private networks and information systems underpinning the functioning of our society and economy. The first important element in this regard is the Member States’ preparedness which should be ensured by having national cybersecurity strategies in place, as described in the Directive, by the work of the CSIRTS, and by that of the competent national authorities. Comprehensiveness of national strategies It is important that Member States seize the opportunity of the transposition of the NIS Directive to review their national cybersecurity strategy in the light of the gaps, best practices and new challenges addressed in the Annex. While the Directive understandably focuses on those companies and services that are of particular critical importance, it is the cybersecurity of the economy and society as a whole that needs to be addressed in a wholistic and consistent manner, given the ever increasing reliance on ICT. Therefore, the adoption of comprehensive national strategies which go beyond the minimum requirements of the NIS Directive (i.e. covering more than the sectors and services listed respectively in the Directive’s Annex II and III) would increase the overall level of security of network and information systems. As cybersecurity is still a relatively new and rapidly expanding area of public policy, new investments are required in most cases, even if the overall situation in public finances calls for cuts and savings. Taking ambitious decisions to secure adequate financial and human resources which are indispensable for the effective implementation of national strategies, including the sufficient resourcing of national competent authorities and CSIRTs, is therefore fundamental for the achievement of Directive's objectives. Effectiveness of implementation and enforcement. The need to designate respective national competent authorities and single points of contacts is outlined in the Directive’s Article 8 and is a key element to ensure an effective implementation of the NIS Directive and cross-border cooperation. Here both more centralised and decentralised approaches have emerged in Member States. When Member States adopt a more decentralised approach with regard to the designation of national competent authorities, ensuring strong cooperative arrangements between numerous authorities and the single point of contact has proved to be of essence (see Table 1 of section 3.2. of the Annex). This would increase effectiveness of implementation and facilitate enforcement. Drawing on previous experience in relation to Critical Information Infrastructure Protection (CIIP) may help to design an optimal model of governance for Member States, ensuring both effective sectoral implementation of the NIS Directive, as well as a coherent horizontal approach (see section 3.1. of the Annex). 4