NIS2 and board accountability: what must management do?

Short answer: NIS2 makes the management body itself responsible for cybersecurity. Management must approve the risk-management measures, oversee their implementation and undergo training. Member States must provide for the possibility of holding management members liable for breaches of these duties.

The responsibility of the management body (Art. 20)

Article 20 of Directive (EU) 2022/2555 places cybersecurity explicitly at leadership level. The management bodies of essential and important entities must approve the risk-management measures referred to in Article 21 and oversee their implementation. The directive makes clear that this is not an IT detail to be delegated away: it is a governance task.

Liability and training

Article 20 provides that Member States ensure management members can be held liable for breaches of the obligations on risk-management measures. The directive further requires management members to follow regular training so they have sufficient knowledge to identify and assess cybersecurity risks. Management is encouraged to offer comparable training to staff.

What must the board do in practice?

• Approve — formally decide on the security policy and the Article 21

measures (incl. risk analysis, incident handling, supply chain, continuity).

• Oversee — periodically review and record implementation and effectiveness.
• Train — management members complete training on cybersecurity risks.
• Document — record decisions, approvals and oversight so the duty of care

is demonstrable.

Note: enforcement via national transposition

NIS2 is a directive; the precise sanctions and the shape of liability are set in the national legislation transposing it. For your situation, consult the text of the directive and the European Commission's guidance, and follow the national implementation and the designated competent authority.

Read more: Transport & Logistics. Take the scan.