What do board members have to approve under NIS2 Article 20?
The cybersecurity risk-management measures the entity takes under Article 21, and they must also oversee how those measures are implemented. In practice, the board approves a short set of documents and decisions: the risk assessment and the resulting priorities, the security policies that cover the ten areas of Article 21(2), the incident-handling and reporting procedure, the business continuity and backup plan, the supplier-security approach, and the budget and owners for each. Approval is not a single signature: the board should receive regular reports on whether the measures work, decide on gaps and record its decisions. Ask for evidence, not just policies, such as restore tests, monitoring coverage and incident records. NetSenX can supply evidence for detection and incident handling on the network; approving the rest remains the board's job.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- How can a managing director check that cyber measures actually work?
- Does NetSenX cover all NIS2 Article 21 measures?
- Does buying a security tool make us NIS2 compliant or registered?
- Which NIS2 tasks can software help with, and which can it not?
- Does NIS2 require a specific security tool, such as intrusion detection?