24 [360] these Regulations apply to the relevant digital service provider in respect only of any digital service provided by it. (3) A digital service provider is deemed to have its main establishment in the State where its head office is in the State. Security measures to be taken by relevant digital service providers 21. (1) A relevant digital service provider shall identify and take appropriate and proportionate technical and organisational measures to manage the risks posed to the security of network and information systems used by it when offering a service set out in Schedule 2 in the Union. (2) The measures to be taken under paragraph (1) shall, having regard to the state of the art— (a) ensure a level of security of network and information systems appropriate to the risk posed, and (b) take into account the following in accordance with the Implementing Regulation: (i) the security of systems and facilities; (ii) incident handling; (iii) business continuity management; (iv) monitoring, auditing and testing; (v) compliance with international standards. (3) A relevant digital service provider shall take measures to prevent and minimise the impact of incidents affecting the security of its network and information systems on a service set out in Schedule 2 that is offered by it within the Union with a view to ensuring the continuity of the provision by it of that service. (4) A relevant digital service provider shall ensure that it has sufficient documentation to enable the competent authority to verify the compliance by the relevant digital service provider with the security requirements provided for in this Regulation. Incident notification by a relevant digital service provider 22. (1) A relevant digital service provider shall notify the CSIRT in accordance with paragraph (3) of any incident that has a substantial impact on the provision by it of a digital service set out in Schedule 2 which is offered by it within the Union. (2) Paragraph (1) shall not apply where a relevant digital service provider does not have access to the information required to assess the impact of an incident taking into account the matters referred to in paragraph (4).