Each Member State shall designate one or more national competent authorities on the security of network and information systems ( competent authority ) , covering at least the sectors referred to in Annex II and the services referred to in Annex III .