UK NIS

The UK NIS Regulations (Network and Information Security Regulations 2018) is a cybersecurity law that aims to improve the cybersecurity and resilience of essential services and digital infrastructure.

UK NIS requires operators of essential services (OES), such as energy, transport and healthcare, and relevant digital services providers (RDSPs) to implement robust security measures and report significant cyber incidents. The goal of UK NIS is to ensure the continuity of essential services and protect the UK’s digital economy from cyber threats.

To increase cyber resilience, NIS requires operators/ providers to implement robust technical, operational, and organizational cybersecurity measures to prevent or minimize disruptions from a wide range of hazards, from cyberattacks to physical incidents.

Compliance with UK NIS helps to protect your operations and boost resilience, safeguarding your stakeholders and reinforcing trust in your services. Non-compliance can be costly. While fines vary depending on the significance of the breach, maximum penalties for breaches determined to cause a significant risk or impact can attract fines of up to £17m.

UK NIS has extra-territorial scope, meaning that it is applicable to companies around the world when operating in the UK. Businesses without their HQ in the UK are required to appoint a representative as their addressee for the competent NIS authority and CSIRT.