# Who is responsible for NIS2 in a company?

The management body. Article 20 of NIS2 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, to oversee their implementation and to answer for infringements, and requires their members to follow training. In practice that means the managing directors or the board cannot delegate the responsibility away to IT or to a provider, even though others do the work: they approve the measures, receive regular reports and must be able to show that oversight took place. National laws add the detail. In Germany, for example, section 38 of the BSIG obliges the management to implement and monitor the measures, makes it liable to the company under company law and requires regular training. Appoint a named person to run the programme day to day, and keep minutes of every review.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/who-is-responsible-for-nis2-in-a-company

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Is NIS2 mandatory for a company with fewer than 50 staff?](https://netsenx.com/en/faq/is-nis2-mandatory-for-companies-with-fewer-than-50-staff)
- [Can a small subsidiary be in NIS2 scope because of its group?](https://netsenx.com/en/faq/can-a-small-subsidiary-be-in-nis2-scope-because-of-its-group)
- [Our customer is in NIS2 scope. Do we have to comply too?](https://netsenx.com/en/faq/our-customer-is-in-nis2-scope-do-we-have-to-comply)
- [What does NIS2 require from a mid-sized company in scope?](https://netsenx.com/en/faq/what-does-nis2-require-from-a-mid-sized-company)
- [What are the ten risk-management measures in NIS2 Article 21?](https://netsenx.com/en/faq/what-are-the-ten-nis2-article-21-measures)