Compliance tools · Cybersecurity and data protection

UK NIS Regulations 2018 compliance tool

SI 2018/506 · United Kingdom · Binding instrument

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your UK NIS Regulations 2018 documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

UK NIS Regulations 2018 is SI 2018/506, a binding instrument in the United Kingdom. UK network and information systems security for operators of essential services and relevant digital service providers.

The free assessment screens for UK NIS Regulations 2018 when a business operates in a critical or essential sector. The Regulations also bind relevant digital service providers, cloud, online marketplace and search services, other than micro and small enterprises.

Sectors this instrument reaches: energy; transport; health; drinking water supply and distribution; online marketplaces; online search engines; cloud computing services.

Screen your business against all 116 agent toolkits, free →

• Your exact position under UK NIS Regulations 2018: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that UK NIS Regulations 2018 applies to your business, free →

Does UK NIS Regulations 2018 apply to my business?

The Regulations apply to you if you are an operator of essential services in the energy, transport, health, or drinking water supply and distribution sectors, or a relevant digital service provider offering online marketplaces, online search engines, or cloud computing services in the United Kingdom. Integrated care boards are deemed operators of essential services for the healthcare settings subsector under regulation 8(2A).

Who does UK NIS Regulations 2018 apply to?

They apply to operators of essential services designated under regulation 8(1), 8(2A) or 8(3), and to relevant digital service providers, meaning a person providing a digital service in the United Kingdom with a head office in the United Kingdom or a nominated UK representative. Non-UK operators of essential services and non-UK digital service providers must nominate a UK representative under regulations 8A and 14A.

Does UK NIS Regulations 2018 apply to a small business?

Micro and small enterprises as defined in Commission Recommendation 2003/361/EC are excluded from the definition of relevant digital service provider and from the UK representative duty for non-UK digital service providers under regulation 14A(1)(b). No size threshold or exemption applies to operators of essential services.

When does UK NIS Regulations 2018 apply from, and what are the deadlines?

The Regulations came into force on 10 May 2018 under regulation 1(1). Key deadlines include notifying the competent authority by 10 August 2018 for deemed operators of essential services, incident notification within 72 hours under regulations 11(3) and 12(6), RDSP registration by 1 November 2018 under regulation 14(2), and payment of enforcement fees within 30 days under regulation 21(2).

What does UK NIS Regulations 2018 require me to do?

You must take appropriate and proportionate technical and organisational measures to manage security risk under regulation 10(1) as an operator of essential services, or identify and manage security risk under regulation 12(1) as a relevant digital service provider. You must notify incidents to your competent authority or the Information Commissioner within 72 hours under regulations 11(3) and 12(6), and register or nominate a UK representative where regulations 14 and 14A apply.

What records or documents does UK NIS Regulations 2018 require me to keep or produce?

You must notify the competent authority in writing of an incident with a significant impact on service continuity under regulation 11(1), and submit registration details to the Information Commissioner under regulation 14(2). You must notify changes to registered details within three months under regulation 14(3), and notify changes to a nominated UK representative within seven days under regulation 8A(4).

What happens if I do not comply with UK NIS Regulations 2018?

A NIS enforcement authority may serve an enforcement notice requiring steps to rectify a failure under regulation 17, and civil penalties run up to £1,000,000, £8,500,000, or £17,000,000 depending on the tier under regulations 17 to 20. Penalties are recoverable as a civil debt under regulation 20, and the authority may seek an injunction or specific performance under regulation A20.

How do I start complying with UK NIS Regulations 2018?

The first practical step is to notify the designated competent authority before the notification date if you are deemed designated as an operator of essential services under regulation 8(1), as required by regulation 8(2). A relevant digital service provider must instead submit registration details to the Information Commissioner before the registration date under regulation 14(2).

Which ComplianceSME account includes the UK NIS Regulations 2018 toolkit?

The UK NIS Regulations 2018 agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive