NIS2 Art. 20 is a paradigm shift: cybersecurity is a board-level matter. Boards and executives must approve cybersecurity measures, monitor their implementation and can be held personally liable — a major change from NIS1.
Management obligations under NIS2 Art. 20
NIS2 Art. 20 requires management to: (1) approve cybersecurity measures under Art. 21, (2) oversee implementation — regular reports to management, (3) attend cybersecurity training — board members must acquire knowledge to assess risks, (4) personal liability for violations — management can be directly held accountable.
NIS2 macht Cybersicherheit zur persönlichen Pflicht der Unternehmensführung. Fahrlässige Verstöße können zu direkten Bußgeldern gegen Vorstände und Geschäftsführer führen.
Governance structures for NIS2
For NIS2 compliance: (1) CISO role at C-level or direct reporting line to board, (2) regular cybersecurity reports to supervisory board and executive board (at least quarterly), (3) documented approval of all material security measures by management, (4) evidence of completed cybersecurity training by management, (5) clear escalation paths for security incidents.
360TPRM liefert automatisierte Executive-Reports und Compliance-Dashboards — damit Vorstände jederzeit den Cybersicherheitsstatus überblicken und NIS2-konform handeln können.
FAQ
Implement NIS2 governance
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →