On the Node Operator side, you can find the response to follow here: 3PS12 - Suspension/disconnection response Process - EBSI Node Operators Community Space - (europa.eu)

On the EBSI office, as soon as a node needs to be suspended, all other NOs in the network will receive a notification to remove from the firewall whitelist the IP of the target node given a predefined timeframe. If this doesn't happen in the predefined timeframe, the EBSI technical office will enforce the removal from the whitelist using the puppet agent that is hosted on each node (via a configuration change). EBSI Technical Office can NOT take control of the node, it can only apply this configuration change.