What NIS2 Means for Board-Level Cybersecurity Accountability

NIS2 Directive (EU) 2022/2555 is the most consequential change to European cyber regulation in a generation, and the part that matters most is not technical. It makes the management body of an organisation directly accountable for cyber risk management, and in several member states, personally liable for failures of oversight.

For boards, NIS2 is not a compliance project delegated to the CISO. It is a governance obligation that sits on the board's side of the table. This article explains what that means in practice.

What NIS2 changed

NIS2 expands the scope of the original directive far beyond critical infrastructure operators to a wide range of "essential and important entities" including many in energy, transport, health, finance, digital infrastructure and public administration. It also raises the bar for what counts as adequate cyber risk management, and gives national authorities real enforcement powers, including significant fines and, for management bodies, potential personal liability.

The directive's core requirement is simple to state and hard to discharge: organisations must manage cyber risk using a risk-based, documented approach, and the management body must approve and oversee it.

Accountability of management bodies

This is the change directors most often underestimate. NIS2 requires that members of the management body "approve the cybersecurity risk-management measures taken by those entities" and "oversee its implementation." It also expects them to follow training so they can identify risks and assess cyber risk-management practices.

In plain terms, the board can no longer approve a budget and delegate the rest. It must understand the risk, approve the approach and retain oversight. Failure to do so can, depending on national implementation, expose directors to personal liability and to temporary suspension from management functions.

Risk management and governance duties

NIS2 calls for measures that address, among other things, policies on risk analysis, incident handling, business continuity, supply-chain security, network security, training and access control. The board's job is not to design these controls but to confirm they exist, are coherent, and are proportionate to the organisation's risk.

The useful board questions are structural: Is there a single, approved cyber risk-management framework? Is supply-chain risk covered not just our own controls, but those of the critical suppliers we depend on? Is training reaching the people who actually handle incidents, including the board itself?

Incident reporting obligations

NIS2 shortens and tightens incident reporting. Significant incidents must be reported to the relevant authority within 24 hours of awareness, with a more detailed update within 72 hours and a final report within one month. The board does not draft these reports, but it must ensure the organisation can meet the clock which means having detection, escalation and decision pathways that move fast enough.

Many organisations that can detect an incident cannot decide quickly enough to report it. Closing that gap is a governance task, not a technical one.

What boards should do now

Three actions make the biggest difference:

1. Document the board's role. Confirm that cyber risk-management measures are formally approved by the management body and that oversight is recorded in board minutes.
2. Ensure the board is trained. NIS2 expects management body members to understand cyber risk. Treat this as a governance prerequisite, not a box to tick.
3. Bring independent judgement to oversight. Management cannot be the sole source of assurance on the systems it runs. Independent advice internal audit, external review or a virtual cyber board advisor makes oversight defensible.

NIS2 has not changed the technical practice of security. It has changed who answers for it. The boards that take that change seriously will find the rest of compliance far easier and far cheaper than those that treat it as a paperwork exercise.