Article 7 b)), PT (maximum 1 year of imprisonment for the offence of Article 3), SE (maximum 1 year of imprisonment for the offence of "infliction of damage") and SI (maximum 1 year of imprisonment for the offences of Articles 3, 6 and 7). In the case of BE, the minimum level of the maximum penalty for Articles 3, 6 and 7 is only reached when the offences are committed with fraudulent intent. cc) A significant number of information systems affected Article 9(3) raises the minimum level of the maximum penalties to 3 years of imprisonment when a significant number of information systems is affected by an offence referred to in Articles 4 and 5. In general, Member States have introduced corresponding legislation, DE refers only to information systems "which are of substantial importance to another", FI requires the assessment of the offence "as a whole" to apply the higher term of penalty, and LV does not refer to a significant number of information systems (or a similar wording), but only to causing "substantial harm". The information provided by BG and SI was not conclusive. dd) Criminal organisations According to Article 9(4)(a), a minimum term of 5 years of a maximum penalty of imprisonment applies for the offences under Articles 4 and 5 when committed by a criminal organisation as defined in Framework Decision 2008/841/JHA. Again, most Member States comply with the provision of Article 9(4)(a). Under the criminal law of LU and SI, the provisions for an offence committed by a criminal organisation do not cover cybercrimes. BE`s legislation provides a maximum term of only 3 years of imprisonment for offences referred to in Article 5, DE`s legislation does not cover natural persons as victims of the offences, FI`s legislation requires an additional assessment of the offence "as a whole" and SE`s legislation provides a maximum penalty of 4 years of imprisonment for "gross infliction of damage". ee) Serious damage caused Article 9(4)(b) determines 5 years as the minimum term for the maximum penalty of imprisonment for any offence referred to in Articles 4 and 5 if serious damage is caused. Although there is no definition of what should be considered as serious damage, all Member States except BG, DE, FI, HU, LU and SE have introduced legislation which corresponds to the Directive. The information provided by HU was not conclusive. BG does not reach the minimum 5-year level of the maximum penalty, while LU refers to a general penalty clause for causing serious damage which does not cover any cybercrimes. There are minor discrepancies in DE (natural persons as victims of the offences not covered), FI (higher penalty requires additional assessment of the offence "as a whole") and SE (maximum of 4 years of imprisonment for "gross infliction of damage"). ff) Critical infrastructure information systems The involvement of critical infrastructure information systems in offences referred to in Articles 4 and 5 also lead to a minimum of 5 years of the maximum penalty of imprisonment, as stated in Article 9(4)(c). While most Member States comply with this provision, BG provided no specific transposition information. BE has set a maximum 3-year term for offences of Article 5. DE does not cover natural persons as victims. FI requires an additional assessment of the offence "as a whole", IT requires actually causing "destruction", PT requires an attack in a "severe and lasting manner" and does not refer to Article 5, and SE meets the Directive`s requirements only for the offence of "gross sabotage". 9