Cybersecurity, Cloud and Critical Infrastructure

This paper looks at cybersecurity and the protection of critical national infrastructure, as an area of systemic risk to society. In particular, it looks at the obligations and potential penalties which apply to cloud providers under the regulatory framework established by the EU’s Network and Information Systems Directive (‘NIS Directive’). Various safeguarding and incident notification obligations apply to cloud providers either directly, because of their status as Digital Service Providers, or indirectly, because of their involvement in supply chains for essential services. We argue that there is a risk that this new regulatory framework might lead to only incremental improvements in the cybersecurity of Europe’s critical infrastructure and digital services, while generating substantial compliance activity, aimed at placating regulators and reassuring the general public