Amendments to regulation 15 (information notices)

11.  In regulation 15—

(a) in paragraph (1), in the opening text—

(i) after “notice” insert “in writing”;

(ii) for “information that” substitute “all such information as”;

(b) in paragraph (2)—

(i) in the opening text—

(aa) after “notice” insert “in writing”;

(bb) for “that person” substitute “the OES”;

(cc) for “information that” substitute “all such information as”;

(dd) for “to assess” substitute “for one or more of the following purposes”;

(ii) for sub-paragraphs (a) and (b) substitute—

“(a) to assess the security of the OES’s network and information systems;

(b) to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c) to identify any failure of the OES to comply with any duty set out in these Regulations;

(d) to assess the implementation of the OES’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.”;

(c) in paragraph (3)—

(i) in the opening text—

(aa) after “notice” insert “in writing”;

(bb) for “information that” substitute “all such information as”;

(cc) for “to assess” substitute “for one or more of the following purposes”;

(ii) for sub-paragraphs (a) and (b) substitute—

“(a) to assess the security of the RDSP’s network and information systems;

(b) to establish whether there have been any events that the Commissioner has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c) to identify any failure of the RDSP to comply with any duty set out in these Regulations;

(d) to assess the implementation of the RDSP’s security policies, including from the results of any inspection conducted under regulation 16 and any underlying evidence in relation to such an inspection.”;

(d) omit paragraph (4);

(e) after paragraph (5) insert—

“(5A) A person upon whom an information notice has been served under this regulation must comply with the requirements of the notice.”.