Step 3 – Is the operator providing an essential service within the meaning of the Directive? Pursuant to Article 5(2)(a), the entity which is subject to the identification needs to provide a service which is essential for the maintenance of the critical societal and/or economic activities. When carrying out this assessment, Member States should take into account that one entity can provide both essential and non-essential services. This means that the security and notification requirements of the NIS Directive will apply to a certain operator only to the extent to which it provides essential services. In accordance with Article 5(3), a Member State should compile a list of all essential services provided by OES within its territory. This list will need to be submitted to the Commission by 9 November 2018 and every two years thereafter.30 Step 4 - Does the service depend on a network and information system? Furthermore, it should be clarified whether this service meets the second criterion of Article 5(2)(b) and in particular whether the provision of the essential service depends on network and information systems as defined in Article 4(1). Step 5 – Would a security incident have a significant disruptive effect? Article 5(2)(c) requires the national authority to assess whether an incident would have a significant disruptive effect on the provision of the service. In this context Article 6(1) lays down several cross-sectorial factors that need to be taken into account in the assessment. Furthermore, Article 6(2) rules that if appropriate, the assessment should consider also sectorspecific factors. The cross-sectoral factors listed in Article 6(1) are the following:       The number of users relying on the service provided by the entity concerned; The dependency of other sectors referred to in Annex II on the service provided by that entity; The impact that incidents could have, in terms of degree and duration, on economic and societal activities or public safety; The market share of that entity; The geographic spread with regard to the area that could be affected by an incident; The importance of the entity for maintaining a sufficient level of the service, taking into account the availability of alternative means for the provision of that service. With regard to the sector-specific factors, recital 28 provides some examples (see Table 4) which could provide helpful guidance to national authorities. 30 See Article 5(7)(b) 26