4.1.7. Cross-border consultation process. Where an operator provides essential services in two or more Member States, Article 5(4) requires that those Member States engage in consultation with each other before the completion of the identification process. The purpose of this consultation is to facilitate the assessment on the critical nature of the operator in terms of cross-border impact. The desired outcome of the consultation is that the involved national authorities exchange arguments and positions and ideally come to the same result concerning the identification of the operator concerned. However, the NIS Directive does not preclude Member States reaching divergent conclusions whether a particular entity is identified as OES or not. Recital 24 mentions the possibility for Member States to request the assistance of the Cooperation Group in that matter. In the Commission’s view, Member States should strive to reach a consensus on these issues to avoid a situation that the same company is facing different legal status in various Member States. Divergence should be truly exceptional e.g. when an entity determined as OES in one Member State has a marginal and insignificant activity in another one. 4.2. Security requirements. Pursuant to Article 14(1), Member States are required to ensure that OES, having regard to the state of art, take appropriate and proportionate technical and organisational measures to manage the risk posed to the security of network and information systems which the organisations use in the provision of their services. In accordance with Article 14(2), appropriate measures shall prevent and minimise the impact of an incident. A dedicated work stream of the Cooperation Group is currently working on non-binding guidelines concerning the security measures for OES32. The guidance document is to be finalised by the Group by Q4 of 2017. The Commission encourages Member States to follow closely the guidance document to be developed by the Cooperation Group so that national provisions on security requirements would be aligned to the extent possible. Harmonisation of such requirements would greatly facilitate compliance by OES which often provide essential services in more than one Member State and the supervision tasks of national competent authorities and CSIRTs. 4.3 Notification requirements. Pursuant to Article 14(3), Member States have to ensure that OES notify “any incident having a significant impact on the continuity of the essential services”. Consequently, the OESs should not notify any minor incidents but only serious incidents affecting the continuity of the essential service. As an incident, Article 4(7) defines “any event having an actual adverse 32 For the purpose of this work stream, lists of international standards, good practices and risk assessment/management methodologies for all sectors covered by the NIS Directive were circulated and were used as input for the proposed security domains and security measures 30