The NIS Regulations came into force on 10 May 2018 and aim to improve the security of organisations that provide essential services to the UK. The Regulations apply to operators of essential services in the transport, energy, water, health and digital infrastructure sectors. They also apply to some digital services, including online marketplaces, online search engines and cloud computing services.

In August 2020, the Government published a call for views on its proposed amendments to the Regulations following recommendations made in the 2020 Post-Implementation Review of the NIS Regulations, which was published in May 2020. The Review showed that whilst it was still too early to judge the long-term impact of the NIS Regulations, organisations in scope were beginning to take steps to improve the security of their network and information systems and that the NIS Regulations were having a positive effect. The Review recommended policy interventions by the Government to enhance the overall efficiency of the Regulations. This ultimately formed the basis of the proposed amendments to the NIS Regulations.

The proposed amendments to the NIS Regulations covered the following eight areas:

• information-sharing powers;
• the provision of information notices;
• powers of inspection;
• strengthening the enforcement regime;
• amendments to the penalty regime;
• the introduction of a statutory appeal route via the First-Tier Tribunal;
• the timelines for Post-Implementation Reviews; and
• sectoral amendments to Schedule 2 and non-UK operators of essential services offering services in the UK.

The Government received 68 replies to its consultation and has now published its response. It says that the replies were “generally positive”. However, a number of respondents highlighted areas of concern and the Government says that it has addressed these through changes to the proposed Statutory Instrument where appropriate. To read the Government’s response, click here.