Article 33Supervisory and enforcement measures in relation to important entities
1. When provided with evidence, indication or information that an important entity allegedly does not comply with this Directive, in particular Articles 21 and 23 thereof, Member States shall ensure that the competent authorities take action, where necessary, through ex post supervisory measures. Member States shall ensure that those measures are effective, proportionate and dissuasive, taking into account the circumstances of each individual case.
2. Member States shall ensure that the competent authorities, when exercising their supervisory tasks in relation to important entities, have the power to subject those entities at least to:
(a) on-site inspections and off-site ex post supervision conducted by trained professionals;
(b) targeted security audits carried out by an independent body or a competent authority;
(c) security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the entity concerned;
(d) requests for information necessary to assess, ex post, the cybersecurity risk-management measures adopted by the entity concerned, including documented cybersecurity policies, as well as compliance with the obligation to submit information to the competent authorities pursuant to Article 27;
(e) requests to access data, documents and information necessary to carry out their supervisory tasks;
(f) requests for evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence.
The targeted security audits referred to in the first subparagraph, point (b), shall be based on risk assessments conducted by the competent authority or the audited entity, or on other risk-related available information.
The results of any targeted security audit shall be made available to the competent authority. The costs of such targeted security audit carried out by an independent body shall be paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise.
3. When exercising their powers under paragraph 2, point (d), (e) or (f), the competent authorities shall state the purpose of the request and specify the information requested.
4. Member States shall ensure that the competent authorities, when exercising their enforcement powers in relation to important entities, have the power at least to:
(a) issue warnings about infringements of this Directive by the entities concerned;
(b) adopt binding instructions or an order requiring the entities concerned to remedy the deficiencies identified or the infringement of this Directive;
(c) order the entities concerned to cease conduct that infringes this Directive and desist from repeating that conduct;
(d) order the entities concerned to ensure that their cybersecurity risk-management measures comply with Article 21 or to fulfil the reporting obligations laid down in Article 23, in a specified manner and within a specified period;
(e) order the entities concerned to inform the natural or legal persons with regard to which they provide services or carry out activities which are potentially affected by a significant cyber threat of the nature of the threat, as well as of any possible protective or remedial measures which can be taken by those natural or legal persons in response to that threat;
(f) order the entities concerned to implement the recommendations provided as a result of a security audit within a reasonable deadline;
(g) order the entities concerned to make public aspects of infringements of this Directive in a specified manner;
(h) impose, or request the imposition by the relevant bodies, courts or tribunals, in accordance with national law, of an administrative fine pursuant to Article 34 in addition to any of the measures referred to in points (a) to (g) of this paragraph.
5. Article 32(6), (7) and (8) shall apply mutatis mutandis to the supervisory and enforcement measures provided for in this Article for important entities.
6. Member States shall ensure that their competent authorities under this Directive cooperate with the relevant competent authorities of the Member State concerned under Regulation (EU) 2022/2554. In particular, Member States shall ensure that their competent authorities under this Directive inform the Oversight Forum established pursuant to Article 32(1) of Regulation (EU) 2022/2554 when exercising their supervisory and enforcement powers aimed at ensuring compliance of an important entity that is designated as a critical ICT third-party service provider pursuant to Article 31 of Regulation (EU) 2022/2554. with this Directive.
NIS2, the European Union directive on network and information security, Article 33
How important entities are supervised. The difference from Article 32 is when authorities act. Where an authority has evidence, indication or information that an important entity may not be complying, in particular with Articles 21 and 23, Member States must ensure it takes action, where necessary, through ex post measures. The regular audits, ad hoc audits and random checks listed for essential entities in Article 32 are not on the list for important entities.
The minimum supervisory powers are: on-site inspections and off-site ex post supervision; targeted security audits; security scans; and requests for information, for access to data and documents, and for evidence of implementation. An independent body’s targeted audit is paid for by the audited entity unless the authority decides otherwise in a substantiated case.
The minimum enforcement powers largely follow Article 32(4): warnings, binding instructions or orders to remedy, orders to stop infringing conduct, orders to comply with Articles 21 and 23, orders to inform people potentially affected by a significant cyber threat, orders to follow audit recommendations, public disclosure, and fines under Article 34. There is no monitoring officer, and binding instructions do not list incident-prevention measures or time-limits. Nor are the suspension and managerial-ban powers of Article 32(5) listed. Article 32(6) to (8) apply here too, so liability of those in charge, the factors for choosing a measure, and reasoned decisions carry over.
These are minimum powers. Articles 21 and 23 apply to both classes alike; the difference is supervisory posture, not the duty.
What is in the packs for this
From NIS2 Implementation & Readiness. Each one helps with this requirement.
NIS2 Readiness Self-AssessmentExcel
Readiness item SV-01 rates whether the evidence a supervisor of an important entity may ask for is ready.
Management Body Cybersecurity Accountability RecordWord
The record applies the same accountability of the management body and those responsible to important entities.
NIS2 Documentation & Evidence ChecklistExcel
The Supervisor Requests sheet lists what an authority may ask of an important entity, and each checklist item names the record that answers it.
NIS2 Gap & Remediation TrackerExcel
Priority 2 gaps are those a supervisor of an important entity would find when acting on evidence or an indication of a breach, and the Summary applies the same accountability to important entities.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.