Stricter thresholds for reporting network and information systems incidents

Regulator Ofcom aims to increase the reporting of significant disruption by lowering thresholds in NIS guidance. 

There have been several outages recently in the digital infrastructure sector – but these were not reported to Ofcom, making it more difficult for the regulator to understand causes, identify significant cyber security and resilience gaps, and spot thematic trends.

This is especially concerning given how many essential services now depend on digital infrastructure, reports of serious data breaches and the recent NCSC warning of increased threats from state-aligned groups. 

Though such outages can have a serious impact on services, each was not considered a ‘significant incident’ within the terms of Ofcom’s Network and Information Systems (NIS) guidance. That means there was no obligation on Operators of Essential Services (OES) to inform Ofcom about them. 

Following public consultation, with responses received from Citizens Advice Scotland (CAS), LINX and Nominet, Ofcom has decided to lower these incident-reporting thresholds. This should mean an increase in such reports and a better picture of what is occurring.

Under the old system, the OES of a TLD name registry service or DNS authoritative hosting service was required to inform Ofcom of a loss or significant degradation of more than 50% lasting more than an hour. The OES of a DNS resolver service had to report a similar degradation lasting 30 minutes. 

The revised guidance now requires notification to be made where service degrades by 25% for more than 15 minutes. 

The OES of an IXP service was required to notify Ofcom of a loss of 25% of a connected ASN or 90% of total port capacity lasting more than an hour. Now, a loss of 25% of connected ASN or 50% of total port capacity should be reported where it lasts more than 15 minutes. 

For more information, see the Ofcom statement and supporting documents.

Photo by Robynne Hu