Each organisation that has been Qualified under the REC, including those under Controlled Market Entry Conditions (CMEC), is responsible for ensuring that it continues to meet its obligations under the REC. A key element of this is maintaining qualification.

The maintenance of qualification guidance document sets out the requirements that are mandatory to remain compliant under the REC, and can be found here.

Maintenance of Qualification REC Service User Categories

Under the REC, there are different types of REC Service User Categories and the purpose of this document is to define these and detail the ongoing assurance requirements of Qualified REC Service Users, and can be found here. Note – this document applies to REC Parties, who access multiple services, as well as Non-Party REC Service Users, who typically have access to enquiry services only.

Annual Statement and Consolidated Metering Code of Practice Self Declaration

REC Parties and Non-Party REC Service Users are required to submit an Annual Statement each year via the REC Portal to self-certify the qualification under the REC. The REC Service Categorisation and Assessment document can be found here. If the Party is an Energy Supplier or Distribution Network Operator than any changes or forthcoming changes should also be highlighted and  the risks associated with the change categorised. Suppliers whose number of domestic customers is above a defined threshold (more than 5,000) must make specific smart metering declarations on this form.

Compliance Statement

REC Parties or Non-Party REC Service Users are required to make an information security disclosure each year, either a Compliance Statement or an External Assessment. How often these are required is dependent on the user category which is set out in the REC Service User Categorisation and Assessment Document. If the Party is required to provide a Compliance Statement the Code Manager will inform them in advance and this will be submitted alongside the Parties Annual Statement submission on the REC Portal. A downloadable format of the Compliance Statement can be found here.

External Assessment

REC Parties or Non-Party REC Service Users are required to make an information security disclosure each year, either a Compliance Statement or an External Assessment. A downloadable format of the External Assessment can be found here.

If required to undergo an External Assessment you will be informed in advance by the Code Manager, this will need to be submitted alongside the Annual Statement submission on the REC Portal. The frequency of External Assessment varies depending on the nature of the organisation and their performance, with the majority of Parties undergoing one every three years, and some non-Party REC Service Users not being required to complete them at all. Guidance on completing the External Assessment, including how to answer the questions and what evidence the Party would need to provide can be found in Appendix 2 in the REC Maintenance and Qualification Guidance Document.

System or Process Change Disclosure

Should a Party make, or intend to make, significant changes to the system or process that are required to disclose this in advance and provide additional information for assessment by the Code Manager. This form can be accessed at any time on the REC portal, or when completing the Annual Statement and can be found here.

All REC Service Users are obligated to report any relevant and significant security incidents that affect or have affected their Systems to the Code Manager. The Data Protection Incident Report can be found in the Party Operations area of the REC Portal and can be uploaded alongside the required supporting material.

Guidance on completing this disclosure and how to answer the questions alongside the supporting evidence that is required can be found within Appendix 4 in the REC Maintenance and Qualification Guidance Document.