Document Generated: 2022-06-22 Status: This is the original version (as it was originally made). PART 4 Digital Services Relevant digital service providers 12.—(1) A RDSP must identify and take appropriate and proportionate measures to manage the risks posed to the security of network and information systems on which it relies to provide, within the European Union, the following services— (a) online marketplace; (b) online search engine; or (c) cloud computing service. (2) The measures taken by a RDSP under paragraph (1) must— (a) (having regard to the state of the art) ensure a level of security of network and information systems appropriate to the risk posed; (b) prevent and minimise the impact of incidents affecting their network and information systems with a view to ensuring the continuity of those services; and (c) take into account the following elements as specified in Article 2 of EU Regulation 2018/151— (i) the security of systems and facilities; (ii) incident handling; (iii) business continuity management; (iv) monitoring auditing and testing; and (v) compliance with international standards. (3) A RDSP must notify the Information Commissioner about any incident having a substantial impact on the provision of any of the digital services mentioned in paragraph (1) that it provides. (4) The requirement to notify in paragraph (3) applies only if the RDSP has access to information which enables it to assess whether the impact of an incident is substantial. (5) The notification mentioned in paragraph (3) must provide the following information— (a) the operator’s name and the essential services it provides; (b) the time the NIS incident occurred; (c) the duration of the NIS incident; (d) information concerning the nature and impact of the NIS incident; (e) information concerning any, or any likely, cross-border impact of the NIS incident; and (f) any other information that may be helpful to the competent authority. (6) The notification under paragraph (3) must— (a) be made without undue delay and in any event no later than 72 hours after the RDSP is aware that an incident has occurred; and (b) contain sufficient information to enable the Information Commissioner to determine the significance of any cross-border impact. (7) In order to determine whether the impact of an incident is substantial the RDSP must— (a) take into account the following parameters, as specified in Article 3 of EU Regulation 2018/151— 11