[FINAL] ● ● a potential threat to public safety; or the possibility of significant adverse social or economic impact resulting from a disruptive incident. 4. National framework The Government notes that there was broad support for our proposed multiple Competent Authority approach. The Government intends to maintain this approach. Work on finalising the list of Competent Authorities is ongoing, as the Government ensures that the Competent Authorities have adequate legislative powers to carry out their duties and adequate resources to carry out their functions. An updated list of proposed Competent Authorities is at ​Annex 2​. The Competent Authorities listed are subject to final confirmation and the definitive list of Competent Authorities will be included in the NIS Regulations. A number of responses called for a greater role for the National Cyber Security Centre (NCSC) in regulating the NIS Directive and in providing support to Operators and Competent Authorities. The Government notes the regard that industry have for the expertise of the NCSC and that part of the NCSC’s role is to be the UK’s centre of excellence on all cyber security matters. The NCSC is central to the successful implementation of NIS. The Government is clear that there must be a clear separation of powers between the NCSC and Competent Authorities. This will allow NCSC to carry out its role in providing expert advice and incident response capability to cyber attacks. It is also a long standing Government policy that Lead Government Departments take responsibility for all risks including Cyber. Having NCSC as the regulator for NIS would be inconsistent with this and existing regulatory frameworks for broader Critical National Infrastructure security. Under the UK’s implementation of the NIS Directive the NCSC will undertake the advisory role of the Computer Security Incident Response Team (CSIRT). It will not be able to, or seek to, enforce actions on Operators or Digital Service Providers. We believe this is important to maintain the close working relationships that have been built between industry and government in dealing with cyber issues. The NCSC will also be the Technical Authority for cyber security, publishing guidance and assessment tools for use by both the Competent Authority and Operators. The NCSC will draw up a framework setting out exactly the level of support that they will provide to Competent Authorities. The Government accepts that there is a need for extra clarification on the role of the Competent Authority and how Competent Authorities will interact with each other and across other regimes such as GDPR. The Government aims to publish further guidance before May 2018 to assist Competent Authorities to carry out their functions. Role of the Competent Authority Page 7