NIS2 Article 32. Supervisory and enforcement measures in relation to essential entities

• (a)

  on-site inspections and off-site supervision, including random checks conducted by trained professionals;
• (b)

  regular and targeted security audits carried out by an independent body or a competent authority;
• (c)

  ad hoc audits, including where justified on the ground of a significant incident or an infringement of this Directive by the essential entity;
• (d)

  security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the entity concerned;
• (e)

  requests for information necessary to assess the cybersecurity risk-management measures adopted by the entity concerned, including documented cybersecurity policies, as well as compliance with the obligation to submit information to the competent authorities pursuant to Article 27;
• (f)

  requests to access data, documents and information necessary to carry out their supervisory tasks;
• (g)

  requests for evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence.

The targeted security audits referred to in the first subparagraph, point (b), shall be based on risk assessments conducted by the competent authority or the audited entity, or on other risk-related available information. The results of any targeted security audit shall be made available to the competent authority. The costs of such targeted security audit carried out by an independent body shall be paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise.

• (a)

  issue warnings about infringements of this Directive by the entities concerned;
• (b)

  adopt binding instructions, including with regard to measures necessary to prevent or remedy an incident, as well as time-limits for the implementation of such measures and for reporting on their implementation, or an order requiring the entities concerned to remedy the deficiencies identified or the infringements of this Directive;
• (c)

  order the entities concerned to cease conduct that infringes this Directive and desist from repeating that conduct;
• (d)

  order the entities concerned to ensure that their cybersecurity risk-management measures comply with Article 21 or to fulfil the reporting obligations laid down in Article 23, in a specified manner and within a specified period;
• (e)

  order the entities concerned to inform the natural or legal persons with regard to which they provide services or carry out activities which are potentially affected by a significant cyber threat of the nature of the threat, as well as of any possible protective or remedial measures which can be taken by those natural or legal persons in response to that threat;
• (f)

  order the entities concerned to implement the recommendations provided as a result of a security audit within a reasonable deadline;
• (g)

  designate a monitoring officer with well-defined tasks for a determined period of time to oversee the compliance of the entities concerned with Articles 21 and 23;
• (h)

  order the entities concerned to make public aspects of infringements of this Directive in a specified manner;
• (i)

  impose, or request the imposition by the relevant bodies, courts or tribunals, in accordance with national law, of an administrative fine pursuant to Article 34 in addition to any of the measures referred to in points (a) to (h) of this paragraph.

• (a)

  suspend temporarily, or request a certification or authorisation body, or a court or tribunal, in accordance with national law, to suspend temporarily a certification or authorisation concerning part or all of the relevant services provided or activities carried out by the essential entity;
• (b)

  request that the relevant bodies, courts or tribunals, in accordance with national law, prohibit temporarily any natural person who is responsible for discharging managerial responsibilities at chief executive officer or legal representative level in the essential entity from exercising managerial functions in that entity.

Temporary suspensions or prohibitions imposed pursuant to this paragraph shall be applied only until the entity concerned takes the necessary action to remedy the deficiencies or comply with the requirements of the competent authority for which such enforcement measures were applied. The imposition of such temporary suspensions or prohibitions shall be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including the right to an effective remedy and to a fair trial, the presumption of innocence and the rights of the defence. The enforcement measures provided for in this paragraph shall not be applicable to public administration entities that are subject to this Directive.

• (a)

  the seriousness of the infringement and the importance of the provisions breached, the following, inter alia, constituting serious infringement in any event:

  • (i)

    repeated violations;

  • (ii)

    a failure to notify or remedy significant incidents;

  • (iii)

    a failure to remedy deficiencies following binding instructions from competent authorities;

  • (iv)

    the obstruction of audits or monitoring activities ordered by the competent authority following the finding of an infringement;

  • (v)

    providing false or grossly inaccurate information in relation to cybersecurity risk-management measures or reporting obligations laid down in Articles 21 and 23;
• (b)

  the duration of the infringement;
• (c)

  any relevant previous infringements by the entity concerned;
• (d)

  any material or non-material damage caused, including any financial or economic loss, effects on other services and the number of users affected;
• (e)

  any intent or negligence on the part of the perpetrator of the infringement;
• (f)

  any measures taken by the entity to prevent or mitigate the material or non-material damage;
• (g)

  any adherence to approved codes of conduct or approved certification mechanisms;
• (h)

  the level of cooperation of the natural or legal persons held responsible with the competent authorities.