UK NIS Regulations and the Cyber Security and Resilience Bill: what they mean for teams outside the office

The UK left the EU before Directive (EU) 2022/2555, known as NIS2, was adopted, so NIS2 is not UK law. Operators here are regulated by the Network and Information Systems Regulations 2018 (SI 2018/506), which implemented the first NIS Directive. They cover operators of essential services in energy (electricity, oil and gas), transport (rail, air, maritime and road), health (including NHS trusts, integrated care boards and independent providers), drinking water and digital infrastructure, plus relevant digital service providers: online marketplaces, online search engines and cloud computing services. Each sector has its own competent authority, such as Ofcom or the ICO, with separate authorities in Scotland and Northern Ireland for some sectors.

The government introduced the Cyber Security and Resilience (Network and Information Systems) Bill on 12 November 2025. It brings data centres, relevant managed service providers, large load controllers and designated critical suppliers into scope, adds a 24-hour first notification for incidents and moves to turnover-based fines. In October 2026 the Bill was still going through the House of Lords, and much of the detail will follow in secondary legislation, so the rules described below may still change.

NIS2 still matters to UK organisations that provide services in EU member states, because those services fall under the transposing law of each member state where they operate. If that applies to you, read that country’s law and guidance as well.

The Regulations protect the essential services an operator provides, together with the network and information systems behind them. Burst-main crews at a water company, fault teams at a distribution network operator, ambulance crews and a rail operator’s incident teams all depend on systems that live outside the data centre:

• phones and tablets that receive jobs, maps and plans;
• messaging used to coordinate a response, including consumer chat apps people picked up on their own;
• location data, photos and incident records created in the field;
• the cloud services and managed service providers hosting those apps and that data, which the Bill brings into scope in their own right;
• fallback arrangements for when the mobile network or the central system is down.

The Regulations require “appropriate and proportionate” technical and organisational measures. Most competent authorities assess operators against the NCSC’s Cyber Assessment Framework (CAF), which sets out four objectives and fourteen principles. With crews in mind, they come down to roughly this:

• Governance and risk management (objective A) should take in mobile devices, field apps and the data on them, with the board accountable for the result.
• Asset management: know which devices exist, who holds them and what they can reach.
• Supply chain, still under objective A, which here means assessing the vendors of field apps and the services behind them. The Bill adds powers to designate critical suppliers.
• Identity and access control (objective B): multi-factor authentication, prompt removal of access when someone leaves, and a way to revoke a lost phone.
• Data security, covering messages, photos and files sent from the field, in transit and on the device.
• Resilient networks and systems. Plan how crews carry on when the network or the central system fails, which in practice means offline maps and data held on the device.
• Staff awareness and training (screen locks, updates, phishing) for crews as well as office staff.
• Security monitoring (objective C): a lost phone, a hijacked chat account or a leaked location trace has to be noticed before it can be handled.
• Response and recovery planning, and lessons learned (objective D). Crews need to know how to report an incident, and the record of what happened should feed the review.

The CAF starts with governance: it expects the board to own the approach to securing network and information systems and to understand the risk. Field operations are often run by people who never see the security policy, and regulators expect the leadership that signs it off to know how it applies on the ground.

Under the NIS Regulations today, the maximum penalty is £17 million for a material contravention that has created, or could have created, a significant risk to the service. According to the government’s enforcement factsheet, the Bill introduces two bands: up to £17 million or 4% of worldwide turnover for more serious breaches, and up to £10 million or 2% for the less serious ones, whichever is higher in each case. Services provided in the EU fall under NIS2’s Article 34 minimum maxima of €10 million or 2% for essential entities and €7 million or 1.4% for important ones.

Sinkaos keeps field coordination in one system you can account for. It has per-device keys and revocation, MFA and passkeys, end-to-end encrypted messages and files, offline operation when the network fails and a tamper-evident audit trail, and you can choose EU hosting, your own servers or a disconnected node. It supports your obligations under the NIS Regulations without making you compliant by itself. Details are on the security page and under deployment.