Figure 5: Service models and assets in cloud computing Comprehensive guidelines on specific topics within the cloud area36and a guidance document on the basics of cloud computing37 have been provided by ENISA. 4.4.2. Security requirements. Pursuant to Article 16(1) Member States are required to ensure that DSPs take appropriate and proportionate technical and organisational measures to manage the risk posed to the security of network and information systems which the companies use in the provision of their services. Those security measures should take into account the state of the art and the following five elements: i) security of systems and facilities; ii) incident handling; iii) business continuity management; iv) monitoring, auditing and testing; v) compliance with international standards. In this regard the Commission is empowered pursuant to Article 16(8) to adopt implementing acts specifying further those elements and ensuring a high level of harmonisation for these service providers. The implementing act is expected to be adopted by the Commission in autumn 2017. Furthermore, Member States are required to ensure that digital service providers take the necessary measures to prevent and minimise the impact of incidents with a view to ensuring the continuity of the their services. 4.4.3. Notification requirements. DSPs should be required to notify serious incidents to the competent authorities or the CSIRTs. In accordance with Article 16(3) of the NIS Directive, the notification requirement for digital service providers will be triggered in cases where the security incident has a 36 Available at: https://www.enisa.europa.eu/topics/cloud-and-big-data/cloud-security ENISA, Cloud Security Guide for SMEs (2015). Available at: https://www.enisa.europa.eu/publications/cloud-security-guide-for-smes 37 34