The section focuses on how the NIS Directive enhances Member States' preparedness by requiring to have effective national competent authorities and Computer Security Incident Response Teams (CSIRTs). More precisely, the section covers the obligation to designate national competent authorities including the role of the single point of contact. It discusses three topics: (a) possible national governance structures (e.g., centralised, de-centralised models, etc.) and other requirements; (b) the role of the single point of contact and (c) Computer Security Incident Response Teams. 3.1. Type of authorities. Article 8 of the NIS Directive requires Member States to designate national competent authorities on security of networks and information systems, while explicitly recognising the possibility to designate 'one or more national competent authorities'. Recital 30 of the Directive explains this policy choice: "In view of the differences in national governance structures and in order to safeguard already existing sectoral arrangements or Union supervisory and regulatory bodies, and to avoid duplication, Member States should be able to designate more than one national competent authority responsible for fulfilling the tasks link to the security of the network and information systems of operators of essential services and digital service providers under this Directive". Accordingly, Member States are free to choose to appoint one central authority dealing with all sectors and services covered by the Directive or several authorities, depending for example on the type of sector. When deciding on the approach, Member States can draw on the experience from the national approaches used in the context of the existing legislation on critical infrastructure protection (CIIP). As described in Table 1, in the case of CIIP, Member States decided to adopt either a centralised or a decentralised approach when assigning competences at national level. National examples are used here for illustrative purposes only and with a view to bringing existing organisational frameworks to the attention of Member States. Hence, the Commission does not imply that the model used by respective countries for CIIP should be necessarily used for the purpose of transposition of the NIS Directive. Member States may also opt for various hybrid arrangements involving elements of both centralised and decentralised approaches. The choices can be made in alignment with prior national governance arrangements for the various sectors and services covered by the Directive, or newly determined by the authorities concerned and by the relevant stakeholders identified as operators of essential services and digital service providers. The existence of specialist expertise on cyber security, resourcing considerations, the relations between the stakeholders and national interests (for example economic development, public security etc.) may also be important factors leading to the choices made by Member States. 3.2 Publicity and additional relevant aspects. Pursuant to Article 8(7), Member States need to inform the Commission about the designation of national competent authorities and their tasks. This must be done by the transposition deadline. 11

Select target paragraph3

Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents