NIS2 Guide · 7 min
NIS2 and management responsibility: what boards and leadership must know
NIS2 does something earlier cybersecurity rules mostly didn't: it puts cybersecurity on the management body's desk, by name. Leadership has to approve the risk-management measures, oversee them, and can be held personally liable when they fail. This guide sets out what the directive expects of boards and executives, the questions worth putting to your security team, what good reporting actually looks like, and the price of getting it wrong.
Key takeaways
- Management bodies must approve and oversee the cybersecurity risk-management measures, and can be held liable when they fail (Art. 20).
- Leadership has to take cybersecurity training; the duty can't be fully handed off to IT.
- Penalties reach €10M or 2% of global turnover for essential entities, €7M or 1.4% for important ones (Art. 34).
- Boards should expect short, evidence-based reporting (coverage, remediation speed and open risk) not a once-a-year reassurance.
Leadership is named, and on the hook
Under Article 20, the management body of an essential or important entity must approve the entity's cybersecurity risk-management measures and oversee how they're implemented. This isn't a formality you can delegate away: the directive makes leadership answerable for the measures actually being in place and actually working.
And members of the management body can be held liable for the entity's breaches. That accountability is written into the directive itself; exactly how it bites depends on national transposition. Cybersecurity is a governance question, then, not only an IT one. It belongs on the board agenda next to financial and legal risk, not in a quarterly slide nobody reads.
The four duties of a management body
In practice the directive's governance expectations come down to four things leadership has to do:
- Approve the measures: sign off on the risk-management measures (the Art. 21 baseline), with enough understanding to know what you're actually approving.
- Oversee implementation: make sure the measures are genuinely deployed and stay effective over time, with regular reporting back to the board.
- Take training: members must follow cybersecurity training so they can recognise risk and judge whether the measures are adequate (Art. 20(2)); similar training should reach staff.
- Be accountable: own the outcome. Liability for failures sits with the management body, and supervisory authorities can act against leadership directly.
Questions to ask your security team
You don't need to be a security engineer to exercise oversight. A board discharges much of its duty simply by asking the right questions and expecting answers backed by evidence:
See how you and your suppliers actually score
7-day free trial · no credit card · cancel anytime
What good board reporting looks like
Oversight needs signal, not a sixty-page appendix. A useful NIS2 line to the board is short, comparable over time, and built on evidence:
Coverage
What share of in-scope suppliers and assets is actually monitored: the gaps are where the surprises come from.
Remediation speed
Mean time to resolve critical and high findings: the trend tells you more than any single figure.
Open risk
Current critical and high findings, plus the documented, accepted ones: NIS2 expects managed risk, not a clean sheet.
Incident readiness
Can the reporting timelines be met, and have they been rehearsed: including for an incident that starts at a supplier?
The cost of getting it wrong, and right
Penalties under Article 34 reach up to €10 million or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and up to €7 million or 1.4% for important ones. Supervisory authorities can also issue binding instructions, order an incident to be made public, and (for essential entities) temporarily suspend management functions. For leadership, the reputational and personal-liability exposure can outweigh the fine itself.
Done well, it's often less about new spend than about pointing existing controls in the right direction: the Article 21 measures overlap heavily with what many organisations already run (ISO 27001, business continuity, access control). What NIS2 really forces is the shift from point-in-time assurance to continuous, evidence-based management, which is also what turns oversight reporting into something genuinely informative rather than a ritual.
Source: Directive (EU) 2022/2555 (NIS2), Articles 20 and 34 — consult your national transposition law for the exact liability and training provisions in your country.
How norppa.io helps
norppa.io turns supplier and third-party cyber risk into the kind of evidence a board can actually use: a clear risk score per supplier, findings mapped to the NIS2 articles they answer to, and a report written for leadership rather than engineers.
Coverage, remediation history and open risk are visible at a glance, with the full audit trail ready to export, so management can show active oversight, and the same evidence answers a supervisory authority's questions when they come.
A dedicated management-accountability workspace lets the accountable officer record their Article 20 approval, sign off critical supplier risks, keep leadership training current, and export a tamper-evident duty-of-care dossier for the board, a regulator or a cyber-insurer. It documents the duty of care; it never certifies compliance.