In short
The NIS Regulations 2018 (SI 2018/506) are UK law requiring operators of essential services and relevant digital service providers to manage cyber risk and report significant incidents. Operators must notify their competent authority within 72 hours of becoming aware of a NIS incident. NIS2 is EU law; the UK's equivalent update is the Cyber Security and Resilience Bill.
Get a quote for managed security for NIS compliance
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What the NIS Regulations are
The Network and Information Systems Regulations 2018 came into force on 10 May 2018. They implemented the original EU NIS Directive in UK law and have been amended since the UK left the EU, so the UK version now stands on its own.
The Regulations do two main things. They require organisations in scope to take appropriate and proportionate technical and organisational measures to manage risks to the network and information systems their services rely on, and to minimise the impact of incidents. And they require those organisations to notify their regulator when an incident has a significant or substantial impact on the service.
Regulation is split by sector. Each sector has a designated competent authority, and relevant digital service providers are regulated by the Information Commission (formerly the ICO). The NCSC provides technical support and publishes the NCSC Cyber Assessment Framework that regulators use to assess operators.
Who is in scope
| Group | Examples | Regulated by |
|---|---|---|
| Operators of essential services (OES) | Organisations above set thresholds in energy, transport, health, drinking water and digital infrastructure | The designated competent authority for each sector |
| Relevant digital service providers (RDSPs) | Online marketplaces, online search engines and cloud computing services | The Information Commission |
Whether you meet the thresholds is a legal question for your organisation and its regulator. Many organisations are not regulated directly but supply one that is, and find NIS expectations arriving through contracts, supplier questionnaires and audits. If you provide managed IT or security services, the Cyber Security and Resilience Bill would bring medium and large providers into the regime directly.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Security duties and incident reporting
For operators of essential services, the core duties are in regulations 10 and 11:
- Security measures (regulation 10): appropriate and proportionate measures to manage risk, prevent and minimise the impact of incidents, having regard to the state of the art and to your regulator's guidance.
- Incident notification (regulation 11): notify the designated competent authority of any incident with a significant impact on the continuity of the essential service, without undue delay and in any event no later than 72 hours after becoming aware of it.
- What the notice contains: the operator and service, when the incident happened, how long it lasted, its nature and impact, and any cross-border impact, limited to what you can reasonably be expected to know.
For relevant digital service providers, regulation 12 sets similar duties. Their measures must take into account the security of systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards. Incidents with a substantial impact are notified to the Information Commission.
The 72-hour clock starts from awareness, which is why detection matters. An incident nobody notices cannot be reported on time, and an incident spotted late leaves very little time to establish the facts the notice needs.
NIS2 and the UK
NIS2 (Directive (EU) 2022/2555) is EU law. It replaced the original NIS Directive across EU member states, widened the sectors covered and tightened incident reporting. It does not apply in the UK as UK law. A UK organisation can still be caught by NIS2 through its operations, establishments or services in EU member states, so check with your advisers if you work across the EU.
The nearest UK equivalent is the Cyber Security and Resilience Bill, which would amend the NIS Regulations 2018 rather than replace them. As the government's factsheets describe it, the Bill would bring managed service providers, data centres and designated critical suppliers into scope, move to an initial notification within 24 hours and a full report within 72 hours, and widen reportable incidents to include those likely to have a significant impact even before disruption. At the time of writing (1 November 2026) it had not become law, with its Lords third reading listed for 2 November 2026. Cyber Essentials UK covers the Cyber Security and Resilience Bill in full; our page covers what it means for MSPs.
Is managed security for NIS compliance the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How MDR and SIEM support NIS compliance
NIS regulators assess operators against the Cyber Assessment Framework. Version 4.0 groups detection under Objective C (C1 Security monitoring and C2 Threat hunting) and response under Objective D (D1 Response and recovery planning and D2 Lessons learned). Managed services map onto these naturally:
| CAF area | What it expects in outline | Managed service that helps |
|---|---|---|
| C1 Security monitoring | Monitoring the security status of the systems behind your essential function to detect events that indicate an incident | Cyber security monitoring and a vendor managed SOC |
| C2 Threat hunting | Proactively looking for adverse activity that evades standard prevention and detection | Threat hunting included in services such as Sophos MDR, Check Point MDR and WatchGuard MDR |
| D1 Response and recovery planning | Plans, playbooks and the ability to contain and recover | Agreed response permissions with the vendor SOC and an incident response retainer |
| D2 Lessons learned | Learning from incidents and improving defences | Vendor case reports and root cause analysis, reviewed with you |
| Logs as evidence | Records that show what happened and when | SIEM as a service with retention set to your needs |
Forever Systems does not run its own security operations centre. The 24/7 monitoring and response comes from the vendor services we resell, such as Sophos MDR, Check Point MDR or WatchGuard MDR; we recommend one, set it up, manage it and handle escalation with you. Notification to your regulator remains your decision and your duty; what we can do is help you get the facts together quickly from the vendor's case notes and your logs.
Talk to us about NIS
If you are an operator of essential services, a digital service provider, or a supplier being asked NIS questions by a regulated customer, we can review your current monitoring and response, show where vendor MDR or SIEM services would close gaps against the CAF outcomes, and set them up with response permissions you approve. Scope and responsibilities are confirmed at quote, and pricing is per user, device or data volume depending on the service, so ask us for a quote.
Contact us to discuss NIS monitoring and incident readiness.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
What are the NIS Regulations in the UK?
The Network and Information Systems Regulations 2018 are UK law that requires operators of essential services and relevant digital service providers to manage the security of their network and information systems and to report significant incidents to their regulator.
Who do the NIS Regulations apply to?
Operators of essential services above set thresholds in energy, transport, health, drinking water and digital infrastructure, and relevant digital service providers: online marketplaces, online search engines and cloud computing services.
How long do you have to report a NIS incident?
An operator of essential services must notify its competent authority without undue delay and no later than 72 hours after becoming aware of a NIS incident. The Cyber Security and Resilience Bill proposes an initial notification within 24 hours followed by a full report within 72 hours.
What is the UK equivalent of NIS2?
NIS2 is EU law and does not apply in the UK as UK law. The UK is updating its own NIS Regulations 2018 through the Cyber Security and Resilience Bill, which had not become law at the time of writing.
Does NIS2 apply to UK companies?
Not as UK law, but a UK company that operates or provides services in EU member states may fall within NIS2 there. Take advice on your EU footprint.
What framework do NIS regulators use?
The NCSC Cyber Assessment Framework, now at version 4.0, is the basis regulators use to assess operators. Its detection and response objectives cover security monitoring, threat hunting, response planning and lessons learned.
Still have a question about managed security for NIS compliance?
Ask us and a member of our team will reply by email.