2. Where the IICB finds that a Union entity has not effectively implemented this Regulation or guidelines, recommendations or calls for action issued pursuant thereto, it may, without prejudice to the internal procedures of the Union entity concerned, and after giving an opportunity to the Union entity concerned to present its observations:
|
(a)
|
communicate a reasoned opinion to the Union entity concerned with observed gaps in the implementation of this Regulation;
|
|
(b)
|
provide, after consulting CERT-EU, guidelines to the Union entity concerned to ensure that its Framework, cybersecurity risk-management measures, cybersecurity plan and reporting comply with this Regulation within a specified period;
|
|
(c)
|
issue a warning to address identified shortcomings within a specified period, including recommendations to amend measures adopted by the Union entity concerned pursuant to this Regulation;
|
|
(d)
|
issue a reasoned notification to the Union entity concerned, in the event that shortcomings identified in a warning issued pursuant to point (c) were not sufficiently addressed within the specified period;
|
|
(e)
|
issue:
|
(i)
|
a recommendation for an audit to be carried out; or
|
|
(ii)
|
a request that an audit be performed by a third-party audit service;
|
|
|
(f)
|
if applicable, inform the Court of Auditors, within the remit of its mandate, of the alleged non-compliance;
|
|
(g)
|
issue a recommendation that all Member States and Union entities implement a temporary suspension of data flows to the Union entity concerned.
|
For the purposes of the first subparagraph, point (c), the audience of a warning shall be restricted appropriately, where necessary in view of the cybersecurity risk.
Warnings and recommendations issued pursuant to the first subparagraph shall be directed to the highest level of management of the Union entity concerned.