<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"full","held_since":"2022-12-27","gaps":[],"covered":["NIS2 L1"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-11-01","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/recitals/44","url":"https://www.headlesslaw.com/nis2/recitals/44","title":"Recital 44","family":"l1_recital_view","work_id":"nis2","view_of":"/nis2/recitals","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Directive (EU) 2022/2555, OJ L 333, 27.12.2022","check":{"against":"EUR-Lex","on":"2026-11-01"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555","valid_from":"2022-12-27","valid_until":null,"content_id":"1cc9558240c9a5de","versions":["2022-12-27"],"version_url":"https://www.headlesslaw.com/nis2/recitals/44/versions/2022-12-27","revision_url":"https://www.headlesslaw.com/nis2/recitals/44/versions/2022-12-27/rev/1cc9558240c9a5de","versions_url":"https://www.headlesslaw.com/nis2/recitals/44/versions","relations_url":"https://www.headlesslaw.com/nis2/recitals/44/relations","act_url":"https://www.headlesslaw.com/nis2/recitals","source_line":null,"attribution":null,"context":{"act":{"work_id":"nis2","path":"/nis2/recitals","name":"NIS2","number":"Directive (EU) 2022/2555","celex":"32022L2555","title_official":null,"document_date":null},"position":{"kind":"recital","key":"44","index":44,"articles":144,"annexes":0},"prev":{"path":"/nis2/recitals/43","key":"43","title":"Recital 43"},"next":{"path":"/nis2/recitals/45","key":"45","title":"Recital 45"},"act_anchor":""}}} -->
# Recital 44

*In force · Directive (EU) 2022/2555, OJ L 333, 27.12.2022 · Checked against EUR-Lex on 1 Nov 2026 · [Official source](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2555)*

The CSIRTs should have the ability, upon an essential or important entity’s request, to monitor the entity’s internet-facing assets, both on and off premises, in order to identify, understand and manage the entity’s overall organisational risks as regards newly identified supply chain compromises or critical vulnerabilities. The entity should be encouraged to communicate to the CSIRT whether it runs a privileged management interface, as this could affect the speed of undertaking mitigating actions.