# Who should own cyber security in a small company?

One named person at management level, even if others do the work. In a small company that is often the managing director or the finance director, with an IT manager, a lone administrator or an outside IT provider doing the day-to-day tasks. Ownership means setting priorities and budget, receiving the quarterly picture and being the person who is called when an incident starts. Without a named owner, tasks fall between IT, finance and the provider, and nobody notices until something breaks. Write down who owns what, including who may decide to disconnect systems or call the insurer. Under NIS2, responsibility for approving and overseeing the security measures sits with the management body, whoever does the work. No tool can own the risk for you.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [What should the CEO do in the first hour of a cyber incident?](https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident)
- [Who in the company should decide on a ransom demand?](https://netsenx.com/en/faq/who-should-decide-on-a-ransom-demand)
- [Which payment controls stop invoice fraud and fake CEO requests?](https://netsenx.com/en/faq/which-payment-controls-stop-invoice-and-ceo-fraud)
- [Should cyber risk be in the company risk register?](https://netsenx.com/en/faq/should-cyber-risk-be-in-the-company-risk-register)
- [How should the board approve a cyber security budget?](https://netsenx.com/en/faq/how-should-the-board-approve-a-cyber-security-budget)