(30)The risk-based approach should be applied by all water suppliers, including small water suppliers, as the evaluation of Directive 98/83/EC showed deficiencies in its implementation by those suppliers, which were sometimes due to the cost of performing unnecessary monitoring operations. When applying the risk-based approach, security concerns should be taken into account.