[FINAL] challenges, determining what is a significant impact should be done on a sector-by-sector basis. Where necessary these thresholds can also be determined on a sub-sector or micro sector basis provided they are applied consistently to all operators in that sub or micro sector. As a minimum, the following parameters will be used: (a) the number of users affected by the disruption of the essential service; (b) the likely or actual duration of the incident; (c) the geographical spread (area affected by the incident); In addition to these three parameters, Competent Authorities may also use the following optional parameters: (d) the dependency of other sectors on the service provided by the affected entity; (e) the impact that incidents have, in terms of degree and duration, on economic and societal activities, public safety or national security; Whilst these additional parameters are optional per sector, if used, they should be applied to all operators within a sector, unless there are specific clear and justifiable reasons for divergence between jurisdictions. New structure As a result of feedback during the Consultation, the Government is amending its proposed incident reporting structure for NIS. This change is intended to separate incident response from incident notification. Incident response being considered primarily as a support function for Operators, where the Government can provide assistance, and incident reporting a more regulatory notification process. All NIS incidents (i.e. incidents that meet the parameters set out above and published by the Competent Authority) should be reported to the Competent Authority. The Competent Authority will then log the incident and decide if any follow up investigation is required. This will be a standalone process and will not form any part of the incident response. Voluntary reporting can be reported to either the Competent Authority or NCSC and is actively encouraged. If companies require incident response support, they should approach the NCSC for assistance on cyber related incidents (e.g. DDoS attacks, Malware, hacking etc.), and their Competent Authority or relevant Lead Government Department (depending on guidance) for non cyber or resilience incidents (e.g. hardware failure, fire, physical damage etc.). The was broad support for the Government’s proposal to apply a similar timescale of 72 hours to incident reporting as for GDPR, and the Government will maintain this approach. A number of respondents recommended that the wording of the reporting requirement be the same as well, which the Government sees merit in. The Government is therefore intending to use the wording ​“​without undue delay and, where feasible, no later than 72 hours after Page 12