Article 32(4) and (5) NIS2 enforcement measures: evidence

What Article 32(4) and (5) enforcement measures mean for essential entities

For an essential entity, the enforcement toolkit under Article 32(4) and (5) is the set of powers a national competent authority can use when it finds that the entity is not meeting its Article 21 risk-management or Article 23 reporting duties. The powers start with a warning and binding instructions with deadlines, and can escalate to orders to stop the infringing conduct, orders to bring measures into compliance, orders to implement audit recommendations, and orders to publish aspects of the infringement. Authorities can also appoint a monitoring officer with defined tasks for a set period. The most severe steps, suspending a certification or authorization for the entity's services and requesting a temporary management ban, are available only where earlier measures have proven ineffective and a set deadline has passed. For that reason, the practical question for management is not which penalty is possible but at which step the authority will be entitled to move next. The Article 32(8) step matters because it is the last point at which the entity can shape the outcome before a measure is adopted. Before adopting enforcement measures, the authority must notify its preliminary findings and allow reasonable time for observations, unless immediate action is needed. A well-prepared response at that stage should set out the facts, the evidence, the remediation already underway and a realistic timetable. Ask counsel and your supervisor what the authority's procedure for observations looks like, how long a response window is in your Member State, and who in the organization is authorized to respond within it.

Two problems make this stage hard in practice. The first is evidence that is not held in one place. Risk assessments, policy approvals, patch records, access reviews, incident logs and supplier assessments often sit in separate tools and teams, so producing a coherent answer within the response window takes days that the entity does not have. The second is deadlines that were not tracked. A binding instruction carries a deadline, and the escalation logic depends on whether that deadline was met. An entity that cannot show when each instruction was received, what was done, and by whom, gives the authority grounds to treat the failure as ineffective remediation. As a near-term action, build a single register of open authority requests, binding instructions and their deadlines, with a named owner for each. Then check that the evidence for each Article 21 and Article 23 measure can be exported on short notice. Confirm the response window and escalation procedure with your national authority or counsel, because the timing and sequence depend on national transposition law and the authority's own procedure.

Which entities and situations trigger these enforcement measures

The Article 32(4) and (5) toolkit applies to essential entities under ex ante supervision, while important entities fall under the ex post regime in Article 33. Escalation toward suspension or a management ban follows specific conduct, not the size of the entity alone, so the cards below cover the classification and the triggers that move a case forward.

Essential entity classification as the trigger

Article 32 powers apply to entities classified as essential under Article 3, which covers entities in the Annex I sectors that meet the size thresholds and entities designated regardless of size. Classification determines which supervisory regime applies from the start. Confirm the classification with your national competent authority and check how your Member State transposed the rule, because the authority decides which regime applies to you.

Important entities under the ex post regime

Important entities face the same Article 21 and Article 23 duties but are supervised ex post, meaning authorities usually act after evidence of non-compliance appears. Article 33 sets out their powers, which differ in scope and sequence from the essential regime. Do not assume the Article 32 toolkit is unavailable to your authority, and check the national law that implements Article 33 for your entity type.

Unremedied deficiencies after binding instructions

Failure to remedy deficiencies after binding instructions is a listed serious infringement under Article 32(7)(a). This is the most common path to escalation: an authority first issues instructions with deadlines, then considers suspension or a management ban if the deadline passes without correction. Track every instruction, its deadline and the evidence of closure in one register.

Missed significant incident notifications

Failure to notify or remedy significant incidents is a serious infringement under Article 32(7)(a). Authorities treat missed Article 23 reporting as a conduct issue, separate from the technical quality of your controls. Confirm the reporting thresholds and timelines in your national law and test that your team can meet them outside business hours.

Obstruction of audits and information requests

Obstructing audits, inspections or security scans is listed as a serious infringement under Article 32(7)(a). Inspections can be on-site or off-site and may include random checks. Staff should know who may grant authority access, where evidence is stored and how to respond to requests for audit results, so that a delayed answer is not read as obstruction.

False or grossly inaccurate information

Providing false or grossly inaccurate information about Article 21 or Article 23 compliance is also a serious infringement. Self-assessments, gap analyses and evidence packs must match what the systems actually do. Assign an owner to review each submission before it leaves the organization, and record who approved it.

How the escalation ladder works in practice

The enforcement ladder under Article 32 starts with the least intrusive tools and only moves upward when the entity does not fix the problem. An authority can begin with a warning or a binding instruction that sets a deadline for the entity to bring its Article 21 risk-management measures or Article 23 reporting into line. Further steps include orders to stop the infringing conduct, orders to implement recommendations from a security audit, and orders to publish aspects of the infringement. For an essential entity, the practical lesson is that a finding can escalate quickly if the first instruction is ignored, so the first deadline deserves the same board-level attention as a fine. Confirm with your national competent authority how it records instructions and deadlines, and who in your organization receives them.

The most severe steps in Article 32(5) carry a double condition. The authority may only consider suspending a certification or authorization for the entity's services, or requesting a temporary management ban, if earlier measures have proven ineffective and the deadline set for remedying the deficiencies has passed without action. Authorities are expected to document both conditions, so an entity should keep a dated record of every instruction received, every remediation step taken and every extension it requested. Note that these measures are triggered by a failure to act on prior orders, not by the finding itself. Check which of your services depend on a certification or authorization, because a suspension would reach those services directly.

A monitoring officer is the authority's own tool for watching a remediation program over a fixed period. Under Article 32(4)(g), the authority may appoint an officer with defined tasks to oversee the entity's compliance with Articles 21 and 23 for a set time. In practice, the entity should expect the officer to ask for progress evidence, test whether fixes work, and check reporting readiness. Ask the authority in writing for the officer's mandate, reporting lines, the length of the appointment and the evidence it expects. Prepare a single evidence register that maps each instruction to its control owner, its deadline and its proof, so that remediation can be shown without rebuilding the record under pressure. Implementation partners can help assemble that register, but the entity remains accountable for the response.

How a supervisor tests compliance before enforcement

This table shows how a national competent authority moves from a suspicion to an established infringement, the evidence it typically requests at each step, and the findings that most often lead to binding instructions. Read it as a sequence: the earlier an entity can produce clear, current evidence, the less likely a supervisor is to move to formal enforcement steps. Preliminary findings and observations are the point where the entity can still correct the record.

Test stage	What the supervisor does	Evidence requested and common findings
Information request	Asks the entity to state how it meets Article 21 and Article 23 obligations, often with a deadline	Current risk assessment, policy set, asset inventory, named management body approval; findings include outdated or missing documents and answers that do not match practice
Audit results and security scans	Reviews audit reports, penetration test results or scan output the entity holds or that the authority commissions	Dated scan and test reports with tracked remediation; findings include open high-severity items past their target dates and no evidence of retest
Incident and reporting records	Checks whether significant incidents were notified within the Article 23 timelines and handled as described	Incident log, early warning and notification copies, timestamps; findings include late or missing notifications and no record of a decision on significance
Evidence of control operation	Tests whether documented measures run in practice, often on site or through a sample	Access review records, patch and change logs, backup restore tests, training attendance; findings include policies with no operating records
Preliminary findings	Notifies the entity of suspected infringements before adopting measures, except where immediate action is needed	Written findings with stated grounds; the entity may submit observations within the time the authority allows, so the response should cite evidence
Observations and remediation	Considers the entity's observations and any corrective actions already taken	Remediation plan with owners, dates and proof of closure; findings can be resolved here if the evidence is credible and timely
Trigger for binding instructions	Issues binding instructions with deadlines where a measure is missing or ineffective	Common triggers include unresolved gaps after prior feedback, obstructed audits, inaccurate statements about Article 21 or 23 compliance, and unremedied deficiencies

How to prepare so enforcement never reaches the escalation stage

This sequence builds the ownership, evidence and response habits that let an essential entity answer supervisors early, so that warnings and binding instructions get closed out before authorities consider monitoring officers, certification suspension or a temporary management ban. Each step produces a record that a supervisor can test.

Map Article 21 and 23 obligations to named owners
Start by listing every Article 21 risk-management measure and every Article 23 reporting duty as a row in a single obligations register. For each row, name one accountable owner inside the organization, a backup, and the evidence location. Management should approve the register because the management body carries oversight under Article 20. The step is done when every obligation has an owner who has accepted it in writing and a pointer to where its evidence lives. A supervisor who asks who runs a control should get a name and a file within minutes.
Set a register of supervisory requests and deadlines
Create one log that records every information request, audit notice, security scan notice, warning or binding instruction received from the national competent authority. Each entry should capture the date received, the requested evidence, the deadline stated by the authority, the owner, and the status. Route all supervisory correspondence through a single mailbox or ticket queue so nothing sits with an individual. The step is complete when a tabletop test with a sample letter shows the item reaching the owner and appearing in the log without manual chasing. Confirm with your national authority which channels it uses for formal notices.
Establish a process to act on binding instructions
Write a short procedure for what happens when an authority issues a binding instruction with a deadline or an order to bring Article 21 measures or Article 23 reporting into compliance. The procedure should assign a remediation owner, convert each instruction into tracked actions, set interim checkpoints, and define how progress is reported back to the authority. Include a escalation path to the management body so decisions on funding or resource conflicts are made by people with authority. The output is a remediation plan per instruction, each with evidence of closure reviewed by someone other than the implementer.
Prepare a response to preliminary findings
Article 32(8) requires authorities to notify preliminary findings and allow reasonable time for observations before adopting most enforcement measures, except where immediate action is needed. Prepare a template response package that includes the factual record, the scope of systems affected, the control evidence available, and a candid statement of gaps with remediation dates. Legal counsel should review the template before it is needed. Ask your counsel to confirm the observation period and format under your national transposition law. The step is done when a sample set of findings can be answered from the register and the evidence library within the working window your counsel has confirmed.
Document the factors authorities weigh
Article 32(7) asks authorities to weigh duration, prior infringements, damage, intent or negligence, mitigation, adherence to approved codes or certification mechanisms, and cooperation. Build a short file that shows how the organization has performed against each factor: incident history, prior correspondence, evidence of mitigation steps taken, and records of cooperation with the authority. Keep it current rather than assembling it under pressure. The output is a dated factor file that a responsible officer can hand to counsel or the authority, showing where the organization stands on each factor.
Rehearse management body oversight
Hold a scheduled session in which the management body reviews the obligations register, the supervisory request log and the remediation status, and works through one simulated warning or binding instruction. Members should decide who signs responses, what budget is released, and when the matter goes to the authority's attention. Record the decisions and the attendance. This rehearsal supports the oversight duties in Article 20 and shows that leadership understands its role before a real case arrives. The step is complete when minutes record the decisions and each open action has an owner and date.
Test the sequence and refresh it on change
Run a tabletop exercise that moves a fictional but realistic-sounding authority letter (labeled as illustrative in the exercise pack) through every step: logging, assignment, remediation, response to preliminary findings and management review. Time how long each handoff takes and fix the gaps the exercise exposes. Repeat the test when the obligations register changes, when a new system enters scope, or when national transposition rules are updated. The output is a dated exercise report with corrective actions, which is the evidence that the escalation path works as designed.

Which infringements the authority treats as serious

Authorities treat it as serious when a significant incident is not notified, or is notified but not remedied. The concern is not only the single failure, but whether the entity had a working process for detecting, classifying, reporting and recovering from incidents. Supervisors will ask for the process as it operated on the day, not as it was written. Records that show the entity was able to meet its Article 23 duties are the main protection here.

Detection and triage logs: timestamps showing when an alert was raised, who classified it, and why it was or was not treated as significant.
Reporting clock records: a timeline against the 24-hour early warning, 72-hour notification and one-month final report obligations.
Remediation tickets: evidence that the root cause was addressed and the fix verified, not just closed.
Notification decision memos: short written reasons for each decision not to notify, approved by a named role.
Exercise reports: results of tabletop or live drills showing the reporting path was tested before it was needed.

Before relying on any of these, confirm with your competent authority which incident criteria apply to your sector, since the thresholds in Implementing Regulation (EU) 2024/2690 depend on the entity type.

Evidence that shows the entity is acting in good faith

Article 32(7) asks authorities to weigh how long an infringement lasted, whether it was intentional or negligent, and how the entity responded. The cards below describe the records that answer those questions, and they only help if they are kept current between inspections, not assembled the week a supervisor arrives.

Dated record of infringement duration

Keep a log that records when each gap was first identified, when a fix was scheduled, when it was completed and who approved the closure. Authorities weigh how long an infringement lasted, so a short, documented window with a known end date reads very differently from an open item with no owner. Check that every entry in the log has a timestamp that matches the change or ticket system it refers to, and that open items carry an owner and a target date.

Previous infringement and corrective action register

Maintain a register of earlier findings, incidents and supervisory instructions, with the corrective action taken for each and the evidence that it worked. Authorities consider previous infringements, so the register should show whether a repeat issue is genuinely new or a recurrence of something already closed. Check that each entry links to the evidence of closure, not only to a status field marked complete.

Mitigation and risk treatment records

Record the interim measures taken while a deficiency is being fixed, such as compensating controls, restricted access, added monitoring or temporary segmentation. Mitigation measures are weighed directly, so the record should state the risk being reduced, the control applied and the date it went live. Confirm that interim measures were reviewed and retired or made permanent, rather than left running indefinitely without an owner.

Decision records showing intent or negligence

Keep records of who knew about a risk, what they decided and why, and whether the decision went to the management body. Authorities distinguish intentional from negligent conduct, and the strongest defense is a documented, reasoned decision that was reviewed on schedule. Check that risk acceptances are signed, time-limited and reported to management, and that no known gap was left unrecorded because it was inconvenient to report.

Certification and code of conduct evidence

Hold current copies of any certificates, attestations or approved codes of conduct the entity relies on, together with their scope statements and validity dates. Adherence to approved codes of conduct or certification mechanisms is a factor authorities weigh, but a certificate only counts for what it covers. Confirm with the issuing body or your auditor which systems and services are in scope, and whether any certificate has lapsed or been suspended.

Cooperation and audit responsiveness log

Log every information request, inspection, scan and monitoring officer interaction, with the date received, the response given and the time taken to answer. Cooperation is weighed, and delays or incomplete answers are easily noticed in this kind of log. Between inspections, run a periodic drill that asks for a sample of this evidence and measure how quickly it can be produced, then fix any gaps before a supervisor asks.

What responding to enforcement costs in money and effort

This table lists the cost components an entity meets when a supervisor issues a binding instruction, a monitoring officer or a compliance order, and marks which costs are one-time and which recur. Use it to see who is paid for what, what drives effort up, and what to request in a written partner quote. No fee or duration figures are stated because none are supplied for this topic.

Cost component	Who carries it	One-time or recurring	What drives it
Internal management time	Management body and executives	One-time for the response, recurring while the monitoring period runs	Number of open instructions, deadlines set by the authority, and how many board meetings are needed to approve remediation
Legal review	Internal counsel or external law firm	One-time for each instruction or order, plus review of observations	Whether the authority has notified preliminary findings, and how much the entity wants to contest or negotiate the wording
Remediation engineering	Internal IT and security teams or an implementation partner	One-time for the fix, recurring for operating controls the authority requires	Gap size against Article 21 measures, system count, and whether systems are self-hosted or run in shared environments
External assessment of remediation	Independent assessor or auditor, engaged by the entity	One-time per verification cycle, repeated if the authority requests new evidence	Scope of the instructions, number of deficiencies to verify, and whether the authority accepts the assessor's method
Monitoring officer support	The entity, which supplies staff time, access and evidence to the designated officer	Recurring for the period the officer is designated	Length of the designated period, frequency of requests, and the volume of evidence each request needs
Reporting and evidence production	Internal compliance team or partner	Recurring while reporting obligations under Article 23 remain open	Quality of logs and records, how quickly evidence can be exported, and how many reporting channels are involved
Consequences of delay	The entity	Recurring until deadlines are met	Each missed deadline can trigger the next step in the enforcement sequence, so schedule slippage raises every other line

Who owns the response and what a partner can prepare

The management body remains accountable for the organization's cybersecurity measures and for how it responds to supervisory action. Enforcement measures such as binding instructions, monitoring officers and, in the most serious cases, a temporary management ban fall on the people who run the entity, so these decisions cannot be delegated to a vendor. Management is also the audience that authorities expect to see approving the response to findings and funding the remediation.

Approval of remediation: Management approves the plan, budget and deadlines for any corrective action the authority orders.
Oversight of deadlines: Management tracks each binding instruction against its stated deadline and receives regular status reports.
Decisions on disclosure: Management decides how the entity cooperates with the authority, including requests to publish aspects of an infringement.
Training and record keeping: Management keeps evidence of its own oversight, such as minutes and attendance at required cybersecurity training.
Escalation: Management decides when preliminary findings require outside legal or regulatory counsel.

Check whether your board minutes show decisions on the authority's findings, not only general updates on cybersecurity.

Where entities usually fall short before supervisors act

Most enforcement under Article 32(4) and (5) does not start with a dramatic breach. It starts with ordinary gaps that an authority can see in a request for information: deadlines that slip, evidence that cannot be found, and decisions nobody owns. The cards below cover the gaps we see most often, each with the closing action that removes it before a supervisor asks.

No deadline tracking for binding instructions

A binding instruction carries a deadline, and missing it is one of the conditions that moves a case toward suspension or a management ban. Many entities record the instruction in an email or ticket and never convert the deadline into a tracked item with an owner. Check that every instruction, audit recommendation and order has a named owner, a due date, and a written status that the management body reviews. Close it by logging each deadline in a single register with automated reminders well before it falls due.

Evidence scattered across tools

When a supervisor asks for proof that a measure works, the answer often sits in five systems: a ticketing tool, a patch console, a vulnerability scanner, a cloud log store and a shared drive. Each system may hold part of the story, and no one can assemble it on request within the deadline set by the authority. Check whether you can produce, for any Article 21 measure, the policy, the configuration, the test result and the log entry from one indexed location. Close it by mapping each measure to its evidence source and exporting a dated evidence pack on a fixed schedule.

No process for preliminary findings

Before adopting enforcement measures, an authority must notify its preliminary findings and allow reasonable time for observations, unless immediate action is needed. Entities that have no intake process for these notices often miss the window to respond, or respond informally without legal review. Check who receives regulator correspondence, how it reaches the accountable executive, and how the response deadline is calculated under the national law. Close it by writing a short procedure that routes any authority notice to legal and the security lead within one working day and records each response.

Unclear management accountability

Enforcement tools reach beyond the entity itself. Authorities can request a temporary management ban where earlier measures have failed, so the question of who approves and oversees Article 21 measures is a real exposure for individuals as well as the organization. Check whether the management body minutes show approval of the risk-management measures, review of incident and audit results, and completed cybersecurity training. Close it by assigning each Article 21 measure to a named executive and recording the management body's oversight in its minutes at a set frequency.

Remediation without a verified closure

Teams often mark a finding as fixed when the change is deployed, but supervisors look for proof that the deficiency is gone. A patch that was pushed without a retest, or a configuration change without a recorded check, does not show that an order to bring measures into compliance has been met. Check that each remediation item links to a retest result, the person who verified it, and the date of verification. Close it by requiring an independent retest, or a second-person check, before any finding is closed in the register.

Weak record of cooperation

Authorities weigh cooperation, mitigation and the entity's conduct when they decide which measure to apply and how severe it should be. Entities that cannot show when they reported a problem, what they did next, and how they engaged with the authority often receive harsher treatment than their conduct warranted. Check whether your incident and correspondence logs record timestamps, decisions and the reasons behind them. Close it by keeping a contemporaneous log of every authority contact and every decision to mitigate, with the reasoning written at the time.

Questions buyers ask about NIS2 enforcement measures

How much does it cost to prepare for NIS2 enforcement measures?

No supplied source gives a price for NIS2 preparation, so no figure is stated here. The cost comes from four components: internal staff time, external assessors, technical work to close gaps, and recurring operations such as monitoring, patching, backups and evidence collection. Internal time is usually the largest share because management, IT and security staff must own the Article 21 measures. External spend depends on how many systems are in scope and how far current controls are from the Article 21 requirements. Ask any provider for a fixed-scope quote that lists each system, each deliverable, who performs each task and which items recur after go-live. Ask the national authority or your sector regulator which evidence it expects, since that determines the work.

How long does remediation take when an authority sets a deadline?

The deadline comes from the binding instruction itself, not from a general rule, so the first step is to read the instruction and note its exact date, scope and required evidence. Duration depends on how many findings are open, whether fixes need procurement or architecture changes, and how much evidence must be produced after the fix. Quick configuration changes can close quickly, while items such as identity redesign, logging platforms or supplier contract changes take longer. Plan backward from the deadline: triage findings, assign owners, fix the highest-risk items first, test each fix and record the evidence. If the deadline cannot be met, request an extension in writing before it passes, because Article 32(5) escalation depends on earlier measures being ineffective after the deadline.

Can an entity respond to NIS2 enforcement measures without outside help?

Yes, the obligations sit with the entity, and an organization can respond with its own staff. The management body remains accountable under Article 20 for approving and overseeing the measures, so leadership must own the response. Internal teams usually need outside help where they lack hands-on experience with the required technical controls, where the deadline is short, or where they need an independent view before presenting evidence. Outside help can take several forms: an implementation partner can prepare systems and evidence, while an independent assessor or auditor issues any formal report. Decide early which tasks stay in-house, such as accountability decisions and authority communication, and which are contracted in a written scope.

What does a NIS2 monitoring officer require from the entity?

A monitoring officer is appointed by the authority for a set period to oversee compliance with Articles 21 and 23 at an essential entity. The officer's tasks and reporting lines are defined by the authority's decision, so the entity should read that decision closely and ask for written terms. In practice, expect requests for current risk assessments, policy documents, asset inventories, incident records, reporting procedures, evidence of remediation progress and access to responsible staff. Prepare a single evidence index that maps each request to an owner and a location, and keep records consistent with what the authority has already seen. Confirm with the authority how it expects evidence to be delivered and how often it expects updates.

Can a partner act on the entity's behalf before an authority?

A partner cannot take over the entity's legal obligations or represent it as the accountable party unless the entity grants that role under its own governance and the applicable national law allows it. Implementation partners such as DeployOpen prepare systems, controls and evidence within a written scope, and the entity remains responsible for its statements and decisions. Any formal assessment, certificate or audit report comes from an independent auditor or certification body, not from the implementation partner. Before engaging anyone, ask who will sign correspondence, who attends authority meetings, and which person in the entity holds final accountability. Confirm these points with the national competent authority and your legal counsel.

What evidence should we prepare before an authority inspection?

Prepare evidence that shows the Article 21 measures are designed, implemented and operating, not only documented. Typical items include the approved risk assessment, the policy set, the asset and network inventory, access review records, vulnerability and patch records, backup restore tests, incident response exercise reports and supplier assessments. Each item should show a date, an owner and a link to the control it supports. Authorities also weigh cooperation and mitigation, so keep a dated log of findings, actions and communications. Confirm the expected format with your national competent authority, because requirements vary by Member State and sector.

What happens if our remediation plan is rejected by the authority?

A rejected plan means the authority considers the proposed actions insufficient, so the entity should treat the feedback as a formal input and respond in writing. Ask the authority to specify which element is inadequate, whether scope, timing, evidence or technical content. Revise the plan to address each point, assign owners and set dates that the entity can defend. Under Article 32(8), the authority must notify preliminary findings and allow reasonable time for observations before adopting measures, except where immediate action is needed, so use that window to present a complete response. Keep records of every exchange with the authority.

Which NIS2 enforcement costs recur after the deadline?

Recurring costs usually continue after the authority is satisfied, because NIS2 expects ongoing operation of the measures. Common recurring items include security monitoring, vulnerability scanning, patch management, backup testing, log retention, training for management body members, periodic risk reviews and incident reporting readiness. The size of these costs depends on the number of systems, the hours of coverage needed and whether the entity runs tools in house or buys a service. Ask any provider to separate one-time implementation work from recurring retainers and to state which tasks each covers. Confirm with the national authority how often it expects reviews and evidence updates.

How DeployOpen prepares systems and evidence for supervisory scrutiny

DeployOpen works as an implementation partner on fixed-scope engagements. Before work starts, the scope, deliverables and timelines are agreed in writing. For the enforcement measures under Article 32(4) and (5), that work typically means preparing the self-hosted open-source systems inside your own infrastructure so they can produce the evidence a national competent authority may request: configuration baselines, access records, logging and monitoring output, backup and recovery tests, patch and vulnerability records, and the documented Article 21 measures they support. DeployOpen does not issue findings, attestations or certifications. The competent authority decides whether an infringement exists, which measure applies and when it is lifted.

When an authority issues a binding instruction with a deadline, or an order to bring Article 21 measures or Article 23 reporting into compliance, the decisive questions are what the instruction requires, which system and control it touches, and what proof of remediation the authority will accept. A useful first step is to map each instruction to a named owner, a technical change, a written procedure and an evidence item, then confirm the deadline with counsel. DeployOpen can then implement or harden the affected systems, document the changes and run the tests that generate the evidence. Ask any partner to show, before signing, which of those outputs they will deliver and which the organization must still approve internally.

Your management body keeps ownership of the response. It approves the remediation plan, accepts residual risk and answers to the authority, including any monitoring officer appointed for a set period. Confirm in the scope document who receives authority correspondence, who signs off evidence packs, and how preliminary findings and observation periods will be tracked, since those steps come before any enforcement measure is adopted. Ask any partner to state in writing which outputs it delivers, what the client must retain, and that the findings and the enforcement decision remain with the authority.

Article 32(4) and (5) Enforcement measures