NIS2 Management Liability: Board Accountability and Training (Article 20)

What Boards Need to Show

• Formal approval of risk-management measures aligned to Article 21
• Periodic oversight (metrics, significant incidents, supplier risk, audit findings)
• Documented management-body cybersecurity training
• Clear delegation without abandoning accountability

Training Expectations

Article 20 emphasises that members of management bodies follow training to identify risks and assess cybersecurity risk-management practices — tabletop briefings and one-slide “awareness” decks rarely meet that bar.

Practical Cadence

• Quarterly cyber risk dashboard to the board or risk committee
• Annual deep-dive on Article 21 gaps and Article 23 readiness
• Immediate escalation path for significant incidents

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does Article 20 create personal liability automatically?

The Directive requires Member States to ensure management bodies can be held liable for infringements of Article 21 duties. Exact personal sanctions depend on national transposition — confirm national law.

Can the CISO replace board training?

No. Management-body members themselves need appropriate training under Article 20 themes.

What evidence helps in a supervisory review?

Board minutes approving measures, training attendance records, and recurring oversight reports mapped to Article 21 status.

Related NIS2 Resources

NIS2 hub · Checklist · CSA