The Network and Information Security Directive 2, or NIS2, places significant new responsibilities on management bodies regarding cybersecurity risk management, as reported by Security Affairs.
Under Article 20 of the directive, boards of essential and important entities must approve and oversee cybersecurity measures, including access controls. This mandate shifts the burden of compliance from IT departments to corporate leadership, who may face personal liability for failures. With approximately 160,000 entities affected across the European Union, directors are now required to ensure that security policies are not only approved but effectively implemented.
This includes overseeing multi-factor authentication and asset management. Because credential abuse remains a leading cause of data breaches, boards are increasingly demanding evidence that controls function as intended rather than accepting high-level policy summaries. Regulators have established significant enforcement powers, with potential fines reaching 2% of global annual turnover for essential entities.
Furthermore, authorities may temporarily prohibit executives from managerial roles if compliance failures persist. To mitigate these risks, organizations must designate clear ownership for access control and provide boards with transparent reporting on unresolved security gaps and the resources required to address them.
Source: Security Affairs
