What Article 34 fines mean for NIS2 entities
For essential entities, NIS2 sets a maximum administrative fine of at least EUR 10 million or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. For important entities the figures are at least EUR 7 million or at least 1.4%, again whichever is higher. These amounts are floors for the maximum, not fixed fines: Member States must allow ceilings at least this high, and national laws may set higher ones. Because turnover is measured for the undertaking the entity belongs to, a group's exposure can exceed what the subsidiary's own accounts suggest. Boards should ask counsel which national transposition law applies and what ceiling it sets, since that figure, not the EU floor, is the number that matters.
The fine is triggered by failing the Article 21 risk-management duties or the Article 23 reporting duties, not by the occurrence of an incident. A breach that happens to an entity with a documented, tested and functioning program is a different supervisory question from one where the entity cannot show that it assessed risk, applied the required measures or reported on time. Fines also sit alongside other tools: authorities may issue warnings, binding instructions and compliance orders, and may apply periodic penalty payments to force an entity to stop an infringement. NIS2 creates no certificate of compliance, so there is no pass or fail outcome to point to. Exposure comes from supervisory findings, which is why the evidence an entity keeps for each Article 21 measure matters as much as the controls themselves.
A practical next step is to ask two questions of the business: which Article 21 and Article 23 obligations would an authority test first in your sector and Member State, and what evidence would you produce within days if asked. Treat the fine ceiling as a planning input for board risk appetite, and confirm the figures with your national competent authority or legal adviser before relying on them. Independent auditors and assessors can test whether the evidence supports the claims, but they do not issue a NIS2 certificate, and the organization remains accountable for proving its own compliance.
Who the Article 34 ceilings apply to and how turnover is measured
The Article 34 ceilings depend on two decisions made before any fine is calculated: whether the entity is essential or important, and which turnover figure applies. Each card below isolates one of these decisions and the internal question your team must answer for it.
Essential or important under Article 3
The classification sets which ceiling applies. Essential entities face the higher maximum for infringing Article 21 or 23, while important entities face a lower one. Classification is not a self-declared label: confirm which Annex I or Annex II sector and entity type you fall under, and whether your national law places you in the same category. Ask: which category does our national authority assign us to, and is that documented in writing?
Whole undertaking turnover
Turnover is measured for the undertaking the entity belongs to, not only the legal entity that is in scope. A subsidiary inside a larger group may therefore face a fine calculated on group revenue. Map your corporate structure, including parent companies and controlled affiliates, before estimating exposure. Ask: which group entities share control with us, and who holds the consolidated revenue figure?
Preceding financial year basis
The percentage applies to total worldwide annual turnover in the preceding financial year, so the figure used is fixed by the last closed year, not the year of the infringement or the year of the decision. Finance and legal should agree which accounts will be used and how group revenue is consolidated. Ask: which closed financial year would a regulator use today, and do our accounts reconcile to that figure?
Higher of the fixed amount or percentage
The ceiling is the higher of the fixed amount and the turnover percentage, so for large groups the percentage usually drives the maximum. For smaller groups the fixed floor may be the operative figure. Both figures are minimums that national law may raise. Ask: at our turnover, which figure is higher, and has our national transposition law set a ceiling above these minimums?
Public administration under Article 34(7)
Each Member State decides whether and to what extent public administration entities can be fined. A public body in scope may therefore face a different enforcement route from a private company, including no monetary fine at all. Confirm the rule in your national transposition law and in the penalty rules notified to the Commission. Ask: does our national law allow fines against public administration bodies, and what other measures apply instead?
What supervisors test before a fine is imposed
A fine under Article 34(4) or Article 34(5) follows only from an infringement of Article 21 (risk-management measures) or Article 23 (incident reporting). The fine ceiling is therefore not the starting point. The starting point is whether the entity can show, for each Article 21 measure and each reporting duty, that it met the obligation. Supervisors reach that finding through the supervision regimes, and the work an organization does before any fine is the work of preparing for those tests. Before budgeting for an assessment, confirm which of the measures in your national transposition law apply to your entity, because the way a competent authority tests them depends on the entity's classification.
The two regimes differ mainly in timing. For an essential entity, supervision is ex ante under Article 32, so authorities may inspect, audit and request evidence before any incident occurs. For an important entity, supervision is ex post under Article 33, so authorities usually act once they have evidence of non-compliance, for example after an incident, a complaint or a referral. An essential entity should expect that its evidence set will be reviewed on a schedule it does not control. An important entity should expect scrutiny to arrive suddenly, so its evidence must already exist and be current when the request comes. Ask your counsel which national authority supervises you and how it has described its own procedure.
A fine does not replace other measures. Authorities can impose fines in addition to binding instructions and orders to bring conduct into line, and Member States may provide periodic penalty payments to make an entity stop an infringement. In practice, a finding of non-compliance often starts with a corrective instruction with a deadline, and the fine question arises if the deadline is missed or the gap was serious. Plan for that sequence: track each corrective instruction as a dated work item with an owner, and keep the evidence that shows closure. For the full set of enforcement powers and the factors authorities weigh, see the Article 32(4) and (5) enforcement measures page.
How an assessor or supervisor tests the conduct behind a fine
This table compares what a competent authority typically checks for each duty that can lead to a fine under Article 34, what evidence it usually asks for, and where entities most often fall short. Read it as a preparation checklist, and confirm the exact procedures and document requests with your national competent authority, since they vary by Member State.
| Duty under review | What the supervisor usually asks for | Common findings |
|---|---|---|
| Risk-management documentation (Article 21) | A current risk analysis, the policies that follow from it, and evidence that they cover the ten minimum measures in Article 21(2) | Policies exist but are generic, not tied to the entity's own systems, or not reviewed since adoption |
| Implementation of the measures | Configuration records, access reviews, backup and recovery test results, vulnerability management records and supplier security arrangements | Measures described on paper but not operating, or evidence that covers only part of the in-scope systems |
| Incident reporting timeliness (Article 23) | Incident logs with detection and decision timestamps, copies of the early warning, notification and final report, and records of who approved each submission | Reports sent after the deadlines, no record of the significance assessment, or inconsistent facts across submissions |
| Management body approval records (Article 20) | Minutes or written approvals of the risk-management measures, evidence of oversight, and training records for management body members | No documented approval, approvals that predate the current measures, or training that cannot be shown |
| Remediation of earlier findings | The findings register, dated corrective action plans, evidence of closure, and any binding instructions issued earlier | Known gaps left open past agreed dates, or fixes reported as complete without supporting evidence |
| Evidence integrity and retention | Records that are complete, dated, version-controlled and retrievable on request within the time the authority sets | Logs overwritten or missing, documents edited without version history, or evidence that cannot be produced promptly |
How to reduce fine exposure in practice
This sequence moves from confirming who is in scope to proving, with dated evidence, that the Article 21 and 23 duties are met and kept met. Each step ends with a document or check the organization can show a competent authority.
Confirm classification and jurisdiction first
Decide whether the organization is an essential or important entity, which Annex I or Annex II sector applies, and which Member State has jurisdiction. The fine ceilings in Article 34 depend on this classification, so the answer drives the whole program. Legal counsel should confirm the size-cap analysis and whether a sector-specific law displaces NIS2 for any service. The output is a signed classification memo that names the competent authority and records the turnover figure used for the fine calculation. Confirm with national counsel how the transposition law in each relevant Member State applies, since national ceilings may be set higher than the Article 34 floors.
Map Article 21 and 23 duties to owned controls
Take each Article 21(2) measure and each Article 23 reporting duty and assign it to a named owner inside the organization. Management remains accountable for approving the measures under Article 20, so the map should show which controls are owned internally and which are delivered by a supplier or implementation partner. The output is a control register that links every obligation to a policy, a control owner, a system in scope and a review date. Gaps found during mapping go into the remediation log described in the final step.
Close gaps against Implementing Regulation 2024/2690
Where the organization is one of the service types covered by Implementing Regulation (EU) 2024/2690, such as a DNS, cloud, data center, managed service or online platform provider, compare each control with the technical and methodological requirements in its annex. Use ENISA's June 2025 technical guidance as a non-binding reference for the evidence examples it describes. Organizations outside those service types should still use the regulation as a benchmark for what a supervisor is likely to expect. The output is a gap assessment with a priority, an owner and a target for each gap, reviewed by the management body.
Build dated evidence for each control
For every control in the register, collect evidence that shows the control existed, operated and was reviewed at a known date. Typical items include approved policies, access review records, patch and vulnerability reports, backup restore tests, supplier assessments and training completion records for management body members. Evidence should be exported from the systems that generate it and stored with timestamps, so that it can be produced quickly during an inspection or information request. The output is an evidence library indexed by control, where each item shows its date, owner and the period it covers.
Rehearse the reporting process end to end
Run a tabletop exercise that follows a simulated significant incident from detection through the early warning, the incident notification and the final report under Article 23. Include the people who would notify the competent authority and the service recipients, and check that the deadlines in the plan match the researched 24-hour, 72-hour and one-month intervals. Where a personal data breach may be involved, include the GDPR notification path as well. The output is an exercise report listing what worked, what failed and who owns each correction. Label any scenario used for the exercise as illustrative.
Set a remediation log for findings
Record every finding from audits, tests, exercises and supervisory contact in one log with a severity, an owner, a planned fix and a verification step. Closing a finding should require evidence that the fix works, not only a change ticket. Management should review the log at regular intervals and record its decisions, since a documented, overseen remediation process is the clearest sign to a supervisor that the entity is trying to stop an infringement before it escalates. The output is a current remediation log with closure evidence attached to each closed item and a record of management review.
When NIS2 and GDPR fines hit the same incident
Article 35 of NIS2 governs infringements that also involve a personal data breach, and it is the provision to read before assuming two regulators can each fine the same conduct. NIS2 fines under Article 34 attach to infringements of Article 21 (risk management) or Article 23 (reporting). GDPR fines are a separate regime with their own ceilings and their own supervisory authority. A single incident can therefore produce findings under both laws, and the national authority handling each side may differ. Confirm with counsel how your Member State has transposed the Article 35 rule against double fines for the same conduct, and whether it applies to your sector and entity type.
Start by mapping each likely finding to the authority that would own it. A missing patch cycle or an absent access review is usually an Article 21 question for the NIS2 competent authority. A late or incomplete notification to the data protection authority, or a failure to document a breach, is a GDPR question. Some facts will fall under both, such as a delayed incident report that also concealed a personal data breach. Write this map down before an incident, and agree with counsel which regulator you would notify first and how the two notification clocks run in parallel, since the NIS2 early warning and the GDPR 72-hour window are measured separately.
Keep one incident record that serves both authorities. In practice this means a single timeline with timestamps for detection, classification, the NIS2 early warning, notification and final report, and the GDPR breach assessment and notification decision, plus the evidence behind each entry. Assign an owner who can answer questions from either authority and make sure the record shows which Article 21 measures were in place at the time. Ask your counsel and any outside incident responder to confirm that the record is held under privilege where appropriate, and that copies sent to one regulator are consistent with what the other receives.
Evidence that shows an entity is managing its NIS2 duties
Article 34 fines follow from infringing Article 21 or Article 23, so the question a supervisor asks is whether the entity can show its risk-management and reporting duties are running, not whether it holds a document. The six artifacts below are the records that demonstrate this, and each one only counts if it is dated, owned and kept current between audits.
Board-approved risk management policy and minutes
The management body must approve the Article 21 measures and oversee their implementation, so the policy needs a signed approval and minutes that show the board discussed it. Check that the approval date, the version and the approving body appear on the document, and that minutes record a review at least once a year and after any significant incident. A policy the board never saw is weak evidence under Article 20 and undermines the rest of the file.
Risk register with dated reviews
The register links each identified risk to an asset, an owner, a rating and the Article 21(2) measure that treats it. Supervisors look for reviews with dates and a change history, which show the register reflects current systems rather than a snapshot taken for an audit. Confirm that each risk has a named owner and that accepted risks carry a recorded approval.
Control implementation records
For each measure, keep records that show the control was configured and operated: change tickets, configuration exports, access reviews and test results with timestamps. A control described in a policy but without operating records is hard to defend in an inspection. Sample a few controls each quarter and confirm the record can be traced to the system it describes.
Incident reporting logs with timestamps
Article 23 deadlines are measured from awareness, so the log must record when the entity became aware, when the early warning, notification and final report were sent, and who approved each step. Timestamps should come from synchronized systems and be stored in a tamper-evident form. Run an exercise to confirm the log captures these fields before a real incident tests it.
Supplier assessments
Supply chain failures are a common source of incidents, so supervisors expect records showing that suppliers, including managed service providers and cloud providers, were assessed before onboarding and reassessed when their services change. Keep the questionnaire responses, the risk rating, the contract clauses on incident notification and the date of the last review. Confirm that each critical supplier has an assessment that is less than a year old or has a documented reason for a longer interval.
Remediation tracking
Findings from audits, scans, tests and incidents need an owner, a due date and a closure record. Supervisors compare open findings with the time the entity has had to fix them, so an aging backlog with no escalation is itself a warning sign. Track each item to verified closure and keep the evidence that the fix works, not only that a ticket was closed.
What a fine-proof NIS2 program costs to run
The table compares the main cost components of running a NIS2 program that can show supervisors compliance with Article 21 and Article 23, and marks whether each is paid once or recurs. Use it to see who is paid for what, what drives each cost up or down, and what to put in a written quote. No fee levels are given because none are supplied; the fine exposure in Article 34 makes the cheapest option a poor benchmark.
| Cost component | One-time or recurring | What drives it up or down |
|---|---|---|
| Internal staff time for governance and reporting | Recurring | Management body briefings, policy reviews, and how many people must produce evidence each cycle |
| Tooling and licenses | Recurring, with some one-time setup | Number of sites, asset count, log volume, and whether open-source tools reduce license lines |
| External testing and security audits | Recurring, with a one-time baseline | Scope of systems tested, testing frequency, and whether prior ISO 27001 evidence can be reused |
| Legal review of national transposition | One-time, then periodic updates | Number of Member States where the group operates and how often national rules change |
| Remediation engineering | One-time for gaps, recurring for upkeep | Size of the gap analysis findings, legacy systems, and supplier dependencies |
| Implementation partner services | Mostly one-time, plus optional retainers | Fixed-scope deliverables agreed in writing, number of sites, and existing documentation quality |
Who owns fine exposure and who can help
The management body and the internal compliance team own the Article 21 measures, the approvals behind them and the decisions that determine whether an infringement occurs. Under Article 20, management bodies must approve and oversee the risk-management measures and can be held liable for infringements, so fine exposure starts with their decisions on budget, risk acceptance and accountability. The internal team turns those decisions into owned controls, named risk owners and evidence that a supervisor can read without a guided tour.
- Control ownership: Named owners for each Article 21 measure, with documented scope, frequency and escalation paths.
- Approvals and risk acceptance: Written sign-off by the management body on the risk assessment, residual risks and resourcing.
- Incident decisions: Internal authority to classify incidents as significant and to meet the Article 23 reporting deadlines.
- Supplier accountability: Oversight of managed providers and cloud services, which remains the organization's responsibility even when the work is outsourced.
- Evidence custody: Retention of policies, logs, test results and minutes in a form that survives staff turnover.
Before engaging anyone, confirm which named individuals hold each of these roles and whether the management body has completed the cybersecurity training that Article 20 requires.
An implementation partner such as DeployOpen can plan, deploy, harden and document the self-hosted open-source platforms that produce evidence, run security testing against them, and prepare the controls and records for an assessment. The partner works inside the scope agreed in writing and hands over systems, configuration records and test results. It does not decide whether the organization is compliant, does not sign off on the risk assessment, and does not issue any report or certificate. NIS2 creates no certificate of compliance, so any claim of certification from a consultant or tool vendor should be treated with caution.
- Systems and configuration: Build and harden of logging, access control, backup and monitoring platforms, with configuration baselines written down.
- Security testing: Application, infrastructure and API testing that gives management an independent view of gaps before a supervisor finds them.
- Evidence preparation: Packaging of configuration exports, test reports and runbooks in the form the organization needs for inspections.
- Remediation support: Fixes to findings within the agreed scope, with records of what changed and when.
- Knowledge transfer: Documentation and training so the internal team can operate the platforms after the engagement.
Ask for a written scope that lists the systems, deliverables and exclusions, and confirm that the partner will not be asked to sign attestations on the organization's behalf.
National competent authorities supervise compliance and decide whether an infringement has occurred, what enforcement measure applies and whether a fine is imposed. Essential entities face ex ante supervision, while important entities face ex post supervision, as set out in Articles 32 and 33. Where an organization wants third-party assurance, an independent auditor or assessor performs the examination and issues its own report. These parties hold the decision-making and attestation roles, and their independence is what gives their conclusions weight with a regulator, a customer or a board.
- Inspections and audits: On-site and off-site inspections, security audits, security scans and information requests carried out by the authority.
- Enforcement decisions: Determination of infringements, warnings, binding instructions and administrative fines under Article 34.
- Independent assessment: Examination by an auditor who is separate from the team that built the controls and who reports on them.
- Limits on advisers: A partner that designed or operated the controls generally cannot also be the party that tests or certifies them.
- Member State rules: Local penalty rules and the public administration treatment that each Member State sets under Article 34(7).
Before relying on any assessment, confirm which body is competent in your Member State, which assessor is accepted by your customers or sector regulator, and how their independence will be documented.
Most organizations outsource part of the NIS2 work, usually the technical build, testing and evidence collection, while keeping the decisions and accountability in-house. The boundary matters for fines because a regulator will look at who approved a control, who operated it and who verified it. Outsourcing can reduce effort and specialist risk, but it does not transfer the legal exposure, and an advisor that is too close to the design of the controls may not be able to provide an independent view later.
- Typically outsourced: Platform deployment, hardening, security testing, log pipeline setup and documentation drafting.
- Typically kept in-house: Management approvals, risk acceptance, incident classification, reporting decisions and supplier accountability.
- Independence check: Separate the party that builds the controls from the party that tests or assesses them where a third-party view is needed.
- Contract clarity: Written statements that the partner prepares evidence and does not issue reports or certificates.
- Ongoing duties: Retainers for upkeep, upgrades and continuous testing still leave the organization responsible for operating the controls.
Review your engagement letters and internal RACI matrix to confirm that each Article 21 measure has one accountable owner inside the organization and a documented route to an independent assessor.
Where entities most often trigger Article 34 exposure
Article 34 fines attach to infringements of Article 21 and Article 23, so the gaps that drive exposure are the ones that break those duties in practice. The cards below cover governance records, reporting process, supplier risk, evidence quality, turnover scope and open findings, each with the check that closes it.
No board approval record
Article 21 measures must be approved and overseen by the management body, and Article 20 makes that body accountable for infringements. Many entities hold a security policy with no dated approval, minutes or named owner. Check that the risk-management measures carry a dated approval by the management body, that minutes record discussion and decisions, and that members have completed the cybersecurity training Article 20 requires. Ask who signed off the last review and when.
Missed reporting deadlines
Article 23 sets an early warning, a notification and a final report on fixed clocks once an incident is significant. Entities that lack a written triage process often miss the early warning because nobody decides significance in time. Check that a named person can classify an incident, that the early warning template is pre-approved, and that a tabletop exercise has tested the clock. Confirm the timings against the Article 23 text with your national authority.
Unmanaged supplier risk
Article 21 includes supply chain security, and an authority reviewing a breach will ask how suppliers with access to systems were assessed. Entities often hold no supplier inventory, no contract security clauses and no record of reviews. Check that critical suppliers and managed service providers are listed, that contracts require incident notice to you in time to meet Article 23, and that each supplier has a documented risk rating and review date.
Undated evidence
Supervisors assess whether controls worked at a point in time, so evidence without dates, owners or version history carries little weight. Screenshots, unsigned policies and logs exported without timestamps are common in first assessments. Check that each control has an owner, that policies show version and approval dates, and that logs, scan reports and access reviews are retained with their generation dates. Keep an index that maps each Article 21 measure to its evidence.
Turnover scope confusion
Article 34 caps are tied to total worldwide annual turnover of the undertaking the entity belongs to, not the turnover of the local legal entity. Groups that size exposure from a subsidiary's accounts can badly understate it. Check the group structure, identify the undertaking, and confirm with counsel which financial year and which consolidated figure apply under your national law. Record the calculation so it can be shown to a regulator.
Findings left open
Audit findings, scan results and incident lessons that stay open after their due date are a clear signal of an unmanaged Article 21 program. Authorities can order binding instructions for an infringement that continues. Check that every finding has an owner, a target date and a status history, that overdue items are escalated to the management body, and that closure is verified by a second person. Track recurring findings separately, since repetition weighs against the entity.
Frequently asked questions about NIS2 fines
What are the maximum NIS2 fines for essential and important entities?
For infringing Article 21 or 23, essential entities face maximum administrative fines of at least EUR 10 million or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 34(4)). Important entities face at least EUR 7 million or at least 1.4% on the same basis (Article 34(5)). The figures are floors for the maximum, not fixed fines. A regulator sets the actual amount case by case, and the Article 34 factors, such as the severity and duration of the infringement, shape it. Confirm the figures that apply in your Member State, because the national transposition law sets the penalty regime.
How is turnover calculated for a NIS2 fine?
Turnover is measured for the undertaking the entity belongs to, not only for the legal entity that is in scope (Article 34(4) and (5)). For a group, that means total worldwide annual turnover of the group in the preceding financial year. Each percentage is applied to that figure and the higher result of the two amounts becomes the ceiling. Ask your legal or finance team to confirm the consolidated figure and the financial year used, since a group structure can raise the ceiling well above the entity's own revenue.
Can national laws set NIS2 fines higher than the EU minimums?
Yes. The EUR 10 million, EUR 7 million, 2% and 1.4% amounts are minimum levels for the maximum fine that Member States must allow, so a national law may set higher ceilings (Article 34(4) and (5)). Member States also decide whether public administration entities can be fined at all (Article 34(7)). Check the transposition law of each Member State where you operate, and the penalty rules notified to the Commission, which Member States had to send by 17 January 2025 (Article 36).
Do periodic penalty payments apply under NIS2?
Yes, Member States may provide for periodic penalty payments to compel an entity to stop an infringement (Article 34(2) and (6)). Unlike a one-time fine, these payments can recur until the entity complies, and fines can be imposed alongside other enforcement measures. The amounts and mechanics depend on national law, so confirm them with counsel for each Member State. The practical lesson is that an open finding that stays unfixed can cost more over time than the original gap.
What does NIS2 preparation cost, and what drives the price?
No supplied figure sets a standard cost, so treat any number you see as a starting point to verify. The main cost components are: staff time for governance and policy work, technical remediation of systems, evidence collection, external advisors, testing, and recurring monitoring and reporting capacity. Costs rise with the number of systems and sites in scope, the number of Member States, the gap between current controls and Article 21, and whether suppliers need reassessment. Ask any provider for a quote built from a written scope that lists deliverables, assumptions and what the customer must provide. Note that DeployOpen prepares systems and evidence under a fixed-scope agreement, but it does not issue regulatory determinations.
Can an organization handle NIS2 readiness in-house?
Often yes, in part. An organization owns its controls and remains accountable, so management must approve the Article 21 measures and keep oversight, which cannot be outsourced. Many teams can run the policy work, asset inventory and day-to-day operations internally. Outside help is most useful for specialist technical work such as hardening, logging and backup design, security testing, and preparing evidence for supervisors. Assess your in-house capacity against the Article 21 measures and reporting duties, and confirm the division of responsibilities with any partner in writing before work starts.
How long does NIS2 preparation take from a low maturity starting point?
No researched duration applies to every organization, so the timeline depends on your starting point. An organization with documented policies, an accurate asset inventory and tested backups has less to build than one that lacks basic governance and visibility. Expect the longest phase to be the remediation of systems that do not yet meet the measures, followed by collecting evidence over a period that shows the controls operate. Ask prospective partners for a phased plan with milestones, dependencies and the evidence each milestone produces, and check it against your own gap assessment.
How DeployOpen prepares systems and evidence for NIS2 supervision
DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and prepares the systems and evidence that a national competent authority may ask for when it assesses Article 21 and Article 23 compliance. Work is delivered under a fixed-scope agreement, with scope, deliverables and timelines agreed in writing before any work starts. That written scope is also the practical starting point for a fine exposure review: the organization decides which entities, systems and obligations are in play, and DeployOpen turns those decisions into controls, configurations and records that can be shown to a supervisor.
DeployOpen also runs security testing of applications, APIs, cloud and infrastructure, and AI systems, and can support red teaming and private cyber ranges for incident exercises. Test reports, remediation records and exercise outcomes are the kind of material that shows an entity is managing risk in practice, which matters when a supervisor weighs the factors behind an administrative fine. Ongoing support, upgrades and continuous testing are available as retainers, and the reader should ask for each to be defined in the written scope so that recurring effort is visible from the start.
DeployOpen does not issue audit reports, attestations or certifications, and it does not set or impose fines. Those decisions belong to the national competent authority, and any independent assessment belongs to an auditor or certification body that the organization selects. Readers who want a view of their exposure should ask DeployOpen for a quote based on a written scope that names the entity classification, the systems in scope and the evidence required. DeployOpen does not publish a price list, so the quote is the only reliable way to compare costs.
