What it asks for. Competent authorities must have effective and proactive supervisory and enforcement powers over essential entities, including on-site inspections, off-site supervision with random checks, regular and targeted security audits by an independent body or the authority, ad hoc audits after significant incidents, security scans, and requests for information and evidence.
In practice. Enforcement powers include warnings, binding instructions, orders to bring measures into compliance or to inform affected persons, appointment of a monitoring officer, public statements on infringements and administrative fines. Where measures are ineffective, authorities can temporarily suspend certifications or authorisations and temporarily prohibit a person with managerial responsibilities at chief executive or legal representative level from exercising managerial functions. Management bodies can be held liable for breaches. Essential entities should be audit-ready at all times, with documented Article 21 measures, audit results and remediation tracking.
Common gaps. Entities often assume supervision is only triggered by an incident, and cannot quickly produce evidence of implemented policies when the authority requests it.