Article 26 (security audit)

• 1

  The competent authority may, by decision, impose an obligation on an essential service provider to:

  • a.

    an independent expert shall investigate whether the measures taken by the provider comply with Articles 7 and 8 and with the detailed rules referred to in Article 9, and

  • b.

    the results of that investigation to the competent authority within a reasonable period specified in the decision.

• 2

  The investigation shall be conducted in a manner prescribed by the competent authority.

• 3

  Unless otherwise specified by general administrative order, the provider shall bear the costs of the investigation.

• 4

  Further rules may be laid down by or pursuant to an order in council concerning the first and second paragraphs.