(1) A provider shall, on the request of the Commission, provide the Commission with the information needed to assess the security of the provider's networks and services, including documented security policies.

(2) The Commission may serve a direction (referred to in this Part as a "security measures direction") on a provider -

(a) to remedy a security incident,

(b) to prevent a security incident from occurring when a significant threat has been identified, or

(c) to ensure that the provider is in compliance with this Part.

(3) Without prejudice to the generality of subsection (2), a security measures direction may require a provider to do one or more of the following:

(a) to implement specified measures within specified time limits to remedy a security incident or prevent one from occurring when a significant threat has been identified;