Entities playing an important role for society and economy referred to in Articles 4(4) and 4(5) of the Directive as operators of essential services (OES) and digital service providers (DSPs) are required to take appropriate security measures and notify serious incidents to the relevant national authorities. The rationale is that impacts of security incidents in such services may constitute a major threat to the operation of such services which may cause major disruptions to economic activities and to society at large, potentially undermining user confidence and cause major damage to the economy of the Union.24 This section provides an overview of entities included in the scope of the NIS Directive’s Annexes II and III and lists their obligations. The identification of operators of essential services is covered extensively, given the importance of this process for the harmonised implementation of the NIS Directive across the EU. It also provides extensive explanations to the definitions of digital infrastructures and digital service providers. It also examines the possible inclusion of additional sectors and further explains the specific approach with regard to DSPs. 4.1. Operators of essential services (OES). The NIS Directive does not define explicitly which particular entities will be considered as OES under its scope. Instead, it provides criteria that Member States will need to apply in order to carry out an identification process which will ultimately determine which individual companies that belong to the type of entities listed in Annex II will be considered operators of essential services, and therefore subject to the obligations under the Directive. 4.1.1. Type of entities listed in NIS Directive Annex II. Article 4(4) defines OES as public or private entities of the types listed in Directive’s Annex II that meets the requirements of Article 5(2). In Annex II the sectors, subsectors and the type of entities are listed for which each Member States needs to carry out the identification process under Article 5(2)25. The sectors include energy, transport, banking, financial market insfrastructures, health, water and digital infrastructure. For most of the entities which belong to the 'traditional sectors' EU legislation contains well developed definitions to which Annex II makes a reference. However, for the sector of digital infrastructure, listed under point 7 of Annex II, including Internet Exchange Points, Domain Name Systems and Top-level domain name registries, this is not the case. Therefore, with the aim to clarify these definitions, the following provides an detailed explaination of these definitions. 1) Internet Exchange Point (IXP). 24 25 See recital 2 See below under section 4.1.6. for more details on the identification process 20