6 Critical National Infrastructure Protection 6.1 State of Play Until relatively recently, accepted best practice in Europe for the protection of critical national infrastructure and services against cyber-attack involved two types of actions, (1) the creation of a national incident response function such as the NCSC, and (2) instituting formal information sharing arrangements whereby information relating to threats to this infrastructure could be shared with owners and operators, including urgent information relating to imminent threats. The NCSC established and still runs precisely these services and has worked, on an ongoing basis, with utility operators and with similar bodies in other jurisdictions to manage risks to Critical National Infrastructure in Ireland, including the active management of ongoing incidents. However, experience over time across Europe and elsewhere has made it clear that there is a risk asymmetry between the public interest and that of many operators of this type of infrastructure. In many cases, critical services remained vulnerable despite comprehensive attempts by Government to provide information and support to operators. As such, and building on work underway in some EU Member States and on previous Directives in Telecommunications, the European Commission published a draft of the ‘Network and Information Security Directive’ in 2013. This NIS Directive, which was formally agreed in 2016, included a series of measures aimed at improving the resilience of Critical National Infrastructure across 7 different sectors (including energy, transport, drinking water, banking, financial markets, healthcare and digital infrastructure). These measures include requiring Member States to formally assess their infrastructure, and legally designate so called ‘Operators of Essential Services’ – those entities that are critical to the provision of these services in each State. Moreover, these entities are required to be made subject to a formal set of security requirements, and to a binding incident reporting requirement. As such, the NIS Directive aims to (a) compel improvements in the security and resilience of Critical National Infrastructure, and (b) improve State awareness of cyber security incidents across Europe, and (c) allow for greater consistency and coordination of response at an EU level. The 2015 strategy was written in anticipation of the NIS Directive, and detailed work was underway from before the Strategy was complete on a detailed assessment of Critical National Infrastructure in Ireland, which included an Infrastructure Interdependency Study with the UK (completed mid in 2017). These assessments were then used to derive a national list of Operators of Essential Services (OES), which were formally designated following the transposition of the NIS Directive in Ireland in September 2018 by S.I. 360 of 25