Another example for a country that displays characteristics of this profile is Ireland. Ireland follows a “doctrine of subsidiarity” where each Ministry is responsible for the identification of CII and risk assessment within its own sector. Furthermore, no specific regulations for CIIP at the national level have been enacted. Legislation remains sectorial and exists mainly for the energy and telecommunications sector (2015). Other examples are Austria, Cyprus and Finland. Profile 2: Centralised approach – with one central authority being competent across all sectors and services referenced in Annex II and III of the Directive. The centralised approach is characterised by: i) A central authority across sectors ii) Comprehensive legislation Central authority across sectors. Member States that follow a centralised approach have developed authorities with responsibilities and wide competencies across several or all critical sectors, or have extended the powers of existing authorities. These main authorities for CIIP combine several tasks such as contingency planning, emergency management, regulatory tasks and supporting private operators. In many cases, the national or governmental CSIRT is part of the main CIIP authority. A central authority is likely to have a higher concentration of expertise in cyber security than multiple sectoral authorities, given the overall shortage of cybersecurity skills. A comprehensive legislation. A comprehensive legislation creates obligations and requirements for all operators of CII across all sectors. This can be achieved through new comprehensive laws, or through complementing existing sector-specific regulations. This approach would facilitate a consistent application of the NIS Directive across all of the sectors and services covered. It would avoid a risk of implementation gaps that could arise in the case of multiple authorities with specific remits. 15