NIS2: A Game-Changer For Senior Management And Boards

Cybersecurity is a standing agenda item and business-critical concern at the highest levels of most organisations.

In most instances, however, responsibility for and oversight of cybersecurity has been given to IT teams, CISOs, and CTOs. The Network and Information Security 2 Directive (NIS2) is a game-changer for in-scope entities because cybersecurity is no longer siloed to IT but instead extends to board members and senior management (referred to as "management bodies") in certain critical sectors.

NIS2 imposes direct and significant responsibilities on board members and senior management to be involved in cybersecurity. Since October 2024, NIS2 requires board members and senior management to understand, oversee and implement effective cybersecurity risk management practices to ensure their organisations are operationally resilient.