CYBERSECURITY & IT GOVERNANCE · EXPERT ARTICLE
NIS2 and management liability
NIS2 shifts cybersecurity from the specialist department to the responsibility of management. Those who approve measures must also understand them — and oversee their effectiveness.
Governance First editorial team·8-minute read
The decisive innovation of NIS2 is not the catalogue of measures — it is largely familiar from ISO 27001 and BSI IT-Grundschutz. What is new is the personal obligation of management bodies to approve cybersecurity risk-management measures, oversee their implementation and undergo training.
Clarify applicability first
Sector, size and role in the supply chain determine whether an entity is ‘essential’ or ‘important’ — and therefore the supervisory regime and reporting obligations. Many companies underestimate indirect applicability: as a supplier to a regulated customer, NIS2 requirements arrive in-house through the contract.
Reporting channels that work in an emergency
Early warning, incident notification, final report — the deadlines are short and run from the time of awareness, not from the time of analysis. Anyone who has not rehearsed the reporting chain loses the first hours on questions of responsibility. A robust process names decision-makers, deputies and escalation by name.
‘A reporting obligation that is only read during an incident is not governance — it is a risk.’
The supply chain as an object of control
Third-party risks must be assessed, anchored in contracts and monitored. A tiered model makes sense: criticality classes, a matching depth of evidence and a register that is shared with DORA requirements instead of duplicating them.
Evidence instead of intentions
Supervisory authorities ask about effectiveness. That means: tests, results, derived measures, re-testing. Anyone who hooks this cycle into existing control systems does not need to build a second governance world.
FIVE QUESTIONS FOR THE NEXT MANAGEMENT MEETING
- Are we essential, important or indirectly affected — and can we prove it?
- Who reports in an emergency, within what deadline, to which authority?
- Which suppliers are critical, and what is regulated by contract?
- When did we last test effectiveness?
- Is the training of the management bodies documented?
Have your NIS2 applicability checked
We assess your classification, reporting channels and supply chain obligations in a compact assessment.
