For a long time, cybersecurity was seen primarily as a technical matter, left to IT teams. Issues such as system protection, vulnerability management and incident response were often handled with limited involvement from senior management.

In our previous article, “NIS2. Do you know where to start?we explored the first steps towards turning regulatory requirements into a practical action plan. But one question deserves particular attention: who is responsible for ensuring that these measures are actually implemented?

Under the NIS2 Directive, management accountability takes on a new dimension across the European Union. Cybersecurity risk management measures must be approved and overseen by management bodies, with greater emphasis on their role in ensuring that risks are properly addressed.

But what does this really mean for decision-makers? And how far can a director’s personal liability extend in the event of a cybersecurity incident?

What is expected of management under NIS2?

NIS2 establishes specific responsibilities for the management bodies of organisations subject to the relevant requirements.

Under Article 20 of the EU NIS2 Directive, management bodies are assigned specific responsibilities for cybersecurity risk management, including:

• Approval of cybersecurity measures: management bodies must approve the cybersecurity risk management measures adopted by their organisation.

• Oversight of implementation: management must oversee how these measures are implemented and ensure that cybersecurity risks are properly addressed.

• Accountability for non-compliance: management bodies may be held liable for infringements of applicable cybersecurity risk management obligations, in accordance with national legislation.

• Cybersecurity training: Members of management bodies are required to undertake training to strengthen their ability to identify and assess cybersecurity risks. Organisations are also encouraged to provide regular training for employees.

In practice, management is expected to understand the organisation's main cybersecurity risks, make informed decisions and oversee the measures put in place to address them.

What happens if an organisation fails to comply?

This is probably one of the questions that raises the greatest concern among directors and senior executives.

Under NIS2, accountability for non-compliance is not limited to the organisation itself. In certain circumstances, members of management bodies may also be held personally liable.

Under the NIS2 Directive, management bodies may be held liable for infringements of cybersecurity risk management obligations, subject to the applicable national legislation of each EU Member State.

However, the consequences of inadequate cybersecurity risk management can extend beyond legal penalties.

A security breach may lead to service disruptions, financial losses, exposure of sensitive information or reputational damage.

Consider, for example, a company where critical vulnerabilities have been identified, but corrective measures have repeatedly been postponed. If an incident occurs, the risks that were known, the decisions that were made and the measures that should have been implemented may all come under scrutiny.

This makes it increasingly important for cybersecurity decisions to be properly justified, documented and regularly reviewed.

What questions should management be asking?

Directors are not expected to master every technical aspect of cybersecurity. However, they should have access to the information needed to understand the risks and make informed decisions.

There are several questions that should become part of management discussions:

• Do we know our organisation's main cybersecurity risks?

• Have we identified the systems and services whose disruption would have the greatest impact?

• Have responsibilities, resources and deadlines been established for implementing the necessary measures?

• Can we demonstrate that approved measures are being implemented and their effectiveness assessed?

The answers can help reveal how effectively cybersecurity is integrated into organisational management and where gaps may still exist.

Accountability starts with today's decisions

NIS2 reinforces the need for management bodies to be involved in setting priorities, allocating resources and overseeing cybersecurity measures.

At ORBCOM, we support organisations in assessing risks, identifying vulnerabilities and implementing protection, monitoring and incident response measures, helping decision-makers make more informed and confident cybersecurity decisions.

Can your organisation demonstrate how its cybersecurity risks are being managed?