NIS2 and board responsibility – why cybersecurity is no longer just an IT department issue

For years, cybersecurity in most companies followed the same pattern: the IT department purchased firewalls and antivirus software, set passwords and responded to incidents. The board of directors received an annual report, nodded in agreement and went back to ‘real business’. NIS2 puts an end to this model. The Directive not only requires the implementation of specific security measures – it demands the personal involvement of senior management and places a responsibility on the board that cannot be delegated to the IT department or passed on to an external provider.

What NIS2 says about the responsibilities of the board of directors – verbatim

NIS2 is exceptionally precise in this regard. The Directive imposes specific obligations on the management bodies of critical and important entities:

Approval of risk management measures. The board must approve the cybersecurity measures implemented within the organisation – it cannot simply delegate this responsibility. This means that decisions regarding the level of security, investment priorities and acceptable risk must be taken at board level, and not solely by the CISO or the IT department.

Oversight of implementation. The board is responsible for ensuring that the required measures are actually implemented and functioning – not merely set out in documentation. The supervisory body may verify whether the board has fulfilled its supervisory duties.

Cybersecurity training. Members of the board must regularly attend cybersecurity training. There is no exception here for chairpersons who ‘are not technically minded’ – NIS2 expects the board to understand the threats and be able to make informed decisions regarding risk.

Personal liability. Where breaches of NIS2 are identified, supervisory authorities may impose sanctions directly on individuals holding management positions – including a temporary ban on holding management roles. This is not an abstract corporate risk. It is a personal risk for the CEO, board members and directors.

Sanctions that pack a punch – and which nobody wants to face

NIS2 introduces a system of sanctions that places cybersecurity on a par with the GDPR in terms of financial severity.

For critical entities, the maximum administrative fine is 10 million euros or 2 per cent of total global turnover – whichever is higher. For important entities, the upper limit is €7 million or 1.4 per cent of turnover. Added to this are penalties for late reporting of incidents, lack of required documentation and failure to comply with a supervisory authority’s order.

But financial sanctions are only part of the picture. NIS2 also provides for:

• Public disclosure of a breach – the supervisory authority may publicly disclose information about a company’s non-compliance with the requirements of the Directive. For a company operating in a regulated sector or serving corporate clients, this is potentially a more serious blow than the financial penalty itself
• Orders to suspend operations – in extreme cases, the authority may order a temporary suspension of service provision until the breaches have been rectified
• Disqualification from holding managerial positions – for individuals responsible for the breaches

No insurance policy fully covers these risks. The only effective protection is compliance with the requirements.

How to turn an obligation into an advantage – because it is possible

NIS2 is primarily seen as a set of regulations imposing obligations. However, companies that approach it strategically can turn compliance into a competitive advantage.

Compliance with NIS2 means establishing or systematising a cybersecurity management system – with a documented risk assessment, incident response procedures, supplier oversight and trained management. This is precisely the level of security maturity that large corporate clients, financial institutions and public sector partners are increasingly expecting.

A company that has undergone the NIS2 compliance process and can document this has a strong selling point in commercial negotiations with demanding clients. Security questionnaires completed during supplier qualification, questions about incident management procedures, and supply chain security requirements – a NIS2-compliant company has ready, documented answers to all these questions.

Within a few years, NIS2 compliance will become the market standard in the sectors covered by the directive. Companies that have adapted early will be seen as mature and trustworthy. Companies that have waited will be playing catch-up, trying to reach the starting point where their competitors were already two years earlier.

→ Cybersecurity is no longer merely an operational cost. It has become a key factor in business credibility. And that is precisely why NIS2 – even though it sounds like yet another EU regulation to tick off a list – is in fact an opportunity to build something that cannot be acquired at the last minute.