NIS2 in the United Kingdom

Current status

The UK implemented the NIS Directive (2016/1148) through the NIS Regulations 2018, which came into force on May 10, 2018 as part of the UK’s £2.8b National Cyber Strategy.

An EU NIS2 follow-on for the UK is currently under development with the CS&R Bill. The UK government is keen to maintain alignment with developments in EU legislation, in particular EU NIS2, noting that previous EU regulations have been superseded (...) and require urgent updating in the UK to ensure that our infrastructure and economy are not comparably more vulnerable.

The Information Commissioner's Office (ICO) is the UK regulator (competent authority) for data protection and oversees relevant digital service providers (RDSPs) under NIS1. For Operators of Essential Services (OES), the UK assigned sector-specific competent authorities.

In conjunction with the NIS Regulations, the UK implemented an act for digital service providers (DSP Regulation), which sets out security requirements and incident reporting thresholds for some entities.

Responsibilities

The UK has defined the competent authorities and Computer Security Incident Response Teams (CSIRTs) under EU NIS1 as follows:

• Government Communications Headquarters (GCHQ) serves as the Single Point of Contact (SPOC) for cybersecurity issues in the UK.
• National Cyber Security Centre (NCSC), which is part of GCHQ, acts as the UK’s primary Computer Security Incident Response Team (CSIRT), responsible for coordinating and responding to significant cybersecurity incidents.
• NCSC is the UK’s technical authority on cyber threats, providing a unified national response to cybersecurity challenges and supporting public and private sector organizations.
• While GCHQ (via NCSC) is the SPOC and plays a central role, regulatory oversight is not centralized in the UK. In some cases additional regulators have been given additional oversight responsibilities:

Entities

NIS Regulations apply to Operators of Essential Services (OES) and Relevant Digital Service Providers (RDSPs), as defined under Part 3 (Art. 8-11) and Part 4 (Art. 12-14) of NIS Regulations. OES are organizations that provide services critical to the economy and society, RDSPs offer specific digital services.

Operators of Essential Services (OES)

An OES provides an essential service where:

• The service depends on network and information systems.
• An incident would have significant disruptive effects on that service.
• Head office located in the United Kingdom, or
• A nominated representative based in the UK.
• Employs ≥ 50 FTE staff or has an annual turnover/balance sheet total >EUR 10m.

Obligations of an OES covered by UK NIS:

• Nominate a UK-based representative in writing with authority to act on their behalf.
• Notify the designated competent authority with relevant information (name, address, contact)

Relevant Digital Service Providers (RDSP)

An RDSP provides one or more of the following services:

• Online marketplace
• Online search engine
• Cloud computing service
• Head office is outside the UK but offers digital services within the UK
• Not a micro or small enterprise (<50 FTE staff and annual turnover/balance sheet total < EUR 10m)

Obligations of an RDSP covered by UK NIS are:

• Notify the designated competent authority with relevant information (name, address, contact)

Sectors in UK NIS

NIS Regulations in the UK define in Schedule 2 (comparable to EU NIS Annex II) sector-specfic threshold requirements and differentiates between Great Britain and Northern Ireland. Thresholds for sectors and subsections under NIS are:

Security Measures in UK NIS

Cybersecurity measures as regulated by UK NIS1 are split into obligations for OES (Operators of Essential Services) and RDSP (relevant digital service providers ).

OES Cybersecurity

• Follow the NCSC Cyber Assessment Framework (CAF) with 14 principles and 39 sector-specific outcomes
• CAF principles include governance, risk management, and recovery planning
• Proactively audited by sector-specific competent authorities (e.g., Ofgem, NHS Digital)
• Report "significant impact" incidents (assessed by user numbers, duration, geographic spread) to sector-specific regulators within 72 hours

RDSPs Cybersecurity

• Required to be compliant with Information Commissioner’s Office (ICO) guidelines and EU Regulation 2018/151 (on DSPs)
• Adopt ISO/IEC 27001 (information security) and ISO/IEC 22301 (business continuity)
• Monitored by ICO, with investigations triggered by incidents without routine audits (likely to change under forthcoming legislation)
• Report substantial impact incidents (service disruptions) to ICO within 72 hours

Sanctions

UK NIS Regulations introduced a structured system of fines for non-compliance:

1. Up to £1m for any contravention that could not result in a NIS incident.
2. Up to £3.4m for a material contravention that has caused or could cause an incident leading to a significant reduction in service.
3. Up to £8.5m for a material contravention that has caused or could cause an incident resulting in a major disruption of service.
4. Up to £17m for a material contravention that has caused or could cause an immediate threat to life or a significant negative impact on the UK economy.
5. Continuous learning and adaptation to enhance compliance.

The UK Competent Authority determines the appropriate level of fines based on the severity of the incident and the level of compliance by OES, with a maximum fine of £17m.

Forthcoming legislation and NIS2

In January 2022, the UK government launched a public consultation process on proposals for legislation to improve the UK's cyber resilience. When the process closed in November 2022, the responses provided the government's response and next steps for policy development. Within two weeks of the UK Labour Party's election in the 2024 general election, it announced plans to update the NIS Regulations from 2018 and improve cross-sector cybersecurity.

The current British Government has announced that it intends to present the Cyber Security and Resilience Bill to Parliament in 2025. The Bill, which was officially proposed as part of the King’s Speech (at the State Opening of Parliament) in July 2024, aims to strengthen the UK’s cross-sector cybersecurity legislation to better protect the British economy and infrastructure.

On April 1, 2025 the British Secretary of State (SoS) for Science, Innovation and Technology fist presented more concrete plans regarding the CS&R Bill. The Bill will expand and update the current legislation implemented in 2018 and will largly be in line with legislative adjustments made under NIS2.

As of April 2025, no Bill has been published but the UK Government has announced legislation will:

• Expand the scope of covered entities (e.g. to MSPs and Data Centers) to ensure broader protection of digital services and supply chains.
• Introduce stricter reporting obligations, requiring affected entities to report incidents more comprehensively, including cases of ransomware attacks.
• Give a greater level of authority and powers to regulators (e.g. enable regulators to designate ‘Critical Suppliers, new powers for Sec. of State).
• Strengthening supply chain security by setting stronger duties on OESs and RDSPs.
• Introduce a two-stage reporting structure

National Differences (CS&R and NIS2)

The UK’s implementation of the Cyber Security and Resilience (CS&R) framework will likely feature the following national distinctions:

• The UK government is considering including data centres within the scope by designating data infrastructure as a relevant sector and data as an essential service—subject to threshold criteria. This would apply to facilities with a capacity above 1MW, except for enterprise data centres, where the threshold would be set at over 10MW.
• Introduction of new powers for the Secretary of State to issue a Statement of Strategic Priorities.
• New executive powers enabling the government to direct an entity or authorise a regulator to take action in the interest of national security, subject to safeguards. This mirrors mechanisms in the Telecommunications (Security) Act 2021.

Scope

UK CS&R will cover Managed service providers (MSPs) for IT services and so-called Designated Critical Suppliers under its regulation for cybersecurity, analogous to EU NIS2.

CS&R aims to provide flexibility to refine the duties and threshold criteria through secondary legislation, subject to appropriate consultation, to ensure that the requirements can be updated in line with changes in technology, emerging threats and lessons learned from implementation.

Managed Service Providers (MSP)

As in EU NIS2, the CS&R Bill will bring Managed service providers (MSPs) into scope, defined in the policy statement from 1 April 2025 as:

• Service provided to another organisation (i.e., not in-house)
• Relies on the use of network and information systems (NIS) to deliver the service
• Relates to ongoing management support, active administration and/or monitoring of IT systems, IT infrastructure, applications, and/or IT networks, including for the purpose of activities relating to cyber security
• Involves a network connection and/or access to the customer’s network and information systems.

Designated Critical Suppliers (DCS)

Under the CS&R Bill, regulators will be able to individually designate a supplier as a DCS if the supplier's goods or services are so critical that disruption could have a significant impact on the essential or digital service it supports. DCSs are therefore expected to represent a very small number and percentage of suppliers providing goods or services to the OES and RDSP.

The designation will bring such suppliers directly within the scope of core security requirements and incident reporting obligations, ensuring consistent standards across supply chain.

The threshold criteria for the designation of DSCs are to be finalized with forthcoming Drafts:

• The supplier provides goods or services (including digital services) to an OES (regulated by that regulator) or to an RDSP (in the case of the ICO).
• The regulator judges that a failure or disruption in that supplier’s goods or services – or an incident affecting the supplier’s network and information systems – could have a significant disruptive effect on the provision of the essential or digital service.
• The supplier’s goods or services depend on NIS, making them relevant to the scope of the regulatory framework. This is intended to ensure that suppliers only fall within scope if their goods or services involve or rely upon technology (e.g. IT infrastructure or OT) that could be targeted or disrupted.
• The supplier is not subject to similar cyber resilience regulations elsewhere (e.g., under Part 2 of the Communications Act 2003, as amended by the Telecommunications (Security) Act 2021) or under the 2018 Regulations.

Small and medium enterprises (SME)

In addition, the CS&R Bill is expected to extend regulation to certain SME RDSPs. While under the NIS Regulations, small and micro RDSPs are exempt from the 2018 Regulations as described above, the forthcoming Bill may change this. UK regulators might designate smaller RDSPs as critical suppliers if they meet the DSC designation criteria to ensure regulation of high-risk providers regardless of size.

Reporting

According to the UK government, significant cyber and network disruptions go unreported under the NIS Regulations. This limitation hinders the ability to identify and assess vulnerabilities in critical systems. The government views adjustments to the reporting of significant cyber incidents as an essential tool for regulators and the NCSC to better understand the evolving threat landscape.

The Cyber Incident Reporting Bill seeks to update and enhance the current incident reporting requirements for regulated entities by introducing the following key changes:

• Expanding the incident reporting criteria.
• Updating the timeframes for incident reporting.
• Streamlining the reporting process.
• Enhancing transparency requirements for digital services and data centres.

The Bill will be complemented by ongoing work on ransomware, which is under consultation. Both the Department for Digital, Culture, Media and Sport (DSIT) and the Home Office (British Department of the Interior) will continue to collaborate to ensure alignment with future frameworks, avoiding unnecessary duplication. These measures are intended to strengthen the position of regulators in addressing emerging risks, ultimately contributing to improved cyber resilience.

Major changes

Under current NIS regulations, an incident is reportable only if it disrupts the continuity of an essential or digital service. However, the UK government believes this scope is too narrow and excludes many important incidents. The Bill aims to expand the criteria to include incidents that may significantly impact the provision of essential or digital services, such as:

• Compromising the confidentiality, availability, or integrity of a system.
• Spyware attacks targeting Managed Service Providers (MSPs) that act as vectors to compromise other organizations.
• Other incidents severely affecting the integrity of critical systems.

The Bill will introduce a two-stage reporting structure that requires regulated entities to:

• Notify their regulator and inform the NCSC of a significant incident no later than 24 hours after becoming aware of it.
• Submit a full incident report within 72 hours.

This initial notification will serve as an early warning, ensuring that the regulator is informed sooner than under current practices. This mirrors the requirements outlined in EU NIS2, ensuring consistency across jurisdictions.

To simplify the reporting process, regulated entities will be required to notify both their regulator and the NCSC at the same time. This will ensure that both parties receive the same information concurrently, fostering a more cohesive understanding of the threat landscape.

Entities providing digital services and data centres will be required to alert affected customers when a significant incident occurs. This requirement aims to promote greater transparency, openness, and accountability among service providers within the scope of the Bill.

Security measures

As of April 2025, no concrete announcements have been made regarding changes to security measures. The UK government has mentioned its intention to place the principles and objectives of the NCSC Cyber Assessment Framework on a stronger footing.

This section will be updated in due course.

Sources

1. The Guide to NIS, Information Commissioner's Office, February 2025
2. Operators of Essential Services and the NIS Regulations, Website of IT Governance Ltd, March 2025
3. The Guide to NIS, Information Commissioner’s Office, February 2025
4. NIS Regulations. How does it differ from the EU version? Arcanum Cyber Security, March 2025
5. Operators of Essential Services and the NIS Regulations, Website of IT Governance Ltd, March 2025
6. The Network and Information Systems Regulations 2018, Website of the UK government, March 2025
7. Policy paper. Cyber security and resilience policy statement, Website of the UK government's Department for Science, Innovation & Technology, April 2025