each Member State11. They usually include strategic principles, guidelines, objectives, and in some cases specific measures for mitigating risks associated with cybersecurity. Given that some of these strategies were adopted prior to the adoption of the NIS Directive, they may not necessarily contain all the elements of Article 7. To ensure correct transposition, Member States will need to undertake a gap analysis by mapping the content of their NCSS to the seven distinct requirements listed in Article 7 across the scope of sectors listed in the Directive’s Annex II and services listed in Annex III. Identified gaps can then be addressed through a revision of their existing NCSS or by deciding on a complete revision of the principles of their national NIS strategy from scratch. The guidelines provided above regarding the process for adoption of NCSS are also relevant for the revision and update of existing NCSS. 11 This information is based on the overview of NCSS https://www.enisa.europa.eu/topics/national-cyber-security-strategies/ncss-map 9 provided by ENISA at