national authority. Thus, having a single point of contact would facilitate the identification and cooperation of authorities from different Member States. The liaison role of the single point of contact is likely to involve interaction with the secretariats of the Cooperation Group and of the CSIRT Network in those cases where the national single point of contact is neither a CSIRT nor a member of the Cooperation Group. Furthermore, Member States need to ensure that the single point of contact is informed about the received notifications from operators of essential services and digital service providers.20 Article 8(3) of the Directive specifies that in case a Member State adopts a centralised approach, i.e. appointing only one competent authority, that authority will also have the role of the single point of contact. If a Member State opts for a decentralised approach, it could choose one of the different competent authorities to act as single point of contact. Irrespective of the institutional model chosen, whenever a competent authority, the CSIRT and the single point of contact are different entities Member States have an obligation to ensure effective cooperation among them in order to fulfil obligations laid down in the Directive.21 The single point of contact is required to submit by 9 August, 2018 and every year thereafter a summary report to the Cooperation Group on received notifications which shall include the number of notifications, the nature of the incidents and the measures taken by authorities, such as informing other affected Member States about the incident or the provision of relevant information to the notifying company for handling of the incident.22 Upon request of the competent authority or the CSIRT, the single point of contact has to forward the notifications of operators of essential services to the single points of contact of other Member States affected by the incidents.23 Member States need to inform the Commission about the designation of the single point of contact and its tasks by the transposition deadline. The designation of the single point of contact is to be made public, in the same way as the national competent authorities. The Commission shall publish the list of designated single points of contact. 3.7. Penalties. Article 21 gives a margin to Member States to decide on the type and nature of applicable penalties provided that they are effective, proportionate and dissuasive. In other words, Member States are in principle free to decide on the maximum amount for penalties laid down in their national legislation but the chosen amount or percentage should allow the national authorities to impose, in every concrete case, effective, proportionate and dissuasive penalties, taking into account different factors such as the graveness or frequency of the infringement. 4. Entities under obligations concerning security requirements and incident notifications. 20 See Article 10(3) See Article 10(1) 22 Idem 23 See Article 14(5) 21 19