Monitoring, continual improvement and preparation for certification
This domain tests how compliance is supervised, evidenced and improved. It covers supervisory powers, penalties, monitoring metrics, management review, testing and readiness for European cybersecurity certification.
Supervision and evidence
Competent authorities can request information, conduct audits and on-site inspections, perform security scans and require corrective action. Essential entities face a stricter regime, including proactive supervision; important entities are generally supervised after evidence of non-compliance. Penalties vary by tier: for essential entities, up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher; for important entities, up to EUR 7 million or 1.4%. Keep an evidence register linking each Article 21 measure to policy, configuration, logs, training records, test results and management decisions.
Continual improvement
Run a monitoring cycle: control metrics, incident trends, supplier reviews, vulnerability and patch status, backup restore tests, tabletop exercises and internal audits. Feed findings into management review and corrective-action tracking. Article 24 encourages use of European cybersecurity certification schemes; certification can evidence specific controls but does not transfer legal responsibility.
Worked example
An essential entity prepares for an audit. It builds a control matrix against Article 21, tests backup restoration and finds it fails. It raises a corrective action, retests, records the result and reports to the management body. In the audit, the evidence shows detection, correction and oversight, which is stronger than a claim of perfect controls.
Traps
Do not assume certification equals NIS2 compliance. Do not rely on annual reviews only; monitoring should be continuous and risk-based. Do not present policies without implementation evidence. Do not forget management review and training records. Do not memorise penalties without tier and turnover comparison.