Incidents and Complaints

Where should incidents involving trust service providers be reported: to the sectoral CSIRT and the supervisory authority, or only to one of these entities?

Regardless of its size, a qualified trust service provider is classified as an essential entity pursuant to Article 5(1)(4)(b) of the National Cybersecurity System Act (UKSC). Consequently, under Article 11(1a) of the UKSC, an essential entity is required to report a significant incident to the competent sectoral CSIRT via the ICT system referred to in Article 46(1) of the UKSC.

At the same time, pursuant to Article 24(2)(f)(b) of the eIDAS Regulation, any security breach or disruption in the provision of a trust service must be reported to the supervisory body. The requirements of the NIS2 Directive, as transposed into national law through the provisions of the UKSC, are complementary to those of the eIDAS Regulation. This follows from Recital 93 of the Directive. Compliance by a trust service provider with its reporting obligation towards the sectoral CSIRT does not exempt that provider from the obligation to notify the Minister of Digital Affairs, acting as the supervisory authority for trust services.

In summary, not every incident must be reported to both recipients. A significant incident within the meaning of the UKSC must be reported to the sectoral CSIRT, as indicated above. A breach of the security or integrity of a trust service within the meaning of the eIDAS Regulation must be reported to the supervisory authority. Where an incident meets the reporting criteria under both the UKSC and the eIDAS Regulation, it must be reported to both entities.