3.3. NIS Directive, Article 9: Computer Security Incident Response Teams (CSIRTs). Pursuant to Article 9, Member States are required to designate one or more CSIRT entrusted with the task of handling risks and incidents for the sectors listed in the NIS Directive’s Annex II and the services listed in Annex III. Taking into account the minimum harmonisation requirement enshrined in Article 3 of the Directive, Member States are free to use the CSIRTs also for other sectors not covered by the Directive, such as the public administration. Member States can opt for establishing a CSIRT within the national competent authority.14 3.4. Tasks and requirements. The tasks of designated CSIRTs, set forth in Annex I of the NIS Directive, include the following:      Monitoring incidents at a national level; Providing early warning, alerts, announcements and dissemination of information to relevant stakeholders about risks and incidents; Responding to incidents; Providing dynamic risk and incident analysis and situational awareness; and Participating in the network of the national CSIRTs (CSIRTs network) established under Article 12. Specific additional tasks are set forth in Articles 14(3), 14(5), 14(6), 16(3), 16(6) and 16(7) in relation to incident notifications where a Member State decides that CSIRTs in addition to or instead of national competent authorities can undertake such roles. In transposing the Directive, Member States have options regarding the role of CSIRTs with incident notification requirements. Direct mandatory reporting to CSIRTs is possible with advantages of administrative efficiency, alternatively Member States can opt to have direct reporting to national competent authorities with CSIRTs having a right of access to the reported information. CSIRTs are ultimately interested in problem solving in deterring, detecting, responding to and mitigating the impact of cyber incidents (including those not critical for mandatory reporting) with their stakeholders with regulatory compliance being a matter for national competent authorities. Pursuant to Article 9(3) of the Directive, Member States also need to ensure that such CSIRTs have access to a secure and resilient ICT infrastructure. Article 9(4) of the Directive requires Member States to inform the Commission about the remit and main elements of the incident handling process of the designated CSIRTs. 14 See Article 9(1) last sentence. 17