Formal DCMS response awaited by the end of the year on consultation to implement the Cyber Security Directive in the UK

The public consultation issued by the UK Department for Digital, Culture, Media & Sport on implementing the EU Network and Information Security Directive (“Cyber Security Directive”) into national legislation closed on 30 September 2017 (the “Consultation”).

The Consultation sets out the UK Government’s planned approach for implementing the Cyber Security Directive, along with a series of questions on a range of detailed policy issues relating to the implementation. It seeks to obtain views from industry, regulators and other interested parties on the proposed plans. The Government is currently analysing feedback and a formal response is expected in December 2017 (within ten weeks of the consultation closing date). The Government has also confirmed its intention for the implementing legislation to continue to apply in the UK post-Brexit (refer to our previous related article for further detail). Continue reading

ENISA report includes guidance on CSIRT maturity assessment

On 12 June 2017, the European Union Agency for Network and Information Security (“ENISA“) published a new report which includes a comprehensive overview of parameters for Computer Security Incident Response Teams to assess their respective maturity. The EU Network and Information Security Directive (the “Cyber Security Directive“) creates a CSIRTs network “to contribute to developing confidence and trust between the Member States and to promote swift and effective operational cooperation”. Each Member State is required to designate one or more CSIRTs to comply with certain requirements in the directive (covering at least the sectors referred to in Annex II and the services referred to in Annex III) and responsible for risk and incident handling in accordance with a well-defined process. Continue reading

ENISA Guidance: Incident Reporting for Digital Service Providers under Cyber Security Directive and the interplay with GDPR

The new report referenced in the article above, follows comprehensive guidelines (the “Guidelines“) published by ENISA in February 2017 for Member States and the European Commission on how to implement incident notification for “digital service providers” (“DSPs“) across the EU, in the context of the Cyber Security Directive.

DSPs: The Cyber Security Directive sets out obligations in respect of “operators of essential services” and DSPs, with a slightly “lighter touch” approach applying to the latter. DSPs are limited to three types of services:

  • online marketplaces – which allow consumers and traders to conclude online sales or service contracts with traders and are the final entity where the contract is concluded. The term excludes both online “intermediaries” to third party services through which a contract can be concluded, as well as online price comparison services of different traders that redirect the user to the preferred trader to purchase the product;
  • online search engines – excluding search functions that are limited just to the content of a specific website; or
  • cloud computing service providers – spanning a wide range of activities that can be delivered according to different models.

Continue reading