Figure 3 – Centralised approach. Public Agency Sector Sector Sector Examples for the centralised approach France is a good example for an EU Member State with a centralised approach. France’s Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI) was declared the main national authority for the defence of information systems in 2011. ANSSI has a strong supervisory role for “operators of vital importance” (OIVs): the agency can order OIVs to comply with security measures and is authorised to perform security audits on them. Furthermore, it is the main single point of contact for OIVs, which are obligated to report security incidents to the agency. In cases of security incidents, ANSSI acts as a contingency agency for CIIP and decides on the measures that operators must take to respond to the crisis. The government’s actions are coordinated within ANSSI’s operations centre. Detection of threats and incident response on an operational level is performed by CERT-FR, which is part of ANSSI. France has established a comprehensive legal framework for CIIP. In 2006, the Prime Minister ordered the establishment of a list of sectors of critical infrastructure. Based on this list, which identified twelve vital sectors, the government has defined around 250 OIVs. In 2013, the Military Programming Law (LPM)13 was promulgated. It sets different obligations for OIVs, such as incident reporting or implementation of security measures. These requirements are mandatory for all OIVs across all sectors (French Senate 2013). 13 La loi de programmation militaire 16