What the Board Actually Needs to Know About NIS2
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.
September 16, 2026
v1
2 min
What the Board Actually Needs to Know About NIS2
Most cybersecurity regulation historically treated the board as an audience for a summary, not a party to liability. NIS2 changes that explicitly: Article 20 requires management bodies to approve the organization's cybersecurity risk-management measures and holds them accountable for non-compliance, including potential personal liability in some member states' transposing laws.
The three things worth a real board conversation
- Has management formally approved our cybersecurity risk-management measures, in a way that satisfies NIS2's approval requirement — not just informally endorsed the security team's plan?
- Do we have a tested, real incident-response process that can actually produce a 24-hour early warning if something happens — not just a documented policy?
- Do we know our full scope — including subsidiaries and critical vendors — well enough to know which NIS2 entity classification actually applies to us?
Explore NIS2
Hub overview →
Related Executive Guides
All ten minimum measure categories Article 21(2) requires, as a working checklist rather than a paragraph of prose.
Everything a CISO, compliance director, or board member needs to know about the EU's revised Network and Information Security Directive — scope, governance, reporting obligations, and a real implementation roadmap.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.