Both DSPs and OES are now held accountable for reporting major security incidents to Computer Security Incident Response Teams (CSIRT).[19] While DSPs are not held to as stringent regulations as operators of essential services, DSPs that are not set up in the EU but still operate in the EU still face regulations. Even if DSPs and OES outsource the maintenance of their information systems to third parties, the NIS Directive still holds them accountable for any security incidents.[20]