Skip to content
the United Kingdom

Regulations that reach the United Kingdom

The UK is not under NIS2. Directive (EU) 2022/2555 binds member states and the UK ceased to be one, so there is no 24-hour early warning here and no one-month final report — the regime in force is The Network and Information Systems Regulations 2018 (S.I. 2018/506), and it is a single 72-hour notification. Regulation 8(1) is self-executing, which is the part most often got wrong in the other direction: meet a Schedule 2 threshold and you are "deemed to be designated" as an operator of essential services, and regulation 8(2) then requires you to tell your competent authority in writing. No authority tells you first. The Cyber Security and Resilience Bill would replace these Regulations. Before Parliament. Not law, not assessed, and no deadline here anticipates it.

Nothing on this page tells you whether an instrument binds YOU. That turns on facts only you hold — whether a competent authority has designated you, your staff and financial figures aggregated across any parent and subsidiary, and which services you provide. The scope check asks for those and answers in three states, because "not in scope" is a claim about limbs of the law it does not test. Run the scope check.

Reporting clocks in force here

Each window below is the instrument’s own, in the unit the instrument uses. Where a duty only applies once a public authority has designated you, or once you have told us what kind of organisation you are, it is marked and grouped second.

Applies to almost every organisation

UK GDPR Article 33 — personal data breach notification

Report to: the Information Commission (Art. 33(1) as retained and amended — “the Commission” in the retained text, defined by DPA 2018 s. 3(8A))

  • within 72 hoursNotify the Information CommissionUK GDPR Art. 33(1)Owed only if this incident is a personal-data breach, and not owed where the breach is "unlikely to result in a risk to the rights and freedoms of natural persons" (Art. 33(1)). Many incidents are neither. This stage is shown on every incident because nothing here can tell which yours is — decide it on the facts, and document the decision either way, because Art. 33(5) requires you to.

Also owed under the same instrument, with no fixed deadline: Telling the people whose data it was (UK GDPR Art. 34); Documenting every breach, including the ones you do not report (UK GDPR Art. 33(5)); If you are a processor, your clock is different (UK GDPR Art. 33(2)).

A personal-data breach duty runs ALONGSIDE any sectoral incident-reporting duty, never instead of it. Where an incident is both a personal-data breach and a reportable security incident, you owe both notifications, to two different authorities, and filing one does not discharge the other. The 72-hour figure is a coincidence of drafting: the two clocks have different triggers, different recipients and different content requirements.

The UK GDPR is the EU Regulation as retained in UK domestic law and amended for EU exit, not the EU Regulation itself. The 72-hour window is the same; the authority and the internal cross-references are not. If you process personal data of people in the Union as well, the EU Regulation can apply to that processing in parallel under its Art. 3(2), and then you may owe a notification in each jurisdiction. Nothing here works out which of your processing falls on which side.

Applies only to a particular kind of organisation

UK NIS Regulations 2018 — operator of essential services

only if: UK NIS Regs 2018 — Operator of Essential Services

Report to: Your designated competent authority, in writing (reg. 11(1))

  • within 72 hoursIncident notificationNIS Regulations 2018, reg. 11(3)(b)(i)

UK NIS Regulations 2018 — relevant digital service provider

only if: UK NIS Regs 2018 — Relevant Digital Service Provider

Report to: the Information Commission, in writing (reg. 12(3))

  • within 72 hoursIncident notificationNIS Regulations 2018, reg. 12(6)(a)

CRA Article 14 — actively exploited vulnerability

only if: EU CRA Manufacturer (products with digital elements)

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

  • within 24 hoursEarly warning notificationCRA Art. 14(2)(a)
  • within 72 hoursVulnerability notificationCRA Art. 14(2)(b)
  • within 14 daysFinal reportCRA Art. 14(2)(c)

CRA Article 14 — severe incident affecting product security

only if: EU CRA Manufacturer (products with digital elements)

Report to: The CSIRT designated as coordinator of the Member State of your main establishment in the Union — or, if you have none, the one Article 14(7) reaches by its four-step order — simultaneously accessible to ENISA, via the single reporting platform (Art. 14(7), Art. 16)

  • within 24 hoursEarly warning notificationCRA Art. 14(4)(a)
  • within 72 hoursIncident notificationCRA Art. 14(4)(b)
  • within one monthFinal reportCRA Art. 14(4)(c)

Standards and schemes — nothing is ever reported

These reach the United Kingdom too, and none of them imposes a duty to file anything with anyone. There is no regulator to notify and no clock to miss. Where certification exists, it is awarded by a certification body after an audit — never by a tool, and never by us.

ISO/IEC 27001:2022

The international standard for information security management systems. It is voluntary and certifiable: an accredited body audits your ISMS and issues a certificate with a three-year cycle.

Checked against the standard's own control statements, from a licensed copy of ISO/IEC 27002:2022. None of ISO's text is reproduced here, and we do not certify anyone.

ISO 27001 in detail

NIST CSF 2.0

The US National Institute of Standards and Technology's Cybersecurity Framework. Version 2.0 is a voluntary, outcome-based framework organised as six functions, widely used outside the US as a common structure for describing a security programme.

NIST CSF 2.0 in detail

NCSC Cyber Assessment Framework v4.0

The UK National Cyber Security Centre's Cyber Assessment Framework. It is an outcome-based framework — it describes what good looks like rather than prescribing controls — and is the assessment method behind the UK's NIS Regulations.

A self-assessment against the framework, not an NCSC or regulator assessment.

NCSC CAF in detail

Cyber Essentials v3.3 (NCSC UK)

The UK's baseline cyber security certification scheme, run by the NCSC and delivered through IASME. It defines five technical control themes and a scope boundary, and certifies against them: Cyber Essentials is a self-assessment verified by a Certification Body, and Cyber Essentials Plus adds a hands-on technical audit of the same controls.

Indicative only. Cyber Essentials sets hard numbers where most frameworks set outcomes, and our questions now carry them — the 14-day update window, the 12-character password bar, the ten guesses in five minutes, the six-character device PIN. That is still not the same as passing: these are your own answers about your own estate, nothing here is tested, and a question asked at the right bar can be answered wrongly. Where the scheme sets a threshold and no question of ours reaches it, the page names the requirement rather than netting it away. Certification is awarded by a Certification Body, and Cyber Essentials Plus adds a hands-on audit; we are neither.

Cyber Essentials in detail

What Vivid Risk does with all of this

  • Runs the reporting clock for each instrument above from dates you enter, against stage timings read out of the instrument itself — including the ones that are not in the instrument at all, like DORA's, where Article 19(4) sets no limit and every figure comes from Delegated Regulation (EU) 2025/301.
  • Cites a provision on every scored control, per jurisdiction, each one checked against the published text rather than a secondary summary.
  • Answers the scope question in three states, and refuses to say "not in scope" — because that is a claim about parts of the law it does not test.
  • Quantifies exposure with a real Monte Carlo simulation over your own three-point estimates, and picks a remediation set with an exact optimiser rather than a greedy sort.

What it does not do

  • Files nothing, with anyone. Not with a CSIRT, not with a competent authority, not with ENISA or the Single Reporting Platform. Where you record a notification here, that is your own note of what you filed and when.
  • Collects no evidence from your systems automatically. There is one read-only connector, for Google Workspace, and it returns counts that are filed BESIDE the answer you give rather than in place of it.
  • Certifies nobody, and determines nobody's compliance. Certification comes from a certification body; compliance is determined by your competent authority.
  • Decides nothing about whether you are in scope. See above.

Find out which of these reach you

The scope check asks for the figures and statuses the law actually turns on, and answers in three states. It will tell you when it cannot place you, rather than guessing.

Run the scope check