Energy: Cybersecurity
The question
To ask the Secretary of State for Energy Security and Net Zero, pursuant to the answer of 14 July 2026 to question 16796, what are the mandatory reporting thresholds.
Answered by Department for Energy Security and Net Zero
Under Regulation 11 of the Network and Information Systems Regulations 2018, an Operator of Essential Services (OES) must notify the competent authority for their subsector about any incident which has a significant impact on the continuity of the essential service it provides. To determine the significance of an incident’s impact, an OES must take account of the number of users affected by the disruption; the duration; and the geographical area affected. The Regulations do not prescribe numerical reporting thresholds; instead competent authorities may publish sector-specific guidance to assist OES in determining whether an incident is reportable.
Verbatim has judged this answer against the question that was actually asked — answered, partly answered, or evaded. Sign in to see the verdict →