icon-grid
Better Regulation logo
Table of Contents

Table of Contents

Expand all headings Collapse all headings Expand side bar Collapse side bar
European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 [S.I. No. 360 of 2018]Introductory TextPart 1 General Provisions (regs. 1-6)Regulation 1 CitationRegulation 2 InterpretationRegulation 3 ApplicationRegulation 4 Safeguarding of State's essential functionsRegulation 5 Sharing of informationRegulation 6 Co-operation with Data Protection Commission and the Garda SiochánaPart 2 Competent Authority, Single Point of Contact, CSIRT (regs. 7-10)Regulation 7 Competent authority for operators of essential servicesRegulation 8 Competent authority for digital service providersRegulation 9 Single Point of ContactRegulation 10 CSIRTPart 3 National Strategy on the Security of Network and Information Systems (reg. 11)Regulation 11 National Strategy on the security of network and information systemsPart 4 Operators of Essential Services (regs. 12-18)Regulation 12 Designation of Operators of Essential ServicesRegulation 13 Procedure for designation as operator of essential servicesRegulation 14 Amendment of designation as operator of essential services by addition of sector, subsector or essential service in respect of which a person is designatedRegulation 15 Amendment of designation as operator of essential services by cancellation of category of sector or subsector or essential service in respect of which a person is designatedRegulation 16 Register of Operators of Essential Services, Combined Operators RegisterRegulation 17 Security requirements in respect of operators of essential servicesRegulation 18 Incident notification by operators of essential servicesPart 5 Digital Services (regs. 19-24)Regulation 19 DefinitionRegulation 20 Relevant digital service providerRegulation 21 Security measures to be taken by relevant digital service providersRegulation 22 Incident notification by a relevant digital service providerRegulation 23 Co-operation and assistance in respect of relevant digital service providers whose network and information systems are not in StateRegulation 24 Co-operation in respect of digital service providers whose main establishment or designated representative not in State but whose network and information systems are in StatePart 6 Guidelines (reg. 25)Regulation 25 GuidelinesPart 7 Voluntary Notification (reg. 26)Regulation 26 Voluntary NotificationPart 8 Implementation and Enforcement (regs. 27-38)Regulation 27 Security assessmentRegulation 28 Appointment of authorised officersRegulation 29 Powers of authorised officersRegulation 30 Compliance noticeRegulation 31 Information noticeRegulation 32 Service of documentsRegulation 33 Offence by body corporateRegulation 34 PenaltiesRegulation 35 Costs of prosecutionsRegulation 36 Prosecution of offences-operators of essential servicesRegulation 37 Prosecution of offences-relevant digital service providersRegulation 38 Hearing of proceedings otherwise than in publicSchedule 1Schedule 2Given under
Page Overview
Document Overview
Tools
Set a date to view the document
Text comparison options
Full text - Date 1 vs Date 2
Amendments requiring commencement - Current text vs Text requiring commencement
Draft proposed changes - Current text vs Text proposed by drafting documents
Coming soon: Any documents - Any document vs Another document at any date
Print / Export options
Current page
Whole document
Selected pages
Consolidated PDF of the entire document as of 24th December 2024
Export
Export line by line
Export provision to provision
Report template
Create report template
Alert me to changes
Manage alerts
Bookmarks
This page
This document
Manage bookmarks
Search within this document
View previous searches
Share
Get page link
Share via email application
PreviousNext
Version status: In force | Document consolidation status: No known changes
Version date: 18 September 2018 - onwards

Regulation 18 Incident notification by operators of essential services

(1)

(a) An operator of essential services shall notify the CSIRT in accordance with paragraph (2) of any incident concerning it that has a significant impact on the continuity of an essential service provided by it in respect of which it is designated as an operator of essential services.

(b) An operator of essential services who relies on a third-party digital service provider for the provision of an essential service in respect of which it is designated as an operator of essential services shall notify the CSIRT in accordance with paragraph (2) of an incident affecting the digital service provider which has a significant impact on the continuity of the essential service provided by the operator.

(2) A notification in respect of an incident shall be made under paragraph (1) without delay after the incident occurs and, in any event, not later than 72 hours after the operator of essential services concerned becomes aware of the occurrence of that incident.

(3) A notification made under paragraph (1) shall, to the extent to which the operator concerned may reasonably be expected to have such information, contain the following information:

PreviousNext