On May 10, 2018, an important piece of legislation, the Network and Information Systems Directive (NISD), was adopted by EU Member States. This was in response to a drive to develop a common approach across Europe to address the potential socio-economic damage caused by attacks on the network and information systems of critical national infrastructure. Find out more about NISD here.
The key parties affected by NISD are Operators of Essential Services (OESs) and Digital Service Providers (DSPs). For the UK in general terms the following are considered to be OESs:
DSPs are operators of:
The first obligation for parties that are Operators of Essential Services (OESs) is to notify their relevant Competent Authority that they qualify as an OES before 10 August 2018. The next key deadline is that parties who qualify as Relevant Digital Service Providers must register with the Information Commissioner before 1 November 2018.
If you're unsure whether your business is considered a OES or DSP for the purposes of NISD or would like some advice on how to register, please get in touch with our international cyber security team who would be delighted to help.