indistinguishable from Nation States in that they sometimes deploy advanced techniques to infect and compromise networks and data. Lastly, at the top of this pyramid, are those State sponsored entities, usually military or security organisations, seeking to use network and information systems to conduct operations ranging from the exfiltration of data to the destruction of physical infrastructure. These threat actors, usually referred to as ‘advanced persistent threats’ (or APTs) have been shown to be involved in attacks across a wide range of sectors, but with a particular focus on Government IT systems, telecommunications networks, financial services and technology companies. The resources at their disposal, their persistence and their expertise mean that that these entities pose a very particular challenge, they are difficult to detect and difficult to remove and therefore pose a serious and ongoing challenge to the security of network and information systems. Historically, States could hope to secure both Critical National Infrastructure and public sector systems and data by securing a very small number of key installations. They could make laws to prohibit parties using their territories for illicit purposes or activities, and they could use physical borders as a means of defending against external threats. None of these measures are as effective in the digital age. Moreover, for practical and legal reasons, Governments generally do not have visibility of, or cannot secure, the vast range of devices in their territory or the traffic flowing to and from them. This is because networks are privately owned, as are both connected devices and a very large proportion of critical national infrastructure. For much of the period until 2016, the approach taken by many National Governments has been to support organisations by providing information as to threats and to risk mitigation measures, and by providing an incident response function. In Ireland, the signing into law of the 2018 Network and Information Security Regulations (S.I. 360 of 2018) has resulted in a far more proactive approach to the protection of Critical National Infrastructure, including the formal identification of operators, and the commencement of a programme of security measures that include assessments and audits of compliance, in line with measures being taken across Europe. These will, over time, result in an increase in the resilience of these key services against attack or incident. Risks remain however, both in those sectors covered by the NIS Regulations and outside of these. In the first instance, the adherence to the security measures in the NIS Regulations is a risk reduction methodology, not a guarantee of absolute security. Secondly, the NIS Directive and Regulations are explicitly limited to seven named sectors. Both the assessment of Critical National Infrastructure carried out by the NCSC during the designation process and 16