<\/p>\n
According to the Department for Energy Security and Net Zero (DESNZ) and Ofgem, the baseline standards will be founded on the existing \u2018Cyber Essentials Plus\u2019 scheme that the government operates, which sets cyber standards that organisations can adopt and obtain independent certification for. A consultation on the precise substance of the requirements is planned for next year. The DESNZ and Ofgem have pledged to minimise regulatory burdens and duplication with existing and forthcoming cyber requirements some licensees in the DGE market are already subject to.<\/p>\n
A cohort of DGE operators are subject to UK cyber regulation under the Network and Information Security (NIS) Regulations 2018. The NIS regime applies to \u2018operators of essential services\u2019, which must keep their networks and information secure and notify security incidents when they occur.\u00a0However, amidst \u201cenergy system and technology transformation\u201d, the DESNZ and Ofgem want to ensure \u201cthe most critical organisations\u201d in the DGE market are within the scope of NIS and have commissioned the National Energy System Operator (NESO) to advise them on whether the existing scope and thresholds for NIS regulation need to be adjusted to achieve this.<\/p>\n
The government intends to exercise powers contained in draft legislation currently making its way through the UK parliament to update the NIS regime, should such a move be recommended by NESO. Subject to the Cyber Security and Resilience Bill (CSRB) receiving Royal Assent, a consultation on those proposals will be opened in 2027, it said.<\/p>\n
The policy decisions were contained in a response<\/a> (39-page \/ 413KB PDF) published by the DESNZ and Ofgem to a consultation they ran earlier this year<\/a>\u00a0on reshaping cyber regulation in the DGE market. The government previously set out a strategic goal of raising cyber resilience across the whole DGE system by the end of 2030.<\/p>\n