[FINAL] It is the Government’s intent that the 14 principles should be relevant to all networks and information systems supporting the delivery of essential services, including Industrial Control Systems and other circumstances in which legacy equipment continues to play a central role. The principles carry no assumptions about how the required outcomes should be achieved. It is for the OES to determine the most appropriate security measures within their organisational context in discussion with the relevant Competent Authority. This approach will be carried through to the supporting guidance to be published by the NCSC. As a result of some of the specific responses concerning the wording of some of the individual principles, together with an internal process of review and improvement, changes have been made to the way some of the principles are stated and explained. The new version of the complete set of principles appears in Annex 3. A number of respondents raised concerns about how NIS will apply to their supply chains. It is the Government’s view that it is the Operator of Essential Service or Digital Service Provider’s responsibility to ensure (through whatever levers or contractual arrangements they have) that their suppliers have in place appropriate measures. NIS will not apply directly to suppliers and Competent Authorities will not be enforcing NIS requirements on the supply chain of Operators of Essential Service or Digital Service Providers. Guidance on ensuring the security of the supply chain is included in the NCSC guidance. The Government values the offers from responders to collaborate on the development of supporting guidance for NIS Directive security requirements. Following initial publication in January 2018 by the NCSC, there will be opportunities for those with a direct interest in the content of the guidance to provide views and comments to inform subsequent versions. Expectations on Operators and Competent Authorities There was a clear concern raised through the consultation regarding what would be expected of both Operators and Competent Authorities over the course of the first year and beyond, in relation to implementing the Directive. The Government can reassure both Operators and Digital Service providers that the approach of both the Government and Competent Authorities in implementing the requirements of the Directive will be realistic and will take into account the circumstances of each sector as appropriate. Competent Authorities will be expected to engage with their sectors and keep them informed about the approach they intend to take. Competent Authorities will take a reasonable and proportionate approach to enforcement and it is the Government’s expectation that the process of improving the security of Network and Information Systems of the UK’s essential services will take a number of years. Competent Authorities will seek to work collaboratively with industry and their focus for the initial phase is likely to be on developing a detailed picture of the current levels of security within their sector, possibly based on an initial self assessment, and in working with Operators to assess areas for further development. However, the Government wants to make clear that even in this first year, Competent Authorities will have the power to issue Page 10