How national competent authorities supervise essential entities ex ante and important entities ex post, the enforcement measures available, the Article 34 maximum fines, and the interplay with GDPR fines.
The ex ante supervisory powers over essential entities: on-site and off-site inspections with random checks, regular, targeted and ad hoc security audits, security scans and requests for evidence such as audit results.
The ex post regime for important entities: when authorities act, the supervisory and enforcement powers available, and how they differ from those for essential entities.
The enforcement toolkit: warnings, binding instructions, compliance orders, monitoring officers, publication of infringements, suspension of certifications and temporary management bans, and the factors authorities must weigh.
The maximum administrative fines for infringing Articles 21 or 23: at least EUR 10 million or 2% of worldwide turnover for essential entities and at least EUR 7 million or 1.4% for important entities, plus periodic penalty payments.
How NIS2 enforcement interacts with the GDPR when an infringement of Article 21 or 23 involves a personal data breach, including the rule against double fines for the same conduct.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.