The Electronic Communications (Security Measures) Regulations 2022

Preparing for remediation and recovery U.K.

9.—(1) A network provider or service provider must take such measures as are appropriate and proportionate to prepare for the occurrence of security compromises with a view to limiting the adverse effects of security compromises and enabling the provider to recover from security compromises.

(2) The duty in paragraph (1) includes in particular a duty—

(a) to create or acquire, for the purposes mentioned in that paragraph, and to retain within the United Kingdom—

(i) an online copy of information necessary to maintain the normal operation of the public electronic communications network or public electronic communications service, and

(ii) so far as is proportionate, an offline copy of that information,

(b) to replace copies held for the purpose of sub-paragraph (a) with reasonable frequency, appropriate to the assessed security risk of the network or service, and

(c) to have means and procedures in place—

(i) for promptly identifying the occurrence of any security compromise and assessing its severity, impact and likely cause,

(ii) for promptly identifying any mitigating actions required as a result of the occurrence of any security compromise,

(iii) where the occurrence of a security compromise gives rise to the risk of a connected security compromise, for preventing the transmission of signals that give rise to that risk,

(iv) for dealing with the occurrence of a security compromise within a reasonable period appropriate to the assessed security risk of the network provider or service provider, and without creating any risk of a further security compromise occurring,

(v) for ensuring that, if the network provider or service provider is unable to take steps for the purposes of preventing any adverse effects (on the network or service or otherwise) arising from the occurrence of a security compromise within the period of 14 days beginning with the day on which it occurs, the network provider or service provider is able to prepare a written plan as to how and when the provider will take such measures,

(vi) for dealing with any unauthorised access to, or control over, security critical functions by taking action as soon as reasonably possible, and without creating any risk of a further security compromise occurring, to ensure that only authorised users have access to the network or service, and

(vii) for replacing information damaged by security compromises with the information contained in the copy referred to in sub-paragraph (a).

(3) For the purposes of paragraph (2)(a)—

(a) an “online copy” is a copy that is held on the public electronic communications network or public electronic communications service in question, and

(b) an “offline copy” is a copy that is stored in such a way that it is not exposed to signals conveyed by means of the network or service in question.

Commencement Information

I1 Reg. 9 in force at 1.10.2022, see reg. 1(2)