[FINAL]
3. Essential services
The consultation responses highlighted concerns by a large proportion of respondents that
the identification thresholds, used to define who is in scope of the requirements of the
Directive, required greater clarity. Lead Government Departments have been refining these
thresholds, so that they are clearer and so that companies can identify with certainty whether
they are in scope of the Directive. Revised thresholds are attached at Annex 1.
When considering these thresholds, the Government has taken into account the
requirements of the Directive as set out in Article 5 (Identification of Operators of Essential
Services) and Article 6 (Significant Disruptive Effect). All the parameters set out in these two
Articles were taken into account, although the Government focused on those that were most
relevant for each sector in order to identify key operators. The thresholds set out in the
consultation and this response are the result of that work.
A number of respondents questioned what systems controlled by an Operator would be in
scope. The thresholds in Annex 1 are not intended to identify the systems that are in scope
of the Directive (which will be the responsibility of the Operator in discussion with the
Competent Authority), only the Operators of Essential Services. Identifying the systems that
support the services will need to be carried out by the Operators, as part of understanding
how they can comply with the security requirements.
A number of respondents called on the Government to broaden the scope of the Directive to
include additional sectors, such as Government, Chemicals, Food and Agriculture, or other
entities beyond those listed in the Directive. At this stage, the Government’s priority is to
maintain the Directive’s scope in terms of the sectors and entities to which it relates and not
‘gold-plate’ our implementation by including additional sectors at this time. The Government
intends to conduct a post-implementation review three years after the legislation comes into
effect and this review will consider the effectiveness of the regulations. A decision to extend
the scope of the regulation would be considered at that time.
A number of respondents asked questions about the reserve power to designate operators
that do not meet the identification threshold for their sector. This reserve power is only
intended to be a limited tool for use where specific operators do not meet the identification
threshold (column four of the table at Annex 1), but whom the Government believes there is
a compelling case that this should be within scope. The Government considers that it is
essential to have a power to designate operators to ensure that essential services are
protected without imposing unnecessary regulatory burdens on other organisations. In any
use of this power, the Operator will still need to meet the sector, subsector and essential
service requirements (columns 1 to 3 of the table at Annex 1). This power cannot be used to
designate an entity who does not meet those requirements.
The Government only intends to use the reserve power where there are valid reasons on the
grounds of:
●
national security;
Page 6