Cybersecurity Is a Boardroom Responsibility: What NIS2 Changes for Organisations

Digital4Security Microcredential Insights

Cybersecurity Is a Boardroom Responsibility: What NIS2 Changes for Organisations

By Giorgio Pedrazzi, University of Brescia

When a cyberattack disrupts an organisation, the immediate questions are often technical. Which systems have been compromised? Can the attack be contained? How quickly can operations resume?

Yet equally important questions concern leadership and accountability. Who was responsible for anticipating the risk? Were adequate security measures approved? Who decides whether an incident must be reported to the authorities?

These are not simply IT questions. They concern corporate governance, legal accountability and organisational resilience. As European cybersecurity legislation evolves, organisations must understand how legal obligations and technical security responsibilities intersect.

From Technical Security to Corporate Governance

For many years, organisations treated cybersecurity primarily as an IT responsibility. Senior management approved budgets, while technical specialists handled infrastructure protection, security policies and incident response.

However, the consequences of cybersecurity incidents now extend far beyond affected systems. Attacks can interrupt essential services, compromise personal information, disrupt supply chains and generate substantial financial losses.

The EU’s NIS2 Directive (Directive (EU) 2022/2555) reflects this broader understanding of cybersecurity.

Under Article 20, Member States must ensure that management bodies of entities covered by the relevant provisions approve cybersecurity risk-management measures and oversee their implementation. Management bodies must also receive cybersecurity training and can be held liable for infringements concerning these measures, subject to applicable national law.

This does not mean that directors must become cybersecurity engineers. It means that management needs sufficient awareness to understand risks, approve appropriate measures and oversee how cybersecurity responsibilities are fulfilled.

What Does Effective Cybersecurity Governance Require?

Consider a medium-sized company operating in a sector covered by NIS2. Its IT department identifies serious vulnerabilities in a system supporting essential business operations.

Addressing these weaknesses requires investment, potential service interruptions and coordination with external suppliers.

Technical specialists can identify vulnerabilities and recommend solutions, but decisions about resources, operational priorities and organisational responsibilities require management involvement.

Article 21 of NIS2 requires covered entities to adopt appropriate and proportionate technical, operational and organisational cybersecurity risk-management measures. These include risk analysis, incident handling, business continuity, supply-chain security, staff training and procedures for evaluating security effectiveness.

Four Questions Every Organisation Should Consider

• Are cybersecurity risks regularly assessed and communicated to decision-makers?
• Who has authority to approve significant risk-management decisions?
• Are responsibilities clearly allocated between IT, compliance, legal advisers and senior management?
• Can the organisation demonstrate that security measures have been implemented and reviewed?

A written cybersecurity policy alone cannot answer these questions. Effective governance requires clear decision-making processes, appropriate resources, communication between departments and evidence that identified risks are being addressed.

When Cybersecurity Incidents Become Legal Challenges

Imagine that an organisation discovers a ransomware attack affecting a critical system.

The incident response team must investigate the attack, contain the threat, preserve relevant evidence and restore operations.

At the same time, management must consider the implications for customers, business continuity, contractual obligations and regulatory reporting.

Under Article 23 of NIS2, entities subject to the relevant reporting obligations must notify significant incidents through a staged process. This generally includes an early warning within 24 hours and an incident notification within 72 hours of becoming aware of a significant incident, followed by further reporting.

Not every cybersecurity event is reportable. Organisations must assess the applicable significance criteria and national implementation requirements.

Other legislation may also apply. For example, where an incident involves personal data, the General Data Protection Regulation (GDPR) may impose separate personal data breach notification obligations.

These overlapping responsibilities demonstrate why cybersecurity compliance cannot be managed through a checklist in a single department. Technical response, legal assessment and management decision-making must work together.

Understanding Europe’s Cybersecurity Regulatory Landscape

Although NIS2 establishes common requirements across the European Union, it is a directive implemented through national legislation.

Organisations therefore need to understand the laws, supervisory arrangements and reporting obligations applicable in the countries where they operate.

This is particularly important for multinational businesses. Common internal cybersecurity policies may provide consistency, but the legal requirements applicable to individual entities and activities can differ between jurisdictions.

Organisations must also consider how NIS2 interacts with other European legal frameworks, including data protection requirements and sector-specific cybersecurity legislation.

Compliance therefore requires more than familiarity with individual regulations. It requires the ability to interpret how legal obligations interact and translate them into practical organisational procedures.

Turning Legal Obligations into Organisational Resilience

Strong cybersecurity governance depends on cooperation between technical specialists, legal and compliance professionals, and organisational leadership.

Technical teams identify threats and develop protective measures. Legal and compliance specialists interpret regulatory obligations. Management allocates resources, determines priorities and oversees organisational risk.

Crucially, these functions must communicate before a cybersecurity incident occurs, rather than attempting to establish responsibilities during a crisis.

A useful starting point for organisations is to answer three questions:

1. Who identifies cybersecurity risks?
2. Who decides how those risks should be addressed?
3. Who verifies that the decisions have been implemented?

If these responsibilities are unclear, investing in additional technology alone may not be sufficient.

Cybersecurity resilience begins when technical capability, legal awareness and organisational accountability work together.