NIS2 Directive Mandates Board Accountability for Cybersecurity Oversight
SC Media, Wednesday, November 4th, 2026
SC Media brief: NIS2 Article 20 makes EU boards approve and oversee cybersecurity measures, with possible personal liability.
Citing Security Affairs, this SC Media brief says Article 20 of the NIS2 directive requires the management bodies of essential and important entities to approve and oversee cybersecurity risk measures, including access controls, multi-factor authentication and asset management.
About 160,000 entities across the EU are affected, and directors may face personal liability.
Fines can reach 2% of global annual turnover for essential entities, and authorities may temporarily bar executives from managerial roles if failures persist.
Organizations are advised to assign clear ownership of access control and give boards transparent reporting on unresolved gaps and the resources needed.