The Minister for Sustainable Economic Development, Deputy Gerald Voisin, has signed the Commencement Order for the Cyber Security (Jersey) Law 2026.
The Order sets out how and when the different parts of the Law will come into effect.
The Law is designed to support the critical services and infrastructure that Islanders rely on and strengthen/protect the economy more broadly. It does this by identifying Operators of Essential Services (OES) across different industries including energy, transport, health, water, and public administration.
OES will be requiring them to register, take appropriate steps to protect their services, and report significant cyber security incidents to Jersey Cyber Security Centre (JCSC).
The Law also establishes the legal status and duties of JCSC. As well as providing support and guidance, the Law also requires JCSC to maintain the register of OES and share information with OES in the event of a significant cyber security incident.
The Law was approved by the States Assembly in January, has received Royal Assent, and is now registered in the Royal Court. The Commencement Order signed today sets out the schedule for when the approved Law will come into effect.
To give OES time to prepare for the new requirements, the Law is designed to come into effect in two phases. In September, the Parts of the Law which govern JCSC will come into effect. In December, the Parts of the Law which identify and govern Operators of Essential Services (OES) will come into effect.
Minister for Sustainable Economic Development, Deputy Gerald Voisin, said: “Our future is digital, and that digital future must be secured if Jersey is going to prosper.
“As cyber threats continue to evolve, Jersey must remain a resilient jurisdiction where our key services are protected, and where businesses can operate with a high degree of confidence.
“This legislation follows substantial work by my predecessors, and I am proud to be bringing it to enactment over the coming months. Following feedback from stakeholders, I am enacting the Law in two phases, which will give our critical service providers enough time to prepare, without creating unreasonable expectations.”
Peter Lescop, Chief Information Security Officer for JT Global Limited, said: “As a provider of critical communications infrastructure, JT sees first-hand the importance of robust cyber security in keeping essential services connected, resilient and trusted.
“The Cyber Security (Jersey) Law is a positive step that will help strengthen the Island’s overall cyber resilience by establishing clear standards for Operators of Essential Services. In an increasingly connected world, collaboration between industry and government is vital to protecting customers, businesses and the wider community from evolving cyber threats.”
James Kelsh, Information Security Director for Zensec (formerly Resolution IT), said: “Cyber security is no longer just an IT issue. It’s fundamental to keeping Jersey’s essential services running, from the electricity in our homes, to the systems behind out our hospital and ports.
“The Law gives JCSC a clear mandate to help the Island prepare for and respond to cyber threats and asks Operators of Essential Services to take sensible, proportionate steps to protect the systems we all depend on. That’s good for business, good for Jersey’s reputation, and good for Islanders.”
Matt Palmer, Director of Jersey Cyber Security Centre, said: “After many years’ work, and excellent engagement from industry colleagues, I am pleased that the Cyber Security (Jersey) Law will be coming into effect later this year.
“We have – since we were founded 2021 – worked to support the Island’s overall cyber resilience. Part of that resilience is being able to stop cyber incidents spreading through Jersey’s digital ecosystem. Having a register of OES will make it much easier for us to do that and help safeguard the services that Islanders rely on.
“Over the next few months, JCSC will continue to support Operators of Essential Services (OES) to prepare. We have already held workshops with key organisations, and will continue to publish Standards, Advice, and Guidance. I would urge any organisation who thinks they may be an OES under the Law to get in contact with us.”
