if necessary on a confidential basis, as this would help to improve the accuracy and quality of the Commission’s assessment (see sections 4.1.5. and 4.1.6. of the Annex). Aligned approaches concerning security and incident notification requirements for OES In relation to obligations concerning security requirements and incident notifications for operators of essential services (Article 14(1), (2) and (3)), an aligned approach regarding the security requirements and incident notifications in order to facilitate the compliance of OESs across EU Member State borders, would promote to the greatest extent possible a single market effect. The reference here remains the work on a guidance document within the Cooperation Group (see sections 4.2. and 4.3. of the Annex). In case of a large scale cyber incident affecting several Member States, it is very likely that a mandatory incident notification is submitted by an OES or DSP pursuant to article 14(3) and 16(3) or by another entity which is not in the scope of the Directive on a voluntary basis pursuant to article 20(1). In line with the Commission Recommendation on Coordinated Response for Large-Scale Cybersecurity incidents and crises, Member States could consider aligning their national approaches so that they can provide as soon as possible, relevant information based on those notifications to the competent authorities or the CSIRT of other Member States concerned. Accurate and actionable information would be vital for reducing the number of infections or addressing vulnerabilities before they are exploited. In the spirit of partnership in making the most from the NIS Directive, the Commission intends to extend support under the Connecting Europe Facility to all relevant stakeholders under this legislation. While the focus has been on CSIRT capacity building and on an enabling platform for swift and effective operational co-operation, thereby re-enforcing the CSIRT Network, the Commission will now explore how funding under Connecting Europe Facility can also benefit national competent authorities as well as operators of essential services and digital service providers. Conclusion In view of the impending deadline for the transposition of the NIS Directive into national legislation by 9 May, 2018, and in view of the deadline for the identification of operators of essential services by 9 November, 2018, Member States should take appropriate measures to ensure that the provisions and the cooperation models of the NIS Directive can provide the best possible EU-level tools to achieve a high common level of security of network and information systems across the Union. The Commission invites Member States to consider in this process the relevant information, guidance and recommendations contained in this Communication. This Communication may be further supplemented by other actions, including those generated through ongoing work within the framework of the Cooperation Group. 6