NIS 2 – A New Era For Management Bodies

There is no doubt that the Network and Information Security Directive (EU) 2022/2555 (“NIS 2”) significantly raises the bar for cybersecurity requirements in the EU. NIS 2 sets out various mandatory requirements for in-scope entities delivering critical or essential goods and services, including the implementation of robust cybersecurity risk management measures and strict incident reporting requirements.

One of the most significant changes introduced by NIS 2 relates to the introduction of an accountability obligation on management bodies.  The traditional approach of allocating responsibility for managing  cybersecurity risks to IT functions is no longer sustainable. NIS 2 makes management bodies directly responsible for approving and overseeing the implementation of cybersecurity risk management measures.  Most importantly, management bodies can be held personally liable for failure to implement those measures.  This is a game changer for the way in which in-scope entities must