Who should own cyber security in a small company?

One named person at management level, even if others do the work. In a small company that is often the managing director or the finance director, with an IT manager, a lone administrator or an outside IT provider doing the day-to-day tasks. Ownership means setting priorities and budget, receiving the quarterly picture and being the person who is called when an incident starts. Without a named owner, tasks fall between IT, finance and the provider, and nobody notices until something breaks. Write down who owns what, including who may decide to disconnect systems or call the insurer. Under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., responsibility for approving and overseeing the security measures sits with the management body, whoever does the work. No tool can own the risk for you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 40 questions on For the board and financeAll topics