NIS2 Guide · 7 min
NIS2 and management responsibility: what boards and leadership must know
NIS2 does something earlier cybersecurity rules largely did not: it puts cybersecurity on the desk of the management body, by name. Leadership must approve the risk-management measures, oversee them, and can be held personally liable if they fail. This guide explains what the directive expects of boards and executives, the questions to put to your security team, what good reporting looks like, and the cost of getting it wrong.
Key takeaways
- Management bodies must approve and oversee cybersecurity risk-management measures — and can be held liable for failures (Art. 20).
- Leadership must take cybersecurity training; the duty cannot be fully delegated to IT.
- Penalties reach €10M or 2% of global turnover for essential entities, €7M or 1.4% for important entities (Art. 34).
- Boards should expect concise, evidence-based reporting — coverage, remediation speed and open risk — not a once-a-year assurance.
Leadership is named, and on the hook
Under Article 20, the management body of an essential or important entity must approve the entity's cybersecurity risk-management measures and oversee their implementation. This is not a delegable formality: the directive makes leadership responsible for the measures actually being in place and working.
Crucially, members of management bodies can be held liable for the entity's infringements. That accountability is written into the directive itself; how it is framed in practice depends on national transposition. Cybersecurity is therefore a governance matter, not only an IT matter — it belongs on the board agenda alongside financial and legal risk.
The four duties of a management body
In practice, the directive's governance expectations come down to four things leadership must do:
- Approve the measures — sign off on the risk-management measures (the Art. 21 baseline), with enough understanding to know what you are approving.
- Oversee implementation — ensure the measures are actually deployed and effective over time, with regular reporting to the board.
- Take training — members must follow cybersecurity training so they can identify risks and judge the adequacy of the measures (Art. 20(2)); similar training should be offered to staff.
- Be accountable — own the outcome. Liability for failures rests with the management body, and supervisory authorities can act against leadership directly.
Questions to ask your security team
You do not need to be a security engineer to exercise oversight. A board can discharge much of its duty by asking the right questions and expecting evidence-based answers:
What good board reporting looks like
Oversight needs signal, not a 60-page appendix. A useful NIS2 reporting line to the board is short, comparable over time, and evidence-based:
Coverage
What share of in-scope suppliers and assets is actually monitored — gaps are where surprises come from.
Remediation speed
Mean time to resolve critical and high findings — the trend matters more than any single number.
Open risk
Current critical/high findings and the documented, accepted risks — NIS2 expects managed risk, not zero findings.
Incident readiness
Can the reporting timelines be met, and have they been rehearsed, including for supplier-caused incidents?
The cost of getting it wrong — and right
Penalties under Article 34 reach up to €10 million or 2% of total worldwide annual turnover (whichever is higher) for essential entities, and up to €7 million or 1.4% for important entities. Supervisory authorities can also issue binding instructions, order the disclosure of incidents, and — for essential entities — temporarily suspend management functions. For leadership, the reputational and personal-liability exposure can outweigh the fine itself.
Done well, it is often less about new spend than redirecting existing controls: the Art. 21 measures overlap heavily with controls many organisations already run (ISO 27001, business continuity, access control). The shift NIS2 forces is from point-in-time assurance to continuous, evidence-based management — which is also what makes oversight reporting genuinely informative rather than a formality.
Source: Directive (EU) 2022/2555 (NIS2), Articles 20 and 34 — consult your national transposition law for the exact liability and training provisions in your country.
How norppa.io helps
norppa.io turns supplier and third-party cyber risk into the kind of evidence a board can actually use: a clear risk score per supplier, findings mapped to NIS2 articles, and a monthly executive report designed for leadership rather than engineers.
Coverage, remediation history and open risk are visible at a glance, with the full audit trail exportable — so management can demonstrate active oversight, and the same evidence answers a supervisory authority's questions.