[FINAL] penalties where significant compliance issues have been discovered and it is evident that organisations are not making active efforts to remedy them. Operators will be in scope of the Directive if they meet the identification thresholds. Competent Authorities will be encouraged to write to their Operators in order to begin the process of working with Operators in order to help them assess their compliance. When assessing compliance with the Directive, Competent Authorities will take into account the amount of time that Operators have had to implement the requirements. Operators will be given time to implement the necessary security measures. The Government can reassure Operators that the main priority of Competent Authorities for the first year will be in obtaining a clear picture of the security of network and information systems in their sectors. Operators will be expected to have begun analysing their systems and existing security measures in order to understand where further work needs to be done, and to develop plans in order to reach the appropriate levels of security requirements. The NCSC’s Cyber Assessment Framework is likely to form the basis of these initial assessments of cyber security standards, both by Competent Authorities and Operators, although this will be dependent on the sector. The guidance published by the NCSC sets out the Government’s advice on how Operators can apply appropriate and proportionate technical and organisational measures in order to manage the risks posed to the security of network and information systems which they use in their operations. Where there is a need for sector specific guidance, to ensure the security of systems that may not fit into the broader guidance, Competent Authorities will work with Operators and the NCSC to develop this. Any sector specific guidance will be introduced in a reasonable and proportionate manner and Operators will be given time in order to implement any necessary measures. In relation to non-cyber security issues, such as resilience, the Government does not propose to change or replace existing standards and legislation that cover these issues. Operators of Essential Services will be directed by their Competent Authority to existing requirements and measures. 6. Incident reporting for operators of essential services The Government accepts that clearer guidance and actual thresholds to determine what a reportable incident is, are required if the NIS incident reporting systems is to work. Competent Authorities will calculate incident reporting thresholds for each sector and/or sub sector. It is the responsibility of the designated Competent Authority in each sector to publish the incident reporting thresholds that will apply under NIS. These will be published before May 2018. In order to define incident thresholds, Competent Authorities must determine what a significant impact would be in their sectors. It is the Government’s view that as each sector differs in terms of existing regulatory requirements, and faces different cybersecurity Page 11