In brief
- Management approval is explicit. NIS2 Article 20 requires Member States to ensure that management bodies of essential and important entities approve the cybersecurity risk-management measures taken to comply with Article 21 and oversee their implementation.
- Board visibility should be decision-oriented. Directors do not need a stream of technical telemetry. They need ownership, material risks, exceptions, incidents, dependencies, overdue actions and evidence that agreed measures are operating.
- Training is part of the governance model. NIS2 also requires members of management bodies to follow training so they can identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.
- Evidence matters. Minutes, approvals, risk acceptance, management reporting, action tracking and escalation records are often more useful than another slide deck saying cyber risk is high.
What NIS2 changes at management level
NIS2 does not treat cybersecurity as a matter that can simply be delegated to IT and forgotten. Article 20 connects the management body to the cybersecurity risk-management measures in Article 21. At EU Directive level, the management body is expected to approve those measures and oversee their implementation. National transposition determines the precise legal mechanics, supervisory approach and sanctions in each Member State, so organisations should verify the law that applies in their jurisdiction.
This distinction matters. Approval is not the same as receiving an annual presentation. Oversight is not the same as asking whether the firewall is patched. A management body needs a repeatable way to understand whether material cyber risks are owned, whether required measures are in place, where exceptions exist and whether the organisation can prove that the governance process works.
Governancy view: NIS2 board reporting becomes useful when every item on the agenda can lead to a decision, challenge, acceptance, escalation or follow-up. If the board cannot act on the information, it is probably operational reporting rather than governance.
What management should be able to see
Material cyber risks
The small number of risks that could materially disrupt services, breach obligations or create unacceptable exposure. Include trend, treatment status and named owner.
Control and programme status
Whether the agreed cybersecurity measures are operating, where implementation is late and which weaknesses are significant enough for management attention.
Incidents and readiness
Material incidents, near misses, lessons, notification readiness, crisis exercises and whether recovery arrangements are credible.
Supplier exposure
Critical third parties, material supplier exceptions, concentration risk and dependencies that can affect continuity or security.
Exceptions and risk acceptance
Where the organisation knowingly operates below policy or target, who accepted the risk, why, for how long and what compensating measures exist.
Assurance and evidence
Internal audit, testing, monitoring, vulnerability management and other evidence showing whether the governance model is reliable.
Translate Article 21 into a board control map
Article 21 sets out the cybersecurity risk-management measures that essential and important entities must address through appropriate and proportionate technical, operational and organisational measures. The list includes areas such as risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, assessment of effectiveness, cyber hygiene and training, cryptography where appropriate, access and asset management, and multi-factor or continuous authentication where appropriate.
The board does not need to review every technical control. It does need a map showing how these areas are governed and who owns them. A practical board control map can look like this:
| Governance area | Management should know | Useful evidence |
|---|---|---|
| Risk management | What the material cyber risks are and whether risk treatment is within appetite. | Approved risk methodology, risk register, treatment decisions, acceptance records. |
| Incident handling and continuity | Whether significant incidents can be detected, escalated, reported and recovered from. | Incident process, exercises, notification playbook, recovery tests, lessons learned. |
| Supply chain | Which suppliers can materially affect services and where unacceptable dependencies remain. | Tiering, supplier assessments, contract clauses, exceptions, monitoring, exit or contingency plans. |
| Control effectiveness | Whether key measures actually work, not simply whether policies exist. | Internal audit, testing, metrics, vulnerability trends, corrective actions. |
| People and access | Whether critical roles, access and security awareness are controlled proportionately. | Joiner/mover/leaver evidence, privileged access reviews, training completion, exceptions. |
What does effective NIS2 board oversight look like for you?
Our NIS2 Board Training connects management accountability with practical decisions, risk oversight and evidence.
Explore NIS2 Board TrainingWhat belongs in a useful NIS2 board pack
A board pack should be short enough to read and structured enough to challenge. A practical quarterly or periodic pack can contain seven sections:
Decision summary
Start with what requires approval, acceptance or escalation. Do not make directors hunt for decisions on slide 28.
Risk movement
Show the material risks that increased, decreased or changed in nature, with a short explanation of why.
Control health
Use a small number of indicators that reveal whether the control environment is improving or deteriorating. Avoid vanity metrics such as raw alert counts without context.
Incidents and resilience
Summarise material incidents, near misses, exercises and recovery issues. Connect them to business impact and lessons.
Supplier dependencies
Highlight critical third parties, unresolved exceptions and concentration that could affect service continuity.
Overdue actions and exceptions
Show what is late, who owns it, why it remains open and what risk management is accepting in the meantime.
Assurance
Summarise internal audit, testing and other independent evidence. Management should see where its own confidence has been challenged.
Where technical reporting ends and governance begins
| Technical reporting | Governance reporting |
|---|---|
| We detected 18,000 security events. | Two event patterns indicate an increased risk to a critical service; treatment is owned and due by a defined date. |
| 92% of critical patches met the SLA. | The remaining 8% includes three internet-facing assets outside tolerance; management has an escalation and temporary control decision. |
| Phishing click rate is 4%. | High-risk functions remain above target despite training; the proposed intervention and owner are clear. |
| Supplier questionnaires are 70% complete. | All tier-1 suppliers have been assessed; two critical dependencies remain under temporary exception with executive owners. |
The governance version does not remove technical detail. It translates the detail into business significance, ownership and action.
What demonstrable oversight looks like
- Formal approval: the management body can show when relevant cybersecurity measures, policies or risk frameworks were approved.
- Recurring oversight: cyber risk appears on a defined governance cadence, not only after incidents.
- Named ownership: material risks and remediation actions have accountable owners and dates.
- Challenge and decisions: minutes show questions, decisions, acceptance or escalation rather than passive receipt of information.
- Training: management-body training is planned and evidenced, with content relevant to the entity's risks and services.
- Follow-through: overdue actions and accepted exceptions come back until they are resolved, renewed or escalated.
Five questions directors should be able to answer
1. What can materially stop our service?
Not every cyber risk belongs at board level. The board should understand the risks with serious operational, legal, customer or societal consequences.
2. Where are we knowingly below target?
Exceptions are governance decisions. Directors should know the material ones, their duration and their compensating measures.
3. Which suppliers can hurt us most?
Supplier risk becomes board-relevant when dependency, criticality or concentration can materially affect the entity.
4. How do we know our measures work?
Policies describe intent. Audit, testing, exercises, metrics and operating records provide stronger evidence.
5. What needs a decision today?
Good reporting ends with a clear request for approval, challenge, acceptance, investment or escalation.
Common failure modes
Three patterns repeatedly weaken NIS2 governance. First, cybersecurity reporting is delegated so far down the organisation that management only sees a technical dashboard. Second, responsibility is assigned to a CISO or IT manager without making business owners accountable for risk decisions. Third, the organisation produces evidence only when an auditor or supervisor asks for it. The stronger model is continuous: decisions, ownership and evidence are created as part of normal governance.
Primary sources
- Directive (EU) 2022/2555, in particular Articles 20 and 21
- Commission Implementing Regulation (EU) 2024/2690, where applicable to the entity types within its scope
Practical next step: If management receives cyber reporting but cannot see ownership, exceptions and evidence, start by redesigning the governance view. Discuss the scope with Governancy.