(1) In order to assess whether a person should be an OES, a designated competent authority may serve an information notice in writing upon any person requiring that person to provide it with all such information as it reasonably requires to establish whether -

(a) a threshold requirement described in Schedule 2 is met; or

(b) the conditions mentioned in regulation 8(3) are met.

(2) A designated competent authority may serve an information notice in writing upon an OES requiring the OES to provide it with all such information as it reasonably requires for one or more of the following purposes -

(a) to assess the security of the OES's network and information systems;

(b) to establish whether there have been any events that the authority has reasonable grounds to believe have had, or could have, an adverse effect on the security of network and information systems and the nature and impact of those events;

(c) to identify any failure of the OES to comply with any duty set out in these Regulations;