Summary
The Network and Information Systems Regulations 2018 implement EU Directive 2016/1148 into UK law, establishing a cybersecurity framework for Operators of Essential Services (OES) in energy, transport, health, drinking water, and digital infrastructure sectors, and Relevant Digital Service Providers (RDSP) including online marketplaces, search engines, and cloud computing services. The Regulations designate competent authorities, a Single Point of Contact (SPOC at GCHQ), and a CSIRT, requiring covered entities to take security measures, manage risks, and report incidents to regulators within 72 hours.
Reason
This is a retained EU law implementing the NIS Directive that was never subject to democratic scrutiny in Parliament — inherited wholesale from EU membership. The compliance burden falls disproportionately on essential service operators and digital service providers, with prescriptive 72-hour reporting requirements and organizational measures that goose-step bureaucratic box-checking rather than genuinely improving security outcomes. The state-of-the-art security requirements and detailed incident classification schemes create ongoing costs without proportionate benefits, as evidenced by the fact that major cyber incidents still occur despite compliance. The regulation's one-size-fits-all approach ignores that market incentives already drive significant private sector cybersecurity investment; where market failures exist in critical infrastructure, targeted interventions would be more effective than broad regulatory frameworks. Post-Brexit regulatory independence demands these inherited EU laws be replaced with genuinely British approaches tailored to UK circumstances rather than maintained as regulatory relics of EU membership.