NIS 2 Management Liability: What Leaders Need to Know

Key Takeaways

Point	Summary
Personal liability	Management body members can be personally held liable for NIS 2 infringements
Approval required	Management must formally approve cybersecurity risk-management measures
Oversight duty	Management must actively oversee the implementation of security measures
Training obligation	Management body members must undergo regular cybersecurity training
Sanctions	Temporary bans from management functions possible for essential entities

Quick Answer: NIS 2 makes cybersecurity a boardroom responsibility. Management body members must approve security measures, oversee implementation, and undergo cybersecurity training. They can be held personally liable for non-compliance, and for essential entities, may face temporary bans from exercising management functions.

What Article 20 Requires

Article 20 of the NIS 2 Directive establishes four specific obligations for management bodies:

1. Approval of Cybersecurity Measures

Management bodies must formally approve the cybersecurity risk-management measures adopted by the entity under Article 21. This means:

• Security policies and procedures cannot be adopted by IT teams alone
• Board or executive committee approval must be documented
• Management must understand what they are approving
• Changes to security measures require renewed approval

2. Oversight of Implementation

Management must actively supervise the implementation of these measures:

• Regular reporting on implementation status
• Monitoring of key security metrics and incidents
• Review of audit findings and remediation progress
• Engagement with security teams on significant issues

3. Training Obligation

Management body members must undertake cybersecurity training to:

• Gain sufficient knowledge to identify risks
• Understand the entity's cybersecurity risk-management practices
• Assess the impact of cybersecurity risks on operations
• Make informed decisions about cybersecurity measures

4. Liability for Infringements

If the entity infringes the requirements of NIS 2, management body members can be held personally liable. This liability extends to:

• Failure to approve appropriate security measures
• Inadequate oversight of implementation
• Neglecting the training obligation
• Ignoring known cybersecurity risks

Enforcement Consequences

For Essential Entities

Supervisory authorities have the power to:

Sanction	Description
Temporary management ban	Temporarily prohibit specific individuals from exercising management functions
Personal fines	Administrative fines against natural persons
Public disclosure	Publication of non-compliance decisions identifying responsible individuals
Compliance orders	Binding orders directed at management

For Important Entities

While the temporary management ban is specific to essential entities, management of important entities can still face:

• Personal liability for infringements
• Administrative fines
• Compliance orders
• Reputational consequences from public enforcement actions

Practical Steps for Management

Establish a Governance Framework

Action	Description
Agenda item	Include cybersecurity as a regular board/executive agenda item
Reporting cadence	Define frequency of cybersecurity reports to management (at least quarterly)
Approval process	Create formal approval workflows for security policies and risk-management measures
Documentation	Maintain records of all management decisions related to cybersecurity

Build Cybersecurity Knowledge

Management training should cover:

• Overview of the organization's threat landscape
• Understanding of NIS 2 requirements and their personal obligations
• Cybersecurity risk assessment fundamentals
• Incident response and reporting obligations
• Supply chain security concepts
• Current trends in cyber threats relevant to the organization's sector

Demonstrate Oversight

Evidence of active oversight includes:

• Minutes of meetings where cybersecurity was discussed
• Signed approvals of security policies and risk-management measures
• Records of management reviewing incident reports and audit findings
• Documentation of management-directed security improvements
• Evidence of management participation in training and exercises

Delegate Effectively

Management liability does not mean management must handle cybersecurity operations directly. Effective delegation includes:

• Appointing a qualified CISO or security lead
• Establishing clear reporting lines from security to management
• Defining KPIs and thresholds that trigger management escalation
• Ensuring adequate budget and resources for cybersecurity
• Maintaining accountability while empowering technical teams

Comparison with Other Frameworks

Framework	Management Obligation
NIS 2	Personal liability, mandatory training, formal approval and oversight
GDPR	Data protection officer role, controller accountability (organizational, not personal)
ISO 27001	Leadership commitment, ISMS policy approval (Clause 5)
DORA	Management body responsibility for ICT risk management framework
SOX (US)	CEO/CFO certification of financial controls

NIS 2's management liability provisions are among the most stringent in EU regulation, comparable to financial sector governance requirements under DORA.

Risk Mitigation for Management

Insurance Considerations

Directors and officers (D&O) insurance policies should be reviewed to determine whether they cover NIS 2-related personal liability. Key questions:

• Does the policy cover regulatory fines and penalties?
• Are cybersecurity-related management failures included?
• What are the coverage limits relative to potential NIS 2 penalties?
• Does the policy cover legal defense costs?

Legal Protection

Management members should consider:

• Obtaining legal advice on their specific NIS 2 obligations
• Ensuring indemnification clauses in employment contracts
• Maintaining comprehensive records of their oversight activities
• Seeking independent cybersecurity assessments to demonstrate due diligence

Common Questions

Can management delegate NIS 2 responsibilities to the CISO?

Management can delegate operational cybersecurity responsibilities to a CISO or security team, but the accountability under NIS 2 cannot be delegated. Management body members remain personally responsible for approving measures, overseeing implementation, and undergoing training. Delegation is about execution, not accountability.

What kind of training satisfies the NIS 2 requirement?

The directive does not prescribe specific training formats or providers. Training should be sufficient for management to identify and assess cybersecurity risks and evaluate their impact on the organization's operations. This could include board-level briefings, executive cybersecurity courses, sector-specific workshops, or guided exercises. The key is that training is regular, documented, and relevant.

How often must management review cybersecurity measures?

NIS 2 does not specify a review frequency, but best practice suggests at least quarterly reviews of cybersecurity status and annual formal reviews of security policies and risk-management measures. Reviews should also be triggered by significant incidents, major organizational changes, or material changes in the threat landscape.