switzerland and the United States.

Onward disclosure is restricted; disclosures must be relevant and proportionate; and nothing authorises a disclosure prohibited by the Investigatory Powers Act 2016. The Information Commission could use NIS information for its other functions where necessary and proportionate (regulation 6B).

Clause 18(4) makes similar changes to regulation 7 (Northern Ireland).

Clause 19 would amend regulation 3. Competent authority guidance must in particular cover security measures under regulation 10, OES incident reporting under regulation 11, and the data centre duties in regulations 8ZA, 11A and 11C. Information Commission guidance must cover RDSP and RMSP security measures, registration, incident reporting and customer notification.

Regulators must have regard to any code of practice under clause 37 so their guidance is consistent with it, and must co-ordinate and consult each other on guidance about critical suppliers. New regulation 3A: regulators must have regard to relevant guidance published by the Secretary of State.

Clause 20 would replace regulation 15 and add regulation 15A. A competent authority or the Information Commission could, by written information notice, require a person it regulates, or any other person (other than the SPOC or CSIRT) likely to hold the information, to provide information or documents it reasonably requires for its functions. Listed purposes include establishing whether someone is in scope or should be designated, assessing security, investigating incidents, assessing measures, identifying failures, and setting penalties or charges.

A notice must say what is sought and why, the form, the deadline and the consequences of not complying. Notices to unregulated persons can be general and published. The power includes requiring a person to obtain, generate, collect or retain information, applies to persons outside the UK and to information stored outside the UK, and does not extend to legally privileged communications.

Clause 21 would amend regulation 18. A penalty must be appropriate and proportionate, having regard to the impact of the failure, steps taken to remedy or mitigate it, and the person's compliance history.

Standard maximum (new regulation 18(8)): for an undertaking, the greater of £10,000,000 and 2% of worldwide turnover; otherwise £10,000,000. It applies to failures listed in regulation 18(10), including OES notification and representative duties (regulations 8(2), 8ZA, 8A), copying notifications to the CSIRT (11(8), 11A(8), 12A(7), 14E(7)), RDSP and RMSP registration and representative duties (14, 14A, 14C, 14D), onward-disclosure restrictions and customer update duties (11C(5), 12C(4), 14G(4)).

Higher maximum (new regulation 18(9)): for an undertaking, the greater of £17,000,000 and 4% of worldwide turnover; otherwise £17,000,000. It applies to failures listed in regulation 18(11), including security duties (regulations 10, 12(1), 14B(1)), incident notification and its timing and form (11, 11A, 12A, 14E), directions to inform the public, customer notification (11C(2)(b), 12C(1)(b), 14G(1)(b)), inspection directions and requirements (regulation 16), information notices (17(2ZB)) and enforcement notice requirements (17(3A)).

New regulation 18(2A) and (2B) would let the Information Commission penalise RMSPs, and any regulator penalise a person who fails to comply with its information notice or enforcement notice.

Clause 22 gives effect to Schedule 1, which contains further amendments to the NIS Regulations on enforcement and appeals. See Schedule 1 below.

Clause 23 gives effect to Schedule 2, which contains minor and consequential amendments to the NIS Regulations and other enactments. See Schedule 2 below.