[FINAL] scalable, but may include services such as email or online storage providers, where the resources are scaleable. Since the consultation was launched, the European Commission has published a draft Implementing Act, which set out the security measures and incident reporting thresholds that DSPs will need to comply with. However, at the time of writing this response, this Implementing Act has yet to be agreed by Member States and remains only as a draft. The Government is committed to carrying out a further targeted consultation once Implementing Act is approved by Member States. This consultation will be limited to how the UK proposes to implement and carry out the requirements of the Implementing Act as neither the UK nor any other Member State will have flexibility to amend the Implementing Act once it has been agreed. The Government’s approach is likely to be based around ensuring consistency with the Single Market, so that Digital Service Providers can have a consistent approach in regard to security standards measures across the UK and the Single Market, and is likely to follow the guidance published by the European Network and Information Systems Agency (ENISA). The Government understands that these measures will involve costs to Digital Service Providers, but believes that there is a strong public and national benefit from improving the security of the UK’s Digital Service Providers. The Government will try to minimise these costs where possible, through applying consistency in approach to EU partners and other existing compatible reporting regimes, and ensuring that Digital Service Providers only have to report to a single point. The Government can reassure Digital Service Providers that both it, and the Competent Authority will approach implementation of the NIS Directive in a reasonable fashion. Companies will be given time to implement the requirements of the Directive. 8. Penalty regime The Government received significant feedback on its proposed penalty regime. The Government’s priority in considering an appropriate penalty regime was to improve the cyber security of UK, and considers the aim of an effective penalty regime is to provide a mechanism to enforce this. The Government believes that an appropriate penalty regime should be significant enough to incentivise a change in behaviour while remaining proportionate. There are different considerations that apply to different sectors when considering the appropriate level of penalty - for example, what is suitable for the Health sector might not be suitable for the energy sector, and vice versa. There will be consistency in how a Competent Authority should approach fines - Competent Authorities must be reasonable, appropriate, and proportionate, take account of mitigating factors when considering penalties, and consider fines only as a last resort. However, it should also be noted that what will be considered a proportionate penalty will vary between sectors and that Competent Authorities Page 15