"Cybersecurity is a board matter" is a line you hear on every conference stage. It only becomes interesting when read legally — because since NIS2 it is no longer a question of attitude but a set of duties with a name and a citation.
What NIS2 actually places on management
The decisive provision is not the much-quoted Article 21 with its catalogue of measures, but Article 20. It addresses management bodies directly and requires three things:
Approval. Management must approve the risk management measures. Not note them — approve them. That is an active decision, and it is either documented or it is not.
Oversight. Management must supervise implementation. A one-off sign-off does not suffice; there has to be a recurring reporting line that reaches the top and is acted on there.
Training. Paragraph 2 obliges members of management bodies to attend training themselves, and to offer comparable training to staff. The first half is routinely overlooked. An awareness campaign for the workforce does not discharge management's own training obligation.
Then there is liability: management bodies can be held responsible for breaches of these duties. In the German transposition, management duties sit in the amended BSIG and the risk management measures in § 30. Whether and to what extent a company can waive claims against its directors is a question for your legal advisers — and one to settle before an incident rather than after.
A necessary correction: the EU AI Act only partly belongs here
The original named NIS2 and the EU AI Act in the same breath as drivers of cyber resilience. That is imprecise. The AI Act is at heart product-safety and fundamental-rights regulation. It does contain accuracy, robustness and cybersecurity requirements for high-risk systems, but it is not a general cybersecurity statute and does not bind management in the way NIS2 does.
Conflating the two makes the argument attackable — and the NIS2 duties are quite clear enough on their own.
The blind spot still holds
One point from the original deserves to stand: many IT organisations weight technology too heavily. Firewalls and endpoint protection are necessary but address only half the problem. Without clear governance, defined responsibilities and awareness, the other half stays open.
The organisational half is also where an audit snags first. Technical measures can be retrofitted. A management decision that was never taken last year cannot be taken retrospectively.
The questions management has to be able to answer
Not as rhetoric, but as a checklist. If any of these takes more than a minute of thought in conversation, that is the answer:
- When did management last formally approve the risk management measures, and where is that documented?
- Through which reporting line does management learn whether the measures work — and when did the last report arrive?
- When did members of management themselves last attend training?
- How long does production run without IT, and who has tested that rather than assumed it?
- Who notifies which authority within 24 hours — by name, with a deputy?
- What obligations does the cyber policy impose, and can we evidence that we meet them?
Point 6 is routinely underestimated. Cyber policies carry minimum requirements — multi-factor authentication, backup regime, patch levels. An insured who cannot evidence them when claiming risks reduced payment. And directors' liability cover is a separate question with no connection to the cyber policy.
Measure before you invest
The original's recommendation was right and remains so: establish the current state before investing. In practice this step is skipped, because buying software feels more tangible than taking stock. The result is tooling that closes gaps which were never the largest.
How to recognise a useful assessment: it produces a ranking by risk rather than a list of defects, it names what you already have and need not replace, and it does not inevitably conclude with the product of whoever carried it out.
That last point applies to us too. If an assessment we run concludes that you need no further tooling but a documented approval process and two training dates, then that is the result.
Sources
- NIS2 Directive (EU) 2022/2555 — Articles 20 and 21 in particular
- BSI — information on the German NIS2 transposition
- Basis of the original version: an article by Dr Andreas Herch, CEO of the accompio Enterprise business unit, published by contentway. Our first version did not link the original — that was a mistake.