Who is responsible for NIS2 in a company?

The management body. Article 20 of NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, to oversee their implementation and to answer for infringements, and requires their members to follow training. In practice that means the managing directors or the board cannot delegate the responsibility away to IT or to a provider, even though others do the work: they approve the measures, receive regular reports and must be able to show that oversight took place. National laws add the detail. In Germany, for example, section 38 of the BSIG obliges the management to implement and monitor the measures, makes it liable to the company under company law and requires regular training. Appoint a named person to run the programme day to day, and keep minutes of every review.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on NIS2 scope and dutiesAll topics