Drinking Water Suppliers and the Cyber Security and Resilience Bill

Yes. Water companies supplying drinking water to 200,000 or more people are already Operators of Essential Services under the NIS Regulations 2018, and the Cyber Security and Resilience Bill keeps that threshold. It tightens their duties: 24-hour and 72-hour incident reports, a wider incident definition, critical supplier designation, regulator charging and higher penalties.

The drinking water supply and distribution subsector is set out in paragraph 9 of Schedule 2 to the NIS Regulations 2018. The essential service is the supply of potable water, and the threshold is the supply of water to 200,000 or more people. The Cyber Security and Resilience Bill does not change this threshold. It changes only three thresholds, all for data centres and electricity load control.

The test turns on the number of people supplied, not on the type of company. Schedule 2 does not list water undertakers or licensees by name. In practice it catches the large regional water and water-and-sewerage undertakers in England and Wales, Scottish Water and NI Water. A water supply licensee, or a smaller water-only company, is in scope only if it meets the 200,000-person test itself.

Schedule 1 to the NIS Regulations names a different competent authority for each UK nation. The Bill keeps these arrangements.

The DWI states that it has been transferred the operational competent authority duties to regulate operators on behalf of the Secretary of State for England and the Welsh Government for Wales. The National Cyber Security Centre is the single point of contact and CSIRT for incidents and acts as technical authority.

No. This is one of the most common points of confusion in the sector. Ofwat is the economic regulator for water and sewerage companies in England and Wales. It sets price controls and licenses water supply and sewerage licensees, but it is not a competent authority under the NIS Regulations 2018.

Ofwat does not appear in Schedule 1 to the NIS Regulations, and the Cyber Security and Resilience Bill does not mention it. Cyber security oversight of water operators under NIS sits with Defra and the Welsh Ministers, exercised through the DWI, and with the DWQR and the Department of Finance in Scotland and Northern Ireland.

The two can still meet in practice. Water companies have put cyber and physical security investment cases into their business plans for price reviews, which Ofwat determines, but compliance with the NIS duties is assessed by the NIS competent authority, not Ofwat.

The threshold, the competent authorities and the core security duty in regulation 10 all stay in place. The changes are about speed, breadth and consequences.

Clause 15 substitutes a new regulation 11. If an operator is aware that an incident has occurred or is occurring, it must give its competent authority an initial notification with its name, the essential service affected and brief details, followed by a full notification covering timing, nature, impact and any link to an incident at another regulated person.

• Initial notification: within 24 hours of first becoming aware (regulation 11(6)(a))
• Full notification: within 72 hours of that same moment, not 72 hours after the initial report (regulation 11(6)(b))
• Notifications must be in writing, in the form the competent authority sets (regulation 11(7))
• A copy must be sent to the CSIRT (the NCSC) at the same time (regulation 11(8))

Clause 15(2) widens the definition of "incident" in regulation 1(2) in two ways. It now covers events having, or capable of having, an adverse effect, and effects on the operation as well as the security of network and information systems.

An incident must be notified where it has affected or is affecting the operation or security of the systems relied on to supply water, and its impact in the UK has been, is or is likely to be significant. Regulation 11(4) lists the factors: extent of disruption, number of users affected, duration, geographical area, and whether the confidentiality, authenticity, integrity or availability of user data is compromised.

For water, this means a ransomware attack that forces a treatment works into manual operation as a precaution may be reportable even if no customer loses supply.

The network and information systems a water company relies on to supply potable water are largely operational technology: SCADA, telemetry, programmable logic controllers at pumping stations and treatment works, and the remote access that links them. The NIS security duty covers all of them, not just corporate IT.

Adding "operation" to the incident definition matters most in this environment. An intrusion that degrades control or visibility of a process, without any data being stolen, falls squarely within scope. Precautionary shutdowns and loss of telemetry both need to be assessed against the significance factors quickly enough to meet the 24-hour clock.

The DWI already asks water companies for an annual Cyber Assessment Framework return and has audited companies against it. Expect that CAF evidence, especially for OT asset inventory, segmentation and remote access, to underpin how the DWI judges compliance with the amended regulations.

Possibly. Clause 12 inserts a new Part 4B into the NIS Regulations. Under regulation 14H(1), a competent authority may designate a person as a critical supplier if that person supplies goods or services directly to an operator it regulates, relies on network and information systems for that supply, and an incident at the supplier could cause disruption with a significant impact on the economy or the day-to-day functioning of society.

• Likely candidates include SCADA and telemetry vendors, OT integrators, billing and customer platforms, and outsourced security operations
• The authority must consider whether the operator could get the supply elsewhere (regulation 14H(3))
• It must also consider whether the risk is already managed through the operator's own duties or another regulator (regulation 14H(6))
• Designation requires consultation first (regulation 14J), and suppliers outside the UK can be designated (regulation 14H(7))
• Managed IT and security providers may separately be regulated as managed service providers under clause 9

Even without designation, water companies will push the new reporting and security expectations down to suppliers through contract.

Water companies in England and Wales already have a second security regime. The Security and Emergency Measures Direction (SEMD) is issued by the Secretary of State and Welsh Ministers under section 208 of the Water Industry Act 1991, which lets them direct undertakers and licensees in the interests of national security or to mitigate the effects of a civil emergency. The current version is the 2022 Direction, amended in 2024.

The DWI regulates SEMD on behalf of the Secretary of State and Welsh Ministers, including reviewing companies' annual self-assessments and national infrastructure audits, and taking enforcement action.

The Cyber Security and Resilience Bill does not amend the Water Industry Act 1991 or SEMD. The two regimes run in parallel, overseen largely by the same inspectorate, so one evidence base serving both is the efficient approach. How the DWI will align SEMD and NIS enforcement after the Bill is not yet settled.

Very likely. Clause 17 inserts a new Part 5A into the NIS Regulations. Under new regulation 20A, a NIS enforcement authority may charge a person it regulates for its relevant costs, but only under a charging scheme it has made and published, and only for a chargeable period in that scheme.

Relevant costs are the authority's costs of exercising its functions under the NIS Regulations or Parts 3 and 4 of the Bill once enacted. The government says this is intended to let regulators recover the full costs of their NIS duties with more transparency. No water sector charging scheme has been published, and the amounts are not yet known.

Clause 21 replaces the penalty caps in regulation 18 with two bands. Both are the greater of a fixed sum and a share of turnover, including turnover outside the UK, so the fixed sum is a floor for large undertakings, not a ceiling.

Lords Committee Stage on HL Bill 32 sat on 1, 3, 7 and 9 September 2026. Report Stage is next, with no date announced, and Royal Assent is expected between late 2026 and spring 2027. Most duties then commence through secondary legislation, towards 2028. Until then the NIS Regulations 2018 apply unchanged.

• Rework incident playbooks for a 24-hour initial notification, with clear rules on when the awareness clock starts
• Map OT and SCADA assets that support potable water supply, and test detection for operational impact, not only data loss
• Identify suppliers likely to be designated critical suppliers and review contract clauses on reporting and security
• Align CAF and SEMD evidence so one control set supports both regimes
• Budget for regulator charges and brief the board on the new penalty bands

• Cyber Security and Resilience (Network and Information Systems) Bill, UK Parliament
• HL Bill 32 full text (PDF viewer)
• GOV.UK: Summary of the Bill factsheet
• The Network and Information Systems Regulations 2018 (legislation.gov.uk)
• Drinking Water Inspectorate: NIS Regulations 2018
• Drinking Water Inspectorate: Security and Emergencies (SEMD)

• Utilities and energy under the Cyber Security and Resilience Bill
• Critical suppliers and regulation 14H designation
• Managed service providers
• Large load controllers
• Cyber Security and Resilience Bill: CAF readiness guide
• New powers to block risky suppliers
• What the Bill changes
• Cyber Security and Resilience Bill FAQ