Document Generated: 2022-06-22 Status: This is the original version (as it was originally made). (b) in any other case, the date three months after the date on which the person falls within that paragraph. Revocation 9.—(1) Even if a person satisfies the threshold mentioned in regulation 8(1)(b), a relevant competent authority may revoke the deemed designation of that person, by notice, if the authority concludes that an incident affecting the provision of that essential service by that person is not likely to have significant disruptive effects on the provision of the essential service. (2) A competent authority may revoke a designation of a person under regulation 8(3), by notice, if the conditions mentioned in that regulation are no longer met by that person. (3) Before revoking a deemed designation of a person under regulation 8(1), or a designation of a person under regulation 8(3), the competent authority must— (a) serve a notice in writing of proposed revocation on that person; (b) provide reasons for the proposed decision; (c) invite that person to submit any written representations about the proposed decision within such time period as may be specified by the competent authority; and (d) consider any representations submitted by the person under sub-paragraph (c) before a final decision is taken to revoke the designation. (4) In order to arrive at the conclusion mentioned in paragraph (1), the competent authority must have regard to the factors mentioned in regulation 8(4). (5) A competent authority may revoke a deemed designation under regulation 8(1), or a designation of a person under regulation 8(3), if the authority has received a request from another Member State to do so and the competent authority is in agreement that the designation of that person should be revoked. The security duties of operators of essential services 10.—(1) An OES must take appropriate and proportionate technical and organisational measures to manage risks posed to the security of the network and information systems on which their essential service relies. (2) An OES must take appropriate and proportionate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used for the provision of an essential service, with a view to ensuring the continuity of those services. (3) The measures taken under paragraph (1) must, having regard to the state of the art, ensure a level of security of network and information systems appropriate to the risk posed. (4) Operators of essential services must have regard to any relevant guidance issued by the relevant competent authority when carrying out their duties imposed by paragraphs (1) and (2). The duty to notify incidents 11.—(1) An OES must notify the designated competent authority about any incident which has a significant impact on the continuity of the essential service which that OES provides (“a network and information systems (“NIS”) incident”). (2) In order to determine the significance of the impact of an incident an OES must have regard to the following factors— (a) the number of users affected by the disruption of the essential service; (b) the duration of the incident; and 9