NIS2 Art.32.2: Supervision of Essential Entities
If your organisation is classified as an essential entity, regulators can - and will - come knocking without waiting for something to go wrong. Unlike important entities that face reactive supervision, essential entities are subject to proactive, ongoing oversight: on-site inspections, off-site reviews, targeted security audits, and regular compliance checks.
Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.
Requirement summary
When supervising essential entities, competent authorities must have the power to carry out on-site inspections and off-site supervision, including random checks; regular and targeted security audits by an independent body or a competent authority; ad hoc audits, including after a significant incident or an infringement; security scans based on objective, non-discriminatory, fair and transparent risk assessment criteria; requests for information needed to assess the cybersecurity risk-management measures; requests to access data, documents and information; and requests for evidence of implementation of cybersecurity policies, such as results of security audits and the underlying evidence.
Check the source wording and scope in NIS2 Directive on EUR-Lex. The guidance below explains how to approach a review.
In Plain Language
Supervisory powers are broad. Authorities can request evidence of your cybersecurity measures, access your documentation, demand information to assess compliance, and order specific corrective actions. There is no waiting for a trigger event.
The practical implication is that you need to be audit-ready at all times. Treat supervision as a chance to validate and improve your security posture rather than an adversarial exercise. Organisations that engage constructively with regulators consistently have better outcomes.
How to Implement
Assign clear ownership for regulatory interactions, whether that is a dedicated compliance function or a named individual. This person needs to understand the supervisory framework, keep readiness levels up, and coordinate responses to regulatory requests.
Keep your compliance documentation comprehensive, current, and auditable. Build a compliance evidence repository organised by NIS2 control area so you can pull together an evidence pack at short notice rather than scrambling when an inspection is announced.
Create an inspection readiness programme. Maintain a standing file of key compliance evidence that gets refreshed regularly, designate points of contact for different topics, document procedures for facilitating on-site inspections (access, logistics, technical support), and train staff who may interact with auditors.
Set up internal processes for responding to supervisory requests within the required timeframes. You need a triage process for incoming requests, coordination between technical, legal, and management teams, quality review before submission, and tracking of all regulatory interactions and commitments.
Run periodic internal compliance assessments that mirror the expected supervisory approach. Finding and fixing gaps before an external inspection is always preferable to having them discovered for you.
Maintain a register of all supervisory interactions, findings, corrective actions, and their status. This demonstrates responsiveness and provides a clear audit trail.
Engage proactively with your competent authority. Attend their informational events, ask for clarification on expectations, and build a working relationship before you need it.
Evidence to review
- Compliance evidence repository organised by NIS2 control area
- Designated regulatory liaison or compliance function
- Inspection readiness procedures and evidence pack
- Register of supervisory interactions and corrective actions
- Internal compliance assessment reports
Common Mistakes
- No preparation for supervisory inspections; scramble to gather evidence upon request
- Documentation is outdated or does not reflect actual security practices
- No designated point of contact for regulatory interactions
- Corrective actions from previous supervisory findings not tracked or completed
- Adversarial attitude toward supervisors rather than constructive engagement
Related Controls Across Frameworks
| Framework | Control ID | Relationship |
|---|---|---|
| ISO 27001 | ISO 27001 A.5.36: Compliance with policies, rules and standards for information security | Related |
| SOC 2 | SOC 2 CC4.1: COSO Principle 16: Selects, Develops, and Performs Ongoing and/or Separate Evaluations | Related |
Frequently Asked Questions
How often will essential entities be inspected?
What is the difference between supervision of essential and important entities?
Related Articles
When Your NIS2 Checklist Stops Matching the Evidence
A green status can outlive the process behind it. Review stale evidence, missed checks and changes in control ownership.
Read article →NIS2 Compliance: What EU Companies Need to Know in 2026
A practical guide to NIS2 directive compliance - who it applies to, what's required, penalties, and step-by-step preparation for EU companies.
Read article →NIS2 Article 21 to ISO 27001 Annex A: Complete Control Mapping
Full cross-reference table mapping every NIS2 Article 21 cybersecurity requirement to its corresponding ISO 27001:2022 Annex A controls. Built for compliance officers managing both frameworks.
Read article →Track NIS2 compliance in one place
Start a 10-question NIS2 readiness check to identify priorities. Use the reference guides and workbook for a wider review.
Start Free AssessmentStart without an account · Sign up only to save