[FINAL] 3. Essential services The consultation responses highlighted concerns by a large proportion of respondents that the identification thresholds, used to define who is in scope of the requirements of the Directive, required greater clarity. Lead Government Departments have been refining these thresholds, so that they are clearer and so that companies can identify with certainty whether they are in scope of the Directive. Revised thresholds are attached at ​Annex 1​. When considering these thresholds, the Government has taken into account the requirements of the Directive as set out in Article 5 (Identification of Operators of Essential Services) and Article 6 (Significant Disruptive Effect). All the parameters set out in these two Articles were taken into account, although the Government focused on those that were most relevant for each sector in order to identify key operators. The thresholds set out in the consultation and this response are the result of that work. A number of respondents questioned what systems controlled by an Operator would be in scope. The thresholds in Annex 1 are not intended to identify the systems that are in scope of the Directive (which will be the responsibility of the Operator in discussion with the Competent Authority), only the Operators of Essential Services. Identifying the systems that support the services will need to be carried out by the Operators, as part of understanding how they can comply with the security requirements. A number of respondents called on the Government to broaden the scope of the Directive to include additional sectors, such as Government, Chemicals, Food and Agriculture, or other entities beyond those listed in the Directive. At this stage, the Government’s priority is to maintain the Directive’s scope in terms of the sectors and entities to which it relates and not ‘gold-plate’ our implementation by including additional sectors at this time. The Government intends to conduct a post-implementation review three years after the legislation comes into effect and this review will consider the effectiveness of the regulations. A decision to extend the scope of the regulation would be considered at that time. A number of respondents asked questions about the reserve power to designate operators that do not meet the identification threshold for their sector. This reserve power is only intended to be a limited tool for use where specific operators do not meet the identification threshold (column four of the table at Annex 1), but whom the Government believes there is a compelling case that this should be within scope. The Government considers that it is essential to have a power to designate operators to ensure that essential services are protected without imposing unnecessary regulatory burdens on other organisations. In any use of this power, the Operator will still need to meet the sector, subsector and essential service requirements (columns 1 to 3 of the table at Annex 1). This power cannot be used to designate an entity who does not meet those requirements. The Government only intends to use the reserve power where there are valid reasons on the grounds of: ● national security; Page 6

Select target paragraph3