[FINAL] where possible for investigations, assessing penalties etc. However, there will sometimes be a need for divergence between sectors, and Competent Authorities will have the flexibility to adapt their approach to reflect the needs of their sector. Where an Operator falls under the jurisdiction of more than one Competent Authority, the Competent Authorities are encouraged to cooperate with each other, to ensure that they do not put an unnecessary burden on the Operator or make conflicting demands. However, they will retain responsibility for their jurisdiction and the Operator will have to engage with both Competent Authorities. A number of responses raised concerns about the risk of infringing more than one piece of legislation at a time. This risk is unavoidable, as Operators will be required to comply with a wide range of legislation, not all of them linked or in similar fields. If an infringement occurs that breaches more than one piece of legislation, Competent Authorities will be required to have regard to this and where possible discuss the best approach with other regulators, but they will remain free to undertake their own response to any infringement, provided that it is appropriate and proportionate. 5. Security requirements for operators of essential services Security requirements and high level principles Given the broad level of support for the proposed approach to NIS security requirements based on outcome-based principles and supporting guidance, the Government does not intend to make any fundamental changes of approach. In relation to the 14 Principles (See ​Annex 3​), the Government recognises the need for some additional detail to assist organisations when they are taking decisions about implementing security measures. Some of this additional detail is available on the ​NCSC website​ where the supporting guidance is published, and it is expected that the initial version of the NIS Cyber Assessment Framework (CAF), planned for publication in Spring 2018, will provide further clarity. It is expected that determinations on acceptable levels of cyber security will be made by Competent Authorities through use of the CAF. The Government remains committed to an outcome-based approach to implementing the NIS Directive and, consequently, the statements of security requirements will, necessarily, always leave room for judgements to be made within the context of an organisation’s risk management approach. While the Government acknowledges the value of some established cyber security standards, it believes that there is no single existing standard that adequately covers NIS Directive security requirements for operators of essential services. However, in order to ensure some consistency in approach the 14 principles have been based around existing global standards and guidance. Page 9