20 [360] (a) review the Operators Register established by it on a regular basis and, in any event, not less than once in every two years from 9 May 2018, and (b) amend the Operators Register established by it in accordance with Regulations 14 and 15. (4) A copy of the Operators Register established by the competent authority referred to in Regulation 7(2) shall be furnished by it to the competent authority referred to in Regulation 7(1) as soon as possible after it has been established. (5) The competent authority referred to in Regulation 7(1) shall establish a Combined Operators Register which comprises the Operators Register established by that competent authority and the Operators Register furnished to it under paragraph (4) by the competent authority referred to in Regulation 7(2), as may be amended from time to time in accordance with Regulations 14 and 15. Security requirements in respect of operators of essential services 17. (1) An operator of essential services shall— (a) take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of the network and information systems which it uses in its operations, and (b) take appropriate measures to prevent and minimise the impact of incidents affecting the security of the network and information systems used by it for the provision of the essential services in respect of which it is designated as an operator of essential services with a view to ensuring the continuity of the provision by it of those services. (2) The measures to be taken by an operator of essential services pursuant to paragraph (1) shall ensure, having regard to the state of the art, a level of security of network and information systems appropriate to the risks posed. Incident notification by operators of essential services 18. (1) (a) An operator of essential services shall notify the CSIRT in accordance with paragraph (2) of any incident concerning it that has a significant impact on the continuity of an essential service provided by it in respect of which it is designated as an operator of essential services. (b) An operator of essential services who relies on a third-party digital service provider for the provision of an essential service in respect of which it is designated as an operator of essential services shall notify the CSIRT in accordance with paragraph (2) of an incident affecting the digital service provider which has a significant impact on the continuity of the essential service provided by the operator. (2) A notification in respect of an incident shall be made under paragraph (1) without delay after the incident occurs and, in any event, not later than 72 hours after the operator of essential services concerned becomes aware of the occurrence of that incident.