2018. Enforcement powers under the NIS Regulations allow Authorised Officers of the NCSC to conduct security assessments and audits in 5 of the 7 sectors (the Central Bank of Ireland retains responsibility for the application of security measure to the Financial Services sectors), and require the provision of information and issue binding instructions to remedy any deficiencies. The NCSC has also prepared detailed guidance documents relating to security measures, compliance and incident reporting to provide additional support to the OES, which were published for public consultation in January 2019. For the purposes of this document Critical National Infrastructure is defined as “… an asset, system or part thereof located in Member States which is essential for the maintenance of vital societal functions, health, safety, security, economic or social well-being of people, and the disruption or destruction of which would have a significant impact in a Member State as a result of failure to maintain those functions.” The aim of Government is to secure our CNI from attack by mandating that measures are taken by operators to manage risks to this infrastructure, including by having appropriate incident response plans in place to cope with any disruption to services. The progressive dependence of Critical National Infrastructure and services on network connected devices has led to the State taking a series of measures to ensure the resilience of certain categories of critical national infrastructure. However, given the nature and extent of the risk, and because of developing technologies, this system needs to be further developed and expanded. To that end, Government will take the following measures to further protect Critical National Infrastructure and services; Key Developments 1. The Critical Infrastructure Protection methodology set out in the EU NIS Directive has been implemented. 2. This has resulted in the designation of Operators of Essential Services across 7 key sectors, and the commencement of a series of formal assessments of readiness by Operators. 3. The introduction of tailored information sharing mechanisms to share sensitive information with key Operators. 6.2 Objective To identify and protect critical national infrastructure by increasing its resilience to cyber attack and by ensuring that operators of essential services have appropriate incident response plans in place to reduce and manage any disruption to services. 26