Management responsibility

NIS2 Article 20(1) requires member states to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken under Article 21, oversee their implementation and can be held liable for infringements of that article. Article 20(2) requires members of the management body to follow training and encourages entities to offer similar training to employees regularly, so that leaders can identify risks and assess risk-management practices. The directive does not define "management body"; national company law decides, which in Denmark's two-tier model can mean both the board (bestyrelse) and the executive management (direktion). The Danish NIS2 Act implements these duties in § 7.

The enforcement side sits in the supervision articles. Articles 32(6) and 33(5) require that natural persons responsible for, or acting as legal representatives of, an entity can be held liable for breaching their duty to ensure compliance, and Article 32(5)(b) allows, for essential entities only and only after other measures have failed, a temporary ban on a person at CEO or legal-representative level from exercising managerial functions. The Danish act contains the corresponding power in § 23. Similar thinking appears elsewhere: DORA Article 5(2) makes the management body of a financial entity bear ultimate responsibility for ICT risk, and GDPR Articles 5(2) and 24 place accountability on the controller as an organisation.

ISO/IEC 27001:2022 expresses the same idea in management-system terms. Clause 5.1 lists what top management must demonstrate, from ensuring that the policy and objectives fit the strategic direction and that resources are available, to directing people, promoting continual improvement and supporting other managers in their areas. Clause 5.2 makes top management establish the policy, 5.3 makes it assign and communicate roles, and 9.3 requires it to review the ISMS at planned intervals and record decisions.

The recurring misconception is that the duty can be delegated. Execution can be delegated to a CISO, an IT department or a managed service provider; approval, oversight and accountability cannot. In practice supervisors and auditors look for evidence rather than statements: minutes in which the board approved the measures and a risk appetite, dated training records for each member, periodic reporting with decisions attached, and follow-up on audit findings. A signature on a policy document that the board never discussed rarely satisfies either an auditor or a supervisory authority.