art_32__para_2

2. Member States shall ensure that the competent authorities, when exercising their supervisory tasks in relation to essential entities, have the power to subject those entities at least to: on-site inspections and off-site supervision, including random checks conducted by trained professionals; regular and targeted security audits carried out by an independent body or a competent authority; ad hoc audits, including where justified on the ground of a significant incident or an infringement of this Directive by the essential entity; security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria, where necessary with the cooperation of the entity concerned; requests for information necessary to assess the cybersecurity risk-management measures adopted by the entity concerned, including documented cybersecurity policies, as well as compliance with the obligation to submit information to the competent authorities pursuant to Article 27; requests to access data, documents and information necessary to carry out their supervisory tasks; requests for evidence of implementation of cybersecurity policies, such as the results of security audits carried out by a qualified auditor and the respective underlying evidence. The targeted security audits referred to in the first subparagraph, point (b), shall be based on risk assessments conducted by the competent authority or the audited entity, or on other risk-related available information. The results of any targeted security audit shall be made available to the competent authority. The costs of such targeted security audit carried out by an independent body shall be paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise.

← art_32__para_1 · All articles · (a) →

Source: EUR-Lex (Cellar) · retrieved 2026-10-27 · Text as adopted (Official Journal); later amendments are not incorporated in this text.