NIS2 Directive Makes Board Members Personally Liable for Access Control Decisions
Original title: NIS2 Makes Board Members Personally Liable for Access Control Decisions
Management bodies must approve and oversee cybersecurity risk-management measures under the EU NIS2 directive and can face liability.
Article 20 of the NIS2 directive requires management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. The directive covers approximately 160,000 entities across the EU. Access control is one required measure. Boards need evidence that controls are working in practice, including who can access critical systems and why.
Unconfirmed: Implementation is still catching up in parts of Europe
- Board members must undergo cybersecurity training and offer it to employees
- Greece requires appointment of an Information and Communication Systems Security Officer
- Maximum fines up to €10,000,000 for essential entities
- CISO may be responsible for risk without controlling budget or teams
- Countries
- EU
From the original article
5 min read at securityaffairs.com
NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work. NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by […]
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.