The Network and Information Systems Regulations 2018 (SI 2018/506) are still the UK's binding cyber security law for essential services and key digital services, and they will stay in force until the Cyber Security and Resilience Bill is enacted and commenced. Much current commentary focuses on the Bill, but enforcement today, including fines of up to £17 million, runs under the 2018 Regulations. They apply to operators of essential services (OES) in energy, transport, health, drinking water and digital infrastructure, and to relevant digital service providers (RDSPs): online marketplaces, online search engines and cloud computing services. This guide covers scope, the security and notification duties, how competent authorities use the NCSC Cyber Assessment Framework, the penalty regime, and how identity and machine credentials fit. It is written for security, risk and compliance leads at regulated organisations and their suppliers. What the Bill will change is covered in the UK Cyber Security and Resilience Bill Guide.
Status line (checked 27 October 2026): the NIS Regulations 2018 are in force as revised on legislation.gov.uk, which is up to date with changes in force on or before 25 October 2026 (an amendment by SI 2026/230 to Schedule 2 is listed but not yet applied to the text). The Cyber Security and Resilience (Network and Information Systems) Bill was carried over into the 2026-27 session, is in the House of Lords and has not received Royal Assent; Lords Report stage was scheduled for 26 October 2026. Until the Bill is enacted and its provisions commenced, the duties below apply as written.
Key takeaways
- Two regulated groups. OES meeting the sector thresholds in Schedule 2 or designated by their competent authority, and RDSPs providing online marketplaces, search engines or cloud computing services in the UK.
- Risk-based security duty. Regulation 10 requires appropriate and proportionate technical and organisational measures, having regard to the state of the art and to competent authority guidance, which in most sectors means the NCSC Cyber Assessment Framework.
- 72 hours to notify. OES must notify incidents with a significant impact on continuity of the essential service, and RDSPs incidents with a substantial impact on the digital service, without undue delay and within 72 hours of becoming aware.
- Fines in three bands. Up to £1 million for non-material contraventions, £8.5 million for material ones and £17 million where a material contravention created a significant risk to or impact on the service.
- Sector regulators enforce. Each sector has its own competent authority, and the Information Commission regulates RDSPs, so expectations and evidence formats differ by sector.
Scope: who and what is covered
Operators of essential services
An organisation is an OES if it provides an essential service in a subsector listed in Schedule 2 and meets the threshold set there, or if its competent authority designates it under regulation 8 because an incident would have significant disruptive effects. OES based outside the UK must nominate a person in the UK to act on their behalf (regulation 8A).
| Sector and subsector | Competent authority (Schedule 1) |
|---|---|
| Energy: electricity | England, Wales and Scotland: Secretary of State for Energy Security and Net Zero jointly with the Gas and Electricity Markets Authority (Ofgem); Northern Ireland: Department of Finance |
| Energy: oil | Secretary of State for Energy Security and Net Zero; Northern Ireland: Department of Finance |
| Energy: gas | Secretary of State for Energy Security and Net Zero, jointly with Ofgem for most services; Northern Ireland: Department of Finance |
| Transport: air | Secretary of State for Transport jointly with the Civil Aviation Authority |
| Transport: rail, water and road | Secretary of State for Transport (Scottish Ministers for road in Scotland; Department of Finance in Northern Ireland for rail and road) |
| Health care settings | England: Secretary of State for Health; Wales: Welsh Ministers; Scotland: Scottish Ministers; Northern Ireland: Department of Finance |
| Drinking water supply and distribution | England: Secretary of State for Environment, Food and Rural Affairs; Wales: Welsh Ministers; Scotland: Drinking Water Quality Regulator; Northern Ireland: Department of Finance |
| Digital infrastructure | Ofcom |
Relevant digital service providers
- Services: online marketplaces, online search engines and cloud computing services provided in the UK (regulation 12).
- Regulator: the Information Commission, which also receives RDSP incident notifications and keeps a register of RDSPs (regulation 14). RDSPs established outside the UK must appoint a UK representative (regulation 14A).
- Size: small and micro businesses are excluded from the RDSP regime, so most RDSPs are medium or large cloud and platform providers.
- Guidance status: the ICO's NIS guide was last updated in January 2023 and is marked as under review following the Data (Use and Access) Act.
Not in scope today: managed service providers, data centres as such, and suppliers to OES are not regulated directly by the 2018 Regulations. Bringing MSPs and data centres in, and allowing designation of critical suppliers, is a central purpose of the Bill.
Key obligations
| Regulation | Duty | Applies to | Detail |
|---|---|---|---|
| 10(1) and (3) | Appropriate and proportionate measures to manage risks to network and information systems, having regard to the state of the art | OES | Assessed by competent authorities, mostly against the CAF |
| 10(2) | Measures to prevent and minimise the impact of incidents to ensure continuity | OES | Covers response and recovery |
| 10(4) | Have regard to guidance issued by the competent authority | OES | Sector guidance and CAF profiles |
| 11 | Notify incidents with a significant impact on continuity of the essential service | OES | Without undue delay, no later than 72 hours after awareness |
| 12(1) and (2) | Appropriate and proportionate measures covering security of systems and facilities, incident handling, business continuity, monitoring, auditing and testing, and compliance with international standards | RDSP | Elements taken from Article 2 of Implementing Regulation (EU) 2018/151, retained in UK law |
| 12(3) to (6) | Notify incidents with a substantial impact on the digital service to the Information Commission | RDSP | Without undue delay, no later than 72 hours |
| 12(9) | Notify the competent authority where an RDSP incident significantly affects an essential service | OES using an RDSP | Cloud outages can trigger OES reports |
| 15 and 16 | Respond to information notices; allow inspections | OES and RDSP | Inspections may be carried out by a person appointed by the authority |
Incident notification detail
| Element | OES (reg 11) | RDSP (reg 12) |
|---|---|---|
| Trigger | Significant impact on continuity of the essential service | Substantial impact on the provision of the digital service |
| Factors | Number of users affected, duration, geographical area | Users affected (especially those relying on the service for their own services), duration, geographical area, extent of disruption, impact on economic and societal activities |
| Recipient | Competent authority, in the form and manner it sets | Information Commission |
| Deadline | Without undue delay, within 72 hours of awareness | Without undue delay, within 72 hours of first awareness |
| Content | Operator and services, time and duration, nature and impact, cross-border impact, other helpful information | Same core content |
Note what triggers a report: impact on service continuity, not compromise as such. A credential theft that has not yet disrupted the service may not be reportable under the 2018 Regulations, although it may be under UK GDPR, and the Bill proposes to widen reporting to incidents capable of significant impact.
The Cyber Assessment Framework
The NCSC Cyber Assessment Framework (CAF), currently version 4.0, is the assessment tool most competent authorities use for OES. It has four objectives and 14 principles: A Managing security risk (4 principles), B Protecting against cyber attack (6), C Detecting cyber security events (2) and D Minimising the impact of incidents (2). Regulators set Basic or Enhanced CAF profiles as targets according to the threat an operator faces. Principle B2, Identity and access control, is where service accounts, privileged users and device identity are assessed. See the NCSC Cyber Assessment Framework (CAF) Guide.
Timeline and current status
| Date | Event |
|---|---|
| 2018 | SI 2018/506 made, implementing the EU NIS Directive (EU) 2016/1148 in UK law |
| After EU exit | Amended so that the regime continues as UK law, with references to EU implementing rules retained |
| 10 January 2023 | ICO NIS guidance last updated |
| 6 August 2025 | NCSC CAF version 4.0 page last reviewed |
| 14 May 2026 | Cyber Security and Resilience Bill reintroduced at Report Stage after carry-over into the 2026-27 session |
| 2026 | SI 2026/230 amends Schedule 2 (listed on legislation.gov.uk, not yet applied to the revised text) |
| 26 October 2026 | Bill's Lords Report stage scheduled |
| To be confirmed | Royal Assent, then commencement of the amended regime, much of it through secondary legislation |
The Bill amends the 2018 Regulations rather than replacing them, so the OES and RDSP concepts, competent authorities and CAF-based assessment will carry forward. Work done now to meet the 2018 duties is not wasted.
Enforcement and penalties
- Information notices (reg 15): authorities can require information to assess compliance or designation.
- Inspection (reg 16): authorities can conduct an inspection, or appoint a person to do so, to verify compliance.
- Enforcement notices (reg 17): set out the failure and the steps required to fix it within a period.
- Penalties (reg 18): following a notice of intention and representations, the authority may serve a penalty notice. Maximums: £1 million for a contravention that is not material; £8.5 million for a material contravention; £17 million for a material contravention that has or could have created a significant risk to, or significant impact on, the service. A penalty can be imposed without a prior enforcement notice, and must be appropriate and proportionate.
- Challenges (regs 19 to 19B): independent review of designation and penalty decisions, and appeal to the First-tier Tribunal.
- Civil enforcement (reg A20 and 20): enforcement notices can be enforced by civil proceedings, and unpaid penalties recovered.
"Material contravention" is defined by reference to failures described in regulation 17, including failing to comply with an enforcement notice. In practice, regulators often appear to use improvement plans and enforcement notices before fines, so the CAF self-assessment and improvement plan are the documents most likely to be scrutinised.
What it means for AI agents and non-human identities
The Regulations say nothing specific about identities, but CAF principle B2 makes identity and access control a core assessed area, and the "state of the art" test in regulations 10 and 12 moves with current practice. The points below are good practice for meeting those tests.
| Assessment area | NHI question an assessor may ask | Evidence |
|---|---|---|
| CAF A3 Asset management | Are service accounts, API keys and certificates that support essential functions inventoried? | NHI inventory linked to essential service assets |
| CAF B2 Identity and access control | Are machine identities uniquely identified, authenticated and limited to need? | Per-workload identities, no shared accounts, access reviews |
| CAF B2 privileged access | Are automation accounts with administrative rights managed as privileged? | Vaulted credentials, just-in-time elevation, session logging |
| CAF A4 Supply chain | Which suppliers hold credentials into your environment, and how are they controlled? | Supplier access register, contract terms, revocation tests |
| CAF C1 Security monitoring | Would misuse of a service account or token be detected? | Alerts on anomalous machine authentication and API use |
| CAF D1 Response and recovery planning | Can credentials be rotated at scale during an incident without losing the service? | Rotation runbooks tested in exercises |
AI agents and automation that act on operational systems should be treated like any other privileged machine identity: a named owner, scoped permissions, logged actions and a tested kill switch. See the Service Account Security Guide, the Privileged Access Management Guide and the OT and ICS Identity and Access Guide.
Compliance steps
- Confirm status. Check the Schedule 2 thresholds for your subsector, any designation notice, and whether you are an RDSP. Record which competent authority regulates each service.
- Agree the target profile. Confirm with your competent authority whether it expects the Basic or Enhanced CAF profile, or a sector-specific variant.
- Scope the systems. Identify the network and information systems that the essential or digital service relies on, including OT, cloud and supplier-operated components and the identities that reach them.
- Run the CAF self-assessment. Assess each contributing outcome honestly, with evidence, and agree an improvement plan with dates and owners.
- Prioritise identity gaps. Address shared and unmanaged service accounts, standing vendor access and missing MFA for privileged users early: they appear in most real intrusions and are visible to assessors.
- Build the 72 hour process. Define "significant" or "substantial" impact thresholds for each service using the regulation factors, assign who decides, and pre-fill notification templates. Include the regulation 12(9) case where a cloud provider's outage affects your essential service. See the Incident Response Plan Template.
- Align other reporting. Map how a NIS notification interacts with UK GDPR breach reporting and sector rules. See the UK GDPR and Data Protection Act 2018 Guide.
- Exercise. Test an incident in which a compromised supplier credential disrupts the service, timing the decision and notification steps. See the Tabletop Exercise Guide.
- Prepare for the Bill. Note proposed 24 hour initial notifications and supplier designation, and start contract and process changes that will be needed anyway.
Framework mapping
| NIS duty | NCSC CAF | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|---|
| Risk management (reg 10(1)) | A1, A2 | GV.RM-01, ID.RA-04 | RA-3, PM-9 | Clauses 6.1.2 and 8.2 |
| Asset and dependency knowledge | A3 | ID.AM-01 | CM-8 | A.5.9 |
| Supply chain | A4 | GV.SC-07 | SR-3, SA-9 | A.5.19 to A.5.22 |
| Identity and access, including machine identities | B2 | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-5 | A.5.16, A.5.18, A.8.2 |
| Monitoring | C1 | DE.CM-01 | SI-4, AU-6 | A.8.16 |
| Incident notification (regs 11 and 12) | D1 | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
| Continuity (reg 10(2)) | D1, D2 | RC.RP-01 | CP-2, IR-8 | A.5.29, A.5.30 |
Common failure patterns
- Waiting for the Bill: deferring CAF improvement work because "the law is changing" leaves you exposed to current enforcement and behind on the new regime.
- Box-ticking the CAF: optimistic self-assessments without evidence are quickly exposed at inspection and undermine trust with the regulator.
- Systems scope too narrow: leaving out OT, cloud services and supplier-run components, the very places where disruption starts.
- Reporting on compromise, not impact, or neither: without agreed impact thresholds teams either over-report or miss the 72 hour deadline arguing about significance.
- Unmanaged machine and vendor access: shared engineering accounts and long-lived supplier credentials fail CAF B2 and are a common route into infrastructure.
Practitioner checklist
- Confirm OES or RDSP status and the competent authority for each service.
- Agree the target CAF profile with the regulator.
- Scope systems including OT, cloud, suppliers and identities.
- Complete an evidenced CAF self-assessment and improvement plan.
- Inventory service accounts, API keys and vendor access for essential systems.
- Define significant and substantial impact thresholds per service.
- Rehearse the 72 hour notification, including cloud provider incidents.
- Map NIS, UK GDPR and sector reporting for one incident record.
- Track the Cyber Security and Resilience Bill and plan for 24 hour reporting.
Standards and references
- legislation.gov.uk: The Network and Information Systems Regulations 2018 (SI 2018/506)
- legislation.gov.uk: Regulation 11, the duty to notify incidents
- legislation.gov.uk: Regulation 18, penalties
- legislation.gov.uk: Schedule 1, designated competent authorities
- NCSC: Cyber Assessment Framework
- ICO: The guide to NIS
- UK Parliament: Cyber Security and Resilience (Network and Information Systems) Bill
- Hill Dickinson: Update on the Cyber Security and Resilience Bill
Related NHI Mgmt Group resources: UK Cyber Security and Resilience Bill Guide · Critical Infrastructure Regulation Map · NIS2 Directive Guide · Critical Infrastructure Identity Security Guide. This guide summarises the UK Network and Information Systems Regulations 2018 as at 27 October 2026 and is not legal advice.