Why the board is now accountable¶
What you'll be able to do in this chapter
- State what NIS2 Article 20 requires of the management body: approve, oversee, train, be liable.
- Distinguish board oversight from executive execution.
- Understand the personal consequences the law now allows, and why they exist.
The question a director can no longer avoid¶
Imagine Scaldimet's board midway through a routine meeting. The agenda reaches "Cybersecurity update". For years, this item meant a short, reassuring note from IT, approved in two minutes. This time, a non-executive director asks a plain question: "If something goes badly wrong with cyber, who is actually answerable (and could that be one of us, personally)?"
A few years ago the answer would have been "the IT department, probably." Boards have always been responsible for steering and protecting the company. What has changed is that, for many sectors, NIS2 now makes cybersecurity oversight an explicit legal duty of the board itself, with potential personal consequences. This Lesson explains exactly what that means, without jargon, and what it requires the board to actually do.
'Board' and 'management body'
NIS2 places these duties on what it calls the management body. That term is deliberately broad: depending on national company law and how a firm is structured, the management body can be a single unitary board, a two-tier board with a separate supervisory board, or the executive directors themselves. This Module uses "board" as the everyday word for it, because in most organisations it is the board that carries these duties. If yours is structured differently, read "board" here as whichever body holds oversight in your structure, and note that executive directors are bound by these duties too, not only non-executive ones.
What NIS2 puts on the board¶
NIS2 replaced an earlier 2016 law (NIS1) that left cybersecurity largely to technical teams. One of its most consequential changes is a single Article that directly addresses the management body. The detail matters, so here is what it actually says (in substance).
Technical explainer (read & discuss, don't build): NIS2 Article 20
NIS2 Article 20 (titled "Governance") places two duties on the management bodies of in-scope entities:
Article 20(1): approve, oversee, be liable. Member states must ensure that management bodies approve the cybersecurity risk-management measures the entity takes (the measures required by Article 21), oversee their implementation, and can be held liable for the entity's failures to meet that obligation.
Article 20(2): be trained. Members of management bodies are required to follow training so they gain enough knowledge and skill to identify risks and assess cybersecurity risk-management practices and their impact on the entity's services. Entities are also encouraged to offer similar training to staff.
Three verbs to remember: approve, oversee, train. And one consequence: liability. These are legal duties under NIS2, rather than optional guidance.
Read those duties carefully, because each is a real obligation, not a formality.
Approve. The board must formally approve the organisation's cybersecurity risk-management measures. At Scaldimet, there is no record of the board ever having approved a single security measure (because there was never anything formal to approve, and no CISO to bring it). That gap is now a compliance failure waiting to be addressed.
Oversee. Approval once is not enough; the board must oversee that the measures are actually implemented and working. Oversight is ongoing (it implies regular reporting, questions, and follow-up). A signature in one set of minutes does not discharge it.
Train. Directors themselves must be trained (not to become security engineers, but to be able to understand and challenge what they are told). The law explicitly ties this to being able to assess cyber risk-management practices. A board that cannot read a risk report cannot oversee it; hence the training duty. (This Module is, in effect, exactly the kind of training Article 20(2) has in mind.)
Oversight is not execution, and the distinction protects you¶
The single most important idea for a director to hold is this: the board's job is to oversee, not to execute. These are different roles, and keeping them separate is both good governance and, practically, a way for the board to demonstrate that it is exercising proper oversight.
| The board (management body) | Executive / CISO | |
|---|---|---|
| Role | Direction, approval, oversight, accountability | Designing and running the measures |
| Typical act | "We approve this plan and will review progress quarterly" | "We have deployed multi-factor login across Site Alpha" |
| The question it owns | Are we doing the right things, and are they working? | Are we doing things right? |
This mirrors the governance-versus-management distinction from Chapter 1.2, now at the very top of the organisation. The board is not expected to choose firewalls or write policies (that is the CISO's job). The board is expected to ensure that someone competent is doing those things, that the approach is sound, that it is adequately resourced, and that it is reviewed. When a director tries to do the CISO's job, oversight suffers; when a director ignores the topic entirely, the law's accountability lands on them anyway. The intended role is engaged oversight.
The consequences, and how serious they are¶
Laws place duties on boards all the time. What makes NIS2 different is that it backs the board's duties with personal consequences, deliberately, to end the era of cybersecurity being treated as someone else's problem.
Technical explainer (read & discuss, don't build): the consequences
NIS2 backs its duties with real consequences, but the enforcement toolkit differs by entity type. Two tiers matter here.
What applies to an important entity like Scaldimet (Article 33). Supervision is reactive: regulators act on evidence of non-compliance rather than auditing by default. When they do act, they can issue binding instructions, order the entity to bring itself into compliance, and make the infringement public: a disclosure that can name the individuals responsible, not only the company. And they can impose administrative fines of at least €7 million or 1.4% of total worldwide annual turnover, whichever is higher (Article 34).
The stricter tier, reserved for essential entities (Article 32). For the most critical "essential" entities, regulators have two additional powers that do not apply to important entities: suspending the authorisations the entity needs to operate, and asking a court to temporarily ban a person at chief-executive or legal-representative level from holding managerial functions (Article 32(5)(b)). These do not apply to Scaldimet. They matter here only as a reference point: this is the regime the same company would fall under if it were classified as essential rather than important.
The exact scope of management-body liability is governed by applicable national law. Article 20 requires Member States to ensure that management bodies can be held liable for infringements by the entity of Article 21.
Why does any of this apply to Scaldimet at all? Because of what Scaldimet makes and how big it is, it falls within NIS2's scope as an important entity: the course's Compliance Module works through that classification in detail. For this Module, the relevant fact is simply: NIS2 applies to Scaldimet, so Article 20 applies to Scaldimet's board. The duties above are not hypothetical for these directors; they are live.
Where Scaldimet's board stands today
- The board has never formally approved a cybersecurity measure (there was nothing to approve and no CISO to bring it). Article 20(1) is currently unmet.
- There is no oversight mechanism: no regular cyber reporting to the board, no review. Ongoing oversight is currently absent.
- No director has been trained in cyber risk. Article 20(2) is currently unmet.
- The directors may face personal liability under a law most of them have not yet read.
The new CISO's early job is not only technical. It is to give this board something to approve, a way to oversee, and the training to do both (turning four unmet duties into a defensible position).
Application: oversight or execution?¶
Below are six actions around Scaldimet's cybersecurity. For each, decide whether it properly belongs to the board (oversight) or to the executive/CISO (execution). A couple are deliberately on the line.
- Formally approving the company's cybersecurity risk-management measures.
- Choosing which brand of firewall to install at Site Beta.
- Reviewing, each quarter, whether the agreed security improvements are on track.
- Writing the incident-response procedure.
- Setting the company's tolerance for production downtime (its risk appetite).
- Deciding whether the security budget the CISO has requested is adequate, and approving it.
Debrief. Board: 1 (the Article 20(1) approval duty), 3 (oversight), 5 (appetite is direction, a board decision), 6 (resourcing and approval are board responsibilities). Executive/CISO: 2 and 4 (both execution, product choice and procedure-writing). The instructive cases are 5 and 6: a board that approves measures (1) but never sets an appetite (5) or properly tests whether they are resourced (6) has signed off on something it cannot actually oversee. Approval without appetite and resourcing is the polished version of rubber-stamping (and Chapter 6.3 returns to it).
Key takeaway
Under NIS2 Article 20, Scaldimet's board must approve the organisation's cybersecurity measures, oversee their implementation, and receive appropriate training. Management bodies can also be held liable for infringements by the entity of Article 21, subject to the applicable national law. For an important entity like Scaldimet, the law backs this with administrative fines (up to €7 million or 1.4% of worldwide turnover), binding corrective orders, and public disclosure that can name those responsible; the one measure Scaldimet does not face, a temporary ban on senior managers, is reserved for the more critical essential entities. The board's role is oversight, not execution: it should ensure that appropriate measures are approved, implemented, resourced and reviewed. Closing these governance gaps should be an early priority for the new CISO.
Next: Chapter 6.2 · Reading cyber risk as a decision-maker →