Table 1: National approaches to critical information infrastructure protection (CIIP). In 2016, ENISA published a study12 regarding the different approaches Member States follow to protect their critical information infrastructures. There are two profiles described as to the CIIP governance in Member States which can be used in the context of the transposition of the NIS Directive. Profile 1: Decentralised approach –with multiple sector-based authorities being competent for specific sectors and services referenced in Annex II and III of the Directive. The decentralised approach is characterised by: (i) The principle of subsidiarity (ii) Strong cooperation between public agencies (iii)Sector-specific legislation The principle of subsidiarity. Instead of establishing or designating a single agency with overall responsibility, the decentralised approach follows the principle of subsidiarity. This means that the responsibility for implementation is in the hands of a sector-specific authority, which understands best the local sector and has an existing established relationship with stakeholders. Under this principle, decisions are taken by those closest to those being impacted. Strong cooperation between public agencies. Because of the variety of public agencies involved with CIIP, many Member States developed cooperation schemes in order to coordinate the work and efforts of the different authorities. These cooperation schemes can take the form of informal networks or more institutionalised fora or arrangements. However, these cooperation schemes only serve the purpose of information exchange and coordination between the different public agencies, but have no authority over them. Sector-specific legislation. The countries that follow the decentralised approach across critical sectors often refrain from legislating for the purpose of CIIP. Instead, the adoption of laws and regulations remains sector-specific and therefore can vary greatly between sectors. This approach would have the advantage of aligning NIS-related measures with existing sector-based regulations to improve both the acceptance by the sector and the effectiveness of enforcement by the authority concerned. There is a substantive risk of reduced consistency in the application of the Directive across multiple sectors and services with a purist decentralised approach. In this case, the Directive provides for a single national point of contact for liaison on cross border matters and this entity 12 ENISA, Stocktaking, Analysis and Recommendations on the protection of CIIs (2016). Available at: https://www.enisa.europa.eu/publications/stocktaking-analysis-and-recommendations-on-the-protection-of-ciis 13