Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If a board member asks about their personal liability under NIS2, then what do I say?

4 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Say in plain terms what NIS2 asks of the board, and hand the question of personal exposure to legal counsel. Do not reassure the director that they are not liable, and do not give a legal opinion.
Reasoning
Directors ask because they have read that the law now names them. As the pack puts it, NIS2 has the management body approve the cyber risk-management measures and oversee how they are carried out, its members follow training, and management bodies can be held liable for infringements of those duties under the national law that applies. What that means for one director is a question for legal counsel. A reassurance recorded in the minutes is hard to live with later. What you can speak to is oversight: decisions in the minutes and actions followed up are the evidence that the board oversees cyber risk rather than simply hearing about it.
Considerations
  • This is not legal advice. Whether and how a director could be personally liable depends on national law and the facts, and is a question for the organisation's legal counsel.
  • Whether NIS2 applies is a legal determination. If legal or compliance has not confirmed it, say so and give the date the board will have the answer. If another regime such as DORA applies instead, report counsel's view as counsel's.
  • The pack treats board training at least once a year as its default. NIS2 requires the training and sets no interval. If you do not know whether every director is trained, treat it as incomplete.
  • If you are in scope of NIS2 or DORA, expect the regulation and liability questions at every meeting until the board is confident of its own duties.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA director asks: "Could I be personally liable?"StepDo not reassure, and do not give a legal opinionDecisionHas legal counsel confirmed whether NIS2 applies to us?StepSay scope is not yet confirmed, and who is confirming itStepGive counsel's view on scope, and any other regimeStepSay in plain terms what NIS2 asks of the boardDecisionIs legal counsel in the room, or has it given a view?StepHand the question to legal counselStepSay it is for legal counsel, and commit to a dateStepPoint to the board's best protection: recorded oversightDecisionHas every director had cyber training in the last 12 months?StepPropose a date for the missing trainingDecisionDo the minutes show the board's cyber decisions and follow-up?OutcomePropose minuted decisions and an action log from now onOutcomeAgree the answers with counsel before the next meeting

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    A director asks: "Could I be personally liable?"

    Directors ask because they have read that the law now names them. The question is uncomfortable because the honest answer is uncertain and partly outside your authority. Reporters most often get it wrong by trying to reassure.

    In the pack

  2. Step

    Do not reassure, and do not give a legal opinion

    Telling a director they are not liable is the trap: you are not their lawyer, and a reassurance recorded in the minutes is hard to live with later. Say what the regulation requires in plain terms and point to legal advice. Legal questions may belong to someone else in the room.

    In the pack

  3. Decision

    Has legal counsel confirmed whether NIS2 applies to us?

    The board's duties under NIS2 depend on whether the organisation is in scope, and why. That is a legal determination, confirmed by legal or compliance and kept as a one-page summary of the regulation that applies.

    In the pack

  4. Step

    Say scope is not yet confirmed, and who is confirming it

    Do not guess whether the organisation is in scope. Say that legal or compliance is confirming it, and give the date the board will have the answer. Have it recorded in the board's action log.

    In the pack

    See also

  5. Step

    Give counsel's view on scope, and any other regime

    Report counsel's conclusion as counsel's, not your own. Say whether another regime, such as DORA, applies instead. Under DORA the management body bears ultimate responsibility for ICT risk.

    In the pack

  6. Step

    Say in plain terms what NIS2 asks of the board

    The management body approves the cyber risk-management measures and oversees how they are carried out (NIS2 Article 20(1)), and its members follow training. NIS2 allows management bodies to be held liable for infringements of those duties, under the national law that applies. Stop there: what that means for one director is not yours to say.

    In the pack

  7. Decision

    Is legal counsel in the room, or has it given a view?

    The question of personal exposure is one for legal counsel. The rehearsal should have agreed in advance who answers legal questions. If counsel has given a written view, it is counsel's to present.

    In the pack

  8. Step

    Hand the question to legal counsel

    Say who should answer, and let them. Do not add a gloss of your own to their answer.

    In the pack

  9. Step

    Say it is for legal counsel, and commit to a date

    Say that personal exposure is a legal question, that you will ask legal counsel for a view, and when the board will have it, normally within 5 working days in the pack's defaults. Have it recorded as an action and chase it.

    In the pack

  10. Step

    Point to the board's best protection: recorded oversight

    What you can speak to is oversight. The board's decisions recorded in the minutes and its actions followed up to closure are the evidence that it oversees cyber risk rather than simply hearing about it.

    In the pack

  11. Decision

    Has every director had cyber training in the last 12 months?

    NIS2 expects members of the management body to follow training, and the pack treats at least once a year as the expectation. Board training is the board's own measure. If you do not know, treat it as incomplete.

    In the pack

  12. Step

    Propose a date for the missing training

    Present it as the board's own measure, with a date, not as an awkward gap to skip. Say how many directors have completed training, what it covered and when the next session is.

    In the pack

  13. Decision

    Do the minutes show the board's cyber decisions and follow-up?

    Look for each decision on a cyber ask recorded in the minutes, and an action log that carries every agreed action to closure. A year of status reports with no recorded decisions leaves a director little to show that they exercised oversight.

    In the pack

  14. Outcome

    Propose minuted decisions and an action log from now on

    Put to the board that each cyber decision is minuted and each agreed action is carried in the report until closed. Agree it with the board secretary, who records the board's decisions and actions with you after each meeting.

    In the pack

  15. Outcome

    Agree the answers with counsel before the next meeting

    If you are in scope of NIS2 or DORA, expect the regulation and liability questions at every meeting until the board is confident of its own duties. Agree the answers with legal or compliance in advance, and make sure the minutes record the board's questions and decisions: they are the evidence of oversight.

    In the pack

Practical checklist

  1. Do not reassure, and do not give a legal opinion.
  2. Check whether legal counsel has confirmed that NIS2 applies to you, and say so plainly, or say who is confirming it and by when.
  3. Say in plain terms what NIS2 asks of the board, and stop there.
  4. If counsel is in the room or has given a view, hand the question over. If not, say you will ask for counsel's view, give a date and have it recorded as an action.
  5. Point to the board's recorded oversight: decisions minuted and actions followed up to closure.
  6. Check every director has had cyber training in the last year, and propose a date for any that is missing.
  7. If the minutes do not show cyber decisions and follow-up, propose minuted decisions and an action log from now on.
  8. Agree the regulation and liability answers with legal or compliance before the next meeting.

Evidence to have ready

  • The one-page summary of the regulation that applies, confirmed by legal or compliance.
  • Legal counsel's view on directors' duties, where one exists.
  • The minutes recording the board's cyber decisions, and the action log carrying each action to closure.
  • Board training records, with who attended and when.

Assumptions

  • This is not legal advice. Whether and how a director could be personally liable depends on national law and the facts, and is a question for the organisation's legal counsel.
  • The top body depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. NIS2 calls it the management body.

Not covered here