could also be tasked by the Member State concerned, with internal co-ordination and cooperation between multiple national competent authorities, in accordance with Article 10 of the Directive. Figure 2 – decentralised approach. Public Agency Co-ordination Arrangement Sector Public Agency Sector Examples for the decentralised approach. Sweden is a good example for a country that follows a decentralised approach in CIIP. The country uses a “system perspective”, which means that the main tasks of CIIP, such as the identification of vital services and critical infrastructures, the coordination and support of operators, regulatory tasks, as well as measures for emergency preparedness are the responsibility of different agencies and municipalities. Among these agencies are the Swedish Civil Contingencies Agency (MSB), the Swedish Post and Telecom Agency (PTS), and several Swedish Defence, Military and law enforcement agencies. In order to coordinate the actions between the different agencies and public entities, the Swedish government has developed a cooperative network comprised of authorities “with specific societal information security responsibilities”. This Cooperation Group for Information Security (SAMFI) consists of representatives of the different authorities and meets several times a year to discuss issues related to national information security. SAMFI’s subject areas are to be found mainly in political-strategic areas and cover topics such as technical issues and standardisation, national and international development in the field of information security, or management and prevention of IT incidents. (Swedish Civil Contingencies Agency (MSB) 2015). Sweden has not published a central law for CIIP applicable for operators of critical information infrastructure (CII) across sectors. Instead, issuing legislation with obligations for companies within specific sectors is the responsibility of the respective public authorities. For example, the MSB has the right to issue regulations for government authorities in the area of information security, while the PTS can require operators to implement certain technical or organisational security measures based on secondary legislation. 14