effect on the security of network and information systems”. The term ‘security of network and information systems’ is further defined under Article 4(2) as “the ability of network to resists, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of stored or transmitted or processed data or the related services offered by, or accessible via, those network and information systems.” Consequently, any event having an adverse effect not only on the availability but also on authenticity, integrity or confidentiality of data or related services could potentially be able to trigger the notification obligation. In fact, the continuity of the service as referred to in Article 14(3) can be compromised not only in cases where the physical availability is concerned, but also by any other security incident affecting the proper provision of the service33. A dedicated work stream within the Cooperation Group is currently preparing non-binding notification guidelines concerning the circumstances in which operators of essential services are required to notify incidents pursuant to Article 14(7) and the format and procedure of national notifications. The guidelines are intended to be finalised by Q4 of 2017. Different national notification requirements may lead to legal uncertainty, more complex and cumbersome procedures and significant administrative costs for providers operating crossborder. The Commission therefore welcomes the work of the Cooperation Group. As is the case for security requirements, the Commission encourages Member States to follow closely the guidance document to be developed by the Cooperation Group so that that national provision on notification of incidents would be aligned to the extent possible. 4.4. NIS Directive, Annex III: Digital Service Providers. The Digital Service Providers (DSPs) are the second category of entities included in the scope of the NIS Directive. These entities are considered to be important economic players due to the fact that they are used by many businesses for the provision of their own services, and a disruption of the digital service could have an impact on the key economic and societal activities. 4.4.1. Categories of DSPs. Article 4(5) which defines digital service refers to the legal definition of point (b) of Article 1(1) of Directive (EU) 2015/1535 by narrowing the scope to the types of services listed in Annex III. In particular, Article 1(1) point (b) of Directive (EU) 2015/1535 defines these services as “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services” and Annex III of the Directive lists three specific types of services: online market place, online search engine and cloud computing service. In comparison to the operators of essential services, the Directive does not require Member States to identify the digital service providers, which would then be subject to the relevant obligations. Therefore, the relevant obligations of the Directive, namely the security and notifications requirements set out in Article 16 will apply to all DSPs within its scope. 33 The same applies to DSPs. 31