NIS2: what the directive requires of senior management

The NIS2 directive changes where cybersecurity sits in a company. It no longer addresses technical teams only: it names management bodies as responsible for cybersecurity risk-management measures. For the leaders of essential and important entities, this is a personal obligation, not something delegated to the CISO.

What Article 20 requires of management

Article 20 of the directive sets three obligations for management bodies:

• approve the cybersecurity risk-management measures taken by the entity;
• oversee their implementation;
• follow training, so that they can identify risks and assess risk-management practices and their impact on the entity’s services. Member States are also encouraged to have all staff trained regularly.

The directive provides that members of management bodies can be held liable for infringements of these obligations. Cybersecurity becomes a governance matter, like financial risk.

The ten measures to approve

Article 21 sets the baseline of measures management must approve, following a risk-based approach:

1. risk analysis and information system security policies;
2. incident handling;
3. business continuity, backups and crisis management;
4. supply chain security, including relationships with suppliers;
5. security in the acquisition, development and maintenance of systems, including vulnerability handling;
6. policies to assess the effectiveness of the measures;
7. basic cyber hygiene practices and training;
8. cryptography and, where appropriate, encryption;
9. human resources security, access control and asset management;
10. multi-factor authentication and secured communications.

This is the list management will have to answer for: not intentions, but measures that are in place and whose effectiveness is assessed.

Reporting an incident: 24 hours, 72 hours, one month

Article 23 governs the reporting of significant incidents to the authority or CSIRT:

• an early warning within 24 hours of becoming aware of the incident;
• an incident notification within 72 hours;
• a final report no later than one month after the notification.

These deadlines require a decision chain ready in advance: who classifies the incident, who approves the notification, who speaks to the authority. That is a management decision, to prepare before the crisis.

Group-level penalties

Article 34 provides for administrative fines with a maximum of at least €10 million or 2% of total worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher.

In France: act without waiting for the law

France has not yet transposed NIS2. The bill on the resilience of critical infrastructure and the strengthening of cybersecurity was adopted by the Senate on 12 March 2025 and by the National Assembly’s special committee on 10 September 2025. After several postponements, its debate in the National Assembly is scheduled from 9 November 2026.

ANSSI has nonetheless published the Référentiel Cyber France (ReCyF), which describes the security objectives expected of the entities concerned. It already gives a concrete basis to measure the gap between what a company declares and what it can prove.

What to remember

NIS2 makes cybersecurity a management responsibility. Leaders must be able to show that they approved appropriate measures, that they follow their implementation and that they have been trained. Start by measuring the gap between the applicable requirements and operational reality, then give management a course it can defend before the authority: that is what Trusted Assessment does.