Module 6 · The Management Body¶
This Module is different from the others. It is written for the board and senior executives (the people NIS2 calls the "management body") and it can be read entirely on its own, without the rest of the course. It is short, deliberately non-technical, and high-altitude.
Throughout, the Module follows one running example: Scaldimet, a fictional mid-sized manufacturer that supplies parts to the automotive industry from two sites, one in Belgium and one in France. It has no history of managing cybersecurity as a governance matter, which makes it a useful stand-in for many real boards. You do not need any other part of the course to follow the examples here.
Why does the board need its own Module? Overseeing cybersecurity is part of a board's basic duty to steer and protect the organisation; it is not something that can be delegated to the CISO and forgotten. Any board should approve its organisation's cybersecurity measures, oversee them, and be trained enough to do so. For a growing list of sectors, NIS2 now turns that duty into a specific legal obligation, and adds a sharper edge: if the board fails, it can be held accountable, personally. Whether or not your organisation is in scope, the board's role is the same; NIS2 makes it urgent, enforceable, and personal for those it covers.
The Module looks at this from the board's side of the table: what the law requires of them, how to read cyber risk well enough to challenge it, and how to oversee a security programme without trying to run it. (The CISO's side of this same relationship (building the reports, registers and controls the board reviews) is covered in Modules 2 to 5. Where this Module refers to those, it does so in plain terms so it stands alone.)
Beyond NIS2
This Module uses NIS2 because it makes the board's duties concrete and legally binding. But the practice it describes, understanding cyber risk and overseeing it properly, is sound governance for any organisation. If NIS2 does not apply to you, treat it as the standard your board should hold itself to anyway; if it does, it is also the law.
What a board member will be able to do¶
- Explain why, under NIS2, the management body is now directly accountable for cybersecurity (and what that accountability concretely involves).
- Read a cyber risk presentation critically: ask the right questions, and not be misled by a tidy chart.
- Oversee and challenge a security programme (approving what must be approved, resourcing it, and avoiding the trap of rubber-stamping).
Chapters in this Module¶
| Chapter | Title |
|---|---|
| 6.1 | Why the board is now accountable |
| 6.2 | Reading cyber risk as a decision-maker |
| 6.3 | Overseeing and challenging the programme |
On the legal detail
This Module refers to specific Articles of the NIS2 Directive (notably Articles 20, 21, 32 and 34). NIS2 is a European directive, meaning each member state turns it into its own national law, and the exact wording, thresholds and penalties can vary by country. Scaldimet operates in Belgium and France, so two national transpositions apply. The principles in this Module hold across the EU; for the precise text that binds a given entity, always check the relevant national law.