[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F33":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","33","Article 33","Supervisory and enforcement measures in relation to important entities",0,"NIS2 Directive","**What it asks for.** For important entities, supervision is reactive. Competent authorities act when they receive evidence, an indication or information that an important entity allegedly does not comply with the Directive, in particular Articles 21 and 23.\n\n**In practice.** Supervisory powers include on-site inspections and off-site ex post supervision, targeted security audits, security scans, requests for information and access to data, documents and evidence of implemented cybersecurity policies. Enforcement powers include warnings, binding instructions, compliance orders, public statements and administrative fines. The stronger measures for essential entities, such as suspending authorisations or temporarily banning managers, are not listed for important entities. Important entities should still keep the same documentation and evidence as essential entities, since an incident report or complaint can trigger supervision.\n\n**Common gaps.** The main gap is treating ex post supervision as no supervision, leaving security measures undocumented until an incident exposes them.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_33","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]