The Network and Information Systems Regulations 2018

Information notices U.K.

15.—(1) In order to assess whether a person should be an OES, a designated competent authority may serve an information notice upon any person requiring that person to provide it with information that it reasonably requires to establish whether—

(a) a threshold requirement described in paragraphs 1 to 9 of Schedule 2 is met; or

(b) the conditions mentioned in regulation 8(3) are met.

(2) A designated competent authority may serve an information notice upon an OES requiring that person to provide it with information that it reasonably requires to assess—

(a) the security of the OES's network and information systems; and

(b) the implementation of the operator's security policies, including any about inspections conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(3) The Information Commissioner may serve upon a RDSP an information notice requiring that RDSP to provide the Information Commissioner with information that the Information Commissioner reasonably requires to assess—

(a) the security of the RDSP's network and information systems; and

(b) the implementation of the RDSP's security policies, including any about inspections conducted under regulation 16 and any underlying evidence in relation to such an inspection.

(4) Before a person is to be designated as an OES under regulation 8(3), a designated competent authority may serve an information notice upon that person requiring the person to provide it with information in order to assess whether to designate it.

(5) An information notice must—

(a) describe the information that is required by the designated competent authority or the Information Commissioner;

(b) provide the reasons for requesting such information;

(c) specify the form and manner in which the requested information is to be provided; and

(d) specify the time period within which the information must be provided.

(6) In a case falling within paragraph (1) the information notice may—

(a) be served by publishing it in such manner as the designated competent authority considers appropriate in order to bring it to the attention of any persons who are described in the notice as the persons from whom the information is required; and

(b) take the form of a general request for a certain category of persons to provide the information that is specified in the notice.

(7) A competent authority or the Information Commissioner may withdraw an information notice by written notice to the person on whom it was served.

(8) An information notice under paragraph (1) may not be served upon the SPOC or CSIRT.