Changes to NIS Regulations - ThinkHouse

Helen Davenport: Hello everyone, my name is Helen Davenport and I am a Partner in the Commercial Litigation Team at Gowling WLG and in particular, I lead our Cyber Security and Contentious Data Privacy work. We are an international law firm with 18 offices across the world, working across a wide variety of sectors and services including technology, financial services, government and real estate.

I will be talking to you today about the NIS Regulations as this is an area in which we may see some new laws coming up the track so an interesting one to watch.

Now before we get into what the new laws might look like, let us just have a little reminder of that the NIS Regulations are. So of course, these came into force on 10 May 2018. They implemented the EU Cyber Security Directive 2016 prior to obviously us Brexiting. The aim of the Regulations is to maintain the security of critical national infrastructure and in particular the network and information systems that are critical for the provision of the essential UK services and digital services.

Now if you are an organisation and are caught by the NIS Regulations you will be familiar with this but if not just bear with me for a moment just while I run through the scope and the effect. So the organisations in scope of the NIS Regulations providing are businesses providing certain essential services and they are referred to as operators of essential services or OES' and relevant digital service providers, RDSP's and they are required to register with the relevant competent authorities, they have to meet a baseline level of Cyber Security requirements and they have to report any incident which has a significant impact on the continuity of the essential services.

Now just to drill down into that a little bit more, how do you know if you are an OES caught within the regulations. Well for the operators of essential services that covers a number of identified sectors and those are energy, transport, health, drinking water supply and distribution and also digital infrastructure and then those are in turn broken down in two sub-sectors and then for each of those sub-sectors there are designated competent authorities and threshold requirements for a business or organisation to see if it is caught and I have just drilled down into one particular example to try not clutter the slide too much but in the area of drinking water supply and distribution you can see that there are a number of designated competent authorities for each of the areas of the UK and the threshold requirement there is for the essential service of supply of possible water in the United Kingdom it is where the supply of water is to 200,000 or more people. So that is OES' and how you would know if you were caught.

Moving on to relevant Digital Service Providers. Now those to be caught that's where a provider provides a digital service in the UK which might be an online market place, an online search engine or a cloud computing service and there are definitions for those in the regulations and organisations that are caught where they have a head office for that provider in the UK or that provider has nominated a representative established in the UK and then there is a carve-out for micro or small enterprises and the competent authority in the case of digital service providers is the ICO.

Now I said I was going to be talking about some potential new laws and in particular talking about the UK Government's current thinking in this area.

So during the last 12 months or so, the UK Government has launched two calls for reviews, one on amending the NIS Regulations and another one on supply chain security. More recently DCMS launched two consultations in January 2022 and those ended in March and April of this year respectively and they are principally geared at having a new legal framework to improve cyber resilience and why is the UK Government thinking about that? Principally for three reasons.

1. There is an increasing awareness of cyber security and that was identified in the most recent DCMS Cyber Breach Survey that came out at the end of March. So an increasing awareness, it is on the agenda, but unfortunately action lags behind that awareness in terms of doing something about cyber security, so that is the first reason.
2. The second reason is the National Cyber Security Centre is seeing an increased number of incidents and is helping organisations manage an increasing number of incidents, both in the UK and we are also seeing obviously incidents worldwide as well and increasingly high profile incidents.
3. Thirdly, there is a recognition of supply chain risk and there is actually an increased reliance on centralised IT services and the concern there is that a small number of organisations in the supply chain are actually carrying a high risk in comparison, that has the potential to impact on a huge number of organisations that they service. So this is all in line with the Government Cyber Security Strategy for 2022.

So drilling down a bit more into those consultations, so there were two consultations covering three pillars. In Pillar 1 of Consultation 1, so the focus there was about amending the NIS regulations and two key changes, the first one to bring managed service providers into the scope of the NIS regulations and the second one is that digital service providers who have the most privileged access or provide critical services to organisations, they would have a risk based enforcement regulatory regime, so that actually those that are in the category that I have just described would have proactive supervision from the ICO and reactive supervision from the others.

In Pillar 2 of the second consultations, the focus here is around future proofing the NIS regulations. Three key changes here. The first one to actually give the government the power to make quicker changes to the regulations going forward, so that they can respond to threats more quickly. The second one to change the reporting thresholds, so at the moment it is just incidents that will have an impact on service, but the proposal there is to increase the incidents that would need to be reported and thirdly the introduction or an expansion of the cost recovery regimes, so that actually the organisations within the scope of the NIS regulations would bear the cost of the competent authorities regulating them.

In the third Pillar, Consultation 2, that is focussed on boosting the cyber security profession, so increased standards, so if organisations obviously need to draw on the expertise of cyber security professionals, there is a regime there that makes it easier to see who has the requisite expertise.

In the next part of the session, I am just going to focus on the managed service providers chain, so that is within the first consultation, given the potential significance this has on supply chain cyber resilience.

So who might be caught by being a managed service provider? Well the consultation currently proposes that an organisation would qualify as a managed service provider if the services it provides are supplied to external clients by its supplier. They involve regular and ongoing service management of data, IT infrastructure, IT networks and/or IT systems. They are categorised as B to B rather than B to C services and the provision of the services relies on network and information systems. The consultation also includes in one of its annexes, a list of the potential organisations that the UK government would envisage that this would cover.

Now two points of note, the first that it is broad and the second is that it is a non-exhaustive list, so here on the slide I have got the headline categories, but if you are looking at the slides, you can also see that there is more detail within them, but in headline terms, the categories are managed network support services, security services, outsourcing, analytics and artificial intelligence, workplace services, business continuity and disaster recovery services, consulting and lastly software engineering service, such as where the managed service provider develops the source code, maintains the source code or stores the source code in its own repository. So broad and the government is also consulting at the moment whether actually there would be an additional threshold to be a managed service provider, so it is also under consideration, whether to be regulated, a provider would also have to have privileged access or connectivity to a customer's data IT infrastructure, IT networks and/or IT systems, or they would have to perform essential or sensitive functions, such as the processing and/or storage of confidential or business critical data.

There is an understanding in considering whether to introduce this additional threshold in that narrowing, so having this additional threshold may be helpful, but could that leave risks to supply chains where actually there is an organisation who are providing services or can have an impact on that supply chain if they would fall outside of this threshold, but on the other hand having too many organisations, so if we do not have a further threshold, that might mean that you have got organisations in scope who it will not be appropriate for them to be in scope for the organisation or business having to bear additional costs and also for the regulator, will incur additional costs if it has to regulate too many organisations, so there needs to be a purpose for them doing so.

So that is one to watch in terms of following the consultation where actually this definition and/or any additional thresholds might land, but for those businesses who are managed services providers in the future, well then the proposed requirements that they will have will mean that they have to register with the ICO as a competent authority. They will have to make sure they have in place adequate and proportionate security measures to ensure that their own network and information systems are secure. They will also be required to report relevant incidents to the competent authority, so if not already in place, then organisations may prepare or need to prepare their business to undertake rigorous independent audits and to ensure compliance with the security expectations of the ICO. In terms of what those expectations might be, at the moment, well there is no guidance at the moment and that is expected to be determined through guidance in the future, so it is something else to watch out for.

There is also as I mentioned earlier, those digital service providers who have the most privileged access providing the most critical services, will then have proactive supervision from the ICO as well. Those managed service providers will also have a cost impact in terms of getting to grips with the regulations, the initial administration costs, there may be the additional increases and cyber security of spending to make sure the security measures are met and if an incident does arise, then there will be cost consequences in terms of having to deal and report that incident and further as I also mentioned earlier, there is an expansion or proposed expansion of the cost recovery scheme, so the managed service providers would also have to pay their part towards the regulators' costs.

So that is what is proposed at the moment also under the consultation. Very much one to watch when we get the results of the consultation. If you are a customer of IT services, then this will be of interest to you because your providers and your supply chain may be the subject of increased regulation, which may have benefits for you and if you are on the other side of the fence, if you are a supplier, then of course you will be concerned to understand whether you are inside or outside this definition of managed service providers and whether you will have the additional regulatory requirements that I have just talked through.

Thank you very much.