NIS: UK cyber reforms to impact tech providers

The Department for Digital, Culture, Media and Sport (DCMS) consulted on a range of reforms to the UK’s NIS regulations earlier this year. It has now published its response to the feedback received, confirming, among other things, its intention to bring suppliers of services that major infrastructure operators depend on within the scope of the NIS regime. It will also increase the scope of NIS to include managed service providers.

Broader changes to the regulation of DSPs under the NIS regime remain under consideration. The government has consulted on establishing a two-tier system of regulation, where ‘critical’ DSPs would be subject to proactive supervision and remaining DSPs subject to a “reactive regime”. However, DCMS has now said that “determining the appropriate criteria for a tiered regime could be problematic” and that it is “considering whether a more flexible, risk-based assessment may be a better approach”.

It said: “The government proposes to implement this supervisory approach through non-legislative means as far as it is practicable. The information commissioner will be responsible for producing any guidance on how it will regulate digital services using a risk-based approach and will identify and assess those digital service providers which play the most critical role in supporting the resilience of the UK’s essential services.”

In its response paper, DCMS also confirmed that changes to incident reporting requirements under the UK NIS regime will be pursued.

Currently, incident reporting requirements under the NIS regime are limited in scope to certain incidents that affect the continuity of service either DSPs or operators of essential services provide.

DCMS previously said that the limitation in scope means “significant cybersecurity incidents” can arise without triggering the reporting obligations, so it consulted on changing the NIS Regulations to require the reporting of “any incident which has a significant impact on the availability, integrity, or confidentiality of networks and information systems, and that could cause, or threaten to cause, substantial disruption to the service”.

Those changes will be taken forward, DCMS has now confirmed. Guidance will be issued to specify more precise detail as to circumstances in which reporting will be required and in relation to what information the incident reports should contain, it said.

Other notable proposals to be taken forward include new powers to enable the government to update the NIS regime in future through secondary legislation rather than via an Act of parliament. The government also confirmed its intention to enable more of the cost of regulation under the NIS regime to be footed by the organisations subject to regulation.

DCMS said: “The government’s starting position is that the existing cost recovery system is not sufficient. It relies on central government funding and the reclaiming of costs at a later date. It is the government’s view that in general the cost burden of regulation should fall on the regulated, not the general taxpayer. Therefore we need a cost recovery scheme for NIS that reduces the burden on the taxpayer.”

Rebecca Townsend of Pinsent Masons said: “It is notable that changes are taking place to strengthen the NIS regime in the UK at the same time as the EU approves its own NIS2 changes. This is likely to represent one of the early examples in the data and cyber field of divergence between the UK and the EU.”