The Network and Information Systems Regulations 2018

Changes over time for: Section 15

Alternative versions:

Changes to legislation:

There are currently no known outstanding effects for the The Network and Information Systems Regulations 2018, Section 15.

Changes to Legislation

Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.

Information noticesU.K.

This section has no associated Explanatory Memorandum

15.—(1) In order to assess whether a person should be an OES, a designated competent authority may serve an information notice [F1in writing] upon any person requiring that person to provide it with [F2all such information as] it reasonably requires to establish whether—

(a)a threshold requirement described in F3... Schedule 2 is met; or

(b)the conditions mentioned in regulation 8(3) are met.

(2) A designated competent authority may serve an information notice [F4in writing] upon an OES requiring [F5the OES] to provide it with [F6all such information as] it reasonably requires [F7for one or more of the following purposes]—

[F8(a)to assess the security of the OES’s network and information systems;

(b)to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c)to identify any failure of the OES to comply with any duty set out in these Regulations;

(d)to assess the implementation of the OES’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.]

(3) The Information Commissioner may serve upon a RDSP an information notice [F9in writing] requiring that RDSP to provide the Information Commissioner with [F10all such information as] the Information Commissioner reasonably requires [F11for one or more of the following purposes]—

[F12(a)to assess the security of the RDSP’s network and information systems;

(b)to establish whether there have been any events that the Commissioner has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c)to identify any failure of the RDSP to comply with any duty set out in these Regulations;

(d)to assess the implementation of the RDSP’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.]

F13(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(5) An information notice must—

(a)describe the information that is required by the designated competent authority or the Information Commissioner;

(b)provide the reasons for requesting such information;

(c)specify the form and manner in which the requested information is to be provided; and

(d)specify the time period within which the information must be provided.

[F14(5A) A person upon whom an information notice has been served under this regulation must comply with the requirements of the notice.]

(6) In a case falling within paragraph (1) the information notice may—

(a)be served by publishing it in such manner as the designated competent authority considers appropriate in order to bring it to the attention of any persons who are described in the notice as the persons from whom the information is required; and

(b)take the form of a general request for a certain category of persons to provide the information that is specified in the notice.

(7) A competent authority or the Information Commissioner may withdraw an information notice by written notice to the person on whom it was served.

(8) An information notice under paragraph (1) may not be served upon the SPOC or CSIRT.

Textual Amendments

F1Words in reg. 15(1) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(a)(i) (with reg. 21)

F2Words in reg. 15(1) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(a)(ii) (with reg. 21)

F3Words in reg. 15(1)(a) omitted (20.6.2018) by virtue of The Network and Information Systems (Amendment) Regulations 2018 (S.I. 2018/629), regs. 1, 2(8)

F4Words in reg. 15(2) inserted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(aa) (with reg. 21)

F5Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(bb) (with reg. 21)

F6Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(cc) (with reg. 21)

F7Words in reg. 15(2) substituted (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(i)(dd) (with reg. 21)

F8Reg. 15(2)(a)-(d) substituted for reg. 15(2)(a)(b) (31.12.2020) by The Network and Information Systems (Amendment and Transitional Provision etc.) Regulations 2020 (S.I. 2020/1245), regs. 1(1), 11(b)(ii) (with reg. 21)