The States Assembly has approved legislation which will increase the Island’s protection against cyber security threats.
The draft Cyber Security (Jersey) Law 202- (which will come into effect later in 2026, pending Privy Council approval) places new requirements on Operators of Essential Services (OES) to protect themselves against cyber security incidents.
In addition, the Law establishes the legal status of Jersey Cyber Security Centre (JCSC) as an advisory and emergency response body. The Law also sets out a requirement for JCSC to operate at arm’s length from regulators, law enforcement and Government, and to produce annual reports on its activity.
The main effect of the Law will be on organisations that are classed as OES in a range of sectors including: energy, water, transport, food production and retail, postal and courier services, health, telecommunications, public communications, financial services, and public administration.
Organisations that meet specific thresholds for their sector will have to meet certain requirements. They will be required to:
- Register as an OES with Jersey Cyber Security Centre (JCSC)
- Put in place appropriate cyber security measures
- Report any significant cyber incidents to JCSC within 24 hours of becoming aware of them, including key information
JCSC will work with Operators of Essential Services to develop standards and guidance ahead of the Law coming into force. OES can work with JCSC to help shape these standards at a series of sector-specific workshops, which will take place between 6 February and 26 February:
- Friday 6 February: Energy and Water (12:30 – 14:00)
- Thursday 6 February: Digital Sector (14:30 – 16:00)
- Thursday 12 February: Transport, Postal, Courier, Food (10:30 – 12:00)
- Thursday 12 February: Digital Services (13:00 – 14:30)
- Thursday 19 February: Public Administration (10:00 – 11:30)
- Thursday 19 February: Telecommunications (12:30 – 14:00)
- Thursday February 26: Parishes (10:00 – 11.30)
Deputy Moz Scott, Assistant Minister for Sustainable Economic Development, who led on the development of the Law, said: “I am pleased that the States Assembly has today approved the draft Cyber Security (Jersey) Law.
“This Law has been developed over some time, which has allowed us to work in partnership with affected sectors and ensure the Law reflects the existing regulatory landscape. We now have a Law that sets a good direction of travel and improves safeguards for our services and our community.”
Director of JCSC, Matt Palmer (pictured), said: “The approval of this Law is a significant landmark for the Island, and for JCSC. As well as focusing on improving the cyber resilience of our key services, the Law also makes JCSC’s status and role clearer. This will make it easier for us to collaborate with Operators of Essential Services (OES) in a constructive and confidential way.
“We are holding workshops so that we can work with OES to support them and develop standards and guidance that are appropriate for Jersey organisations. We are writing directly to every organisation we believe may be an OES to invite them to these workshops. However, I would urge anyone who believes their organisation may be an OES to check the thresholds in the Law, and attend a workshop for their sector.”
