Does directors and officers insurance cover NIS2 fines or management liability?

Partly at most, and it depends on national law and the policy. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. makes the management bodies of entities in scope responsible for approving and overseeing cybersecurity risk-management measures, and national laws attach consequences: in Germany, section 38(2) of the BSIG makes managing directors liable under company law for breaching that duty. Directors and officers (D&O) insurance can cover the cost of defending a claim and damages a manager owes the company or third parties. Administrative fines are a different matter: whether they can be insured at all is decided by national law and public policy, and many policies exclude them. Read three things with your broker: whether the D&O policy excludes cyber events or refers them to the cyber policy, whether fines are covered where the law allows, and how the two policies interact. Insurance does not remove the duty itself, which is to approve and oversee the measures. NetSenX has no role in insurance cover.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on Cyber insuranceAll topics