NIS2 Art.31.1: Supervisory Powers for Essential Entities

Build an internal regulatory response procedure covering each type of supervisory activity.

For on-site inspections: identify facility contacts and access procedures, prepare meeting rooms and technical access for auditors, keep key documentation organised and accessible, and brief staff on how to interact with inspectors.

For security audits (regular, targeted, or ad-hoc): maintain a standing evidence pack covering all NIS2 control areas, be ready to give auditors access to systems, logs, and configurations, have technical staff available to answer detailed questions and demonstrate controls, and set up a process for gathering additional evidence quickly during an audit.

For security scans: know your external attack surface from the perspective of automated scanning, keep internet-facing systems hardened and regularly assessed, maintain an inventory of all public-facing services and their security status, and fix known vulnerabilities before regulators discover them.

For information requests: set up a rapid-response process for formal requests, define internal SLAs for gathering and submitting information, implement quality review before anything goes out the door, and track every request and response for the audit trail.

Run internal readiness assessments that simulate different supervisory scenarios. Test whether you can respond to short-notice inspection requests, gather evidence within regulatory timeframes, and give live demonstrations of security controls.

Maintain a centralised compliance management system that gives you real-time visibility into your posture across all NIS2 requirements. When a regulator contacts you, you want to know immediately where you stand.