Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we show that our management body has approved and oversees our NIS2 measures?

5 decision pointsThe pack behind this answer: NIS2 Implementation & Readiness

Add to board memo

The short answer

Recommendation
Keep one record, next to the minutes, of what the management body did: each approval of the measures, each quarterly oversight review with the questions asked, answers given and decisions taken, and how each decision was followed up. Confirm with counsel first who the management body is.
Reasoning
NIS2 asks the management body to approve the cybersecurity risk-management measures, oversee how they are put in place and follow training, and its members can be held liable. A supervisor may ask for evidence. Minutes alone rarely show oversight: a line saying the board noted the cyber report shows receipt. The questions and answers are the best evidence that the body oversees and does not only receive (NR-04). Approvals must name what was approved and be repeated after any material change (NR-03), and every decision is followed up until closed (BR-09).
Considerations
  • Yearly re-approval, quarterly review and 10 working days to tell the chair of a blocking gap are the pack's defaults (NR-03, NR-04, NR-10). National law or your own procedure may set others. This is not legal advice.
  • The management body is the board of directors, or the management board in a two-tier structure; where there is no board, the people national law makes responsible. NIS2 does not define it, so confirm with counsel.
  • A board committee may prepare and recommend, but the approval is the body's own, minuted at its own meeting. Whether national law allows delegation is for counsel.
  • Where the NIS2 lead is also a member, the chair or another member signs the annual statement, so nobody signs off their own report.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartYou must show the body approves and oversees the measuresStepConfirm with counsel who the management body isDecisionDoes a board committee prepare or recommend for the body?StepThe committee recommends; the body itself approvesStepSend the papers the body needs to judge the measuresStepRecord the approval: date, documents, minute referenceDecisionDoes the approval cover all ten measures?StepRecord what is outstanding and when it comes backStepReview the measures at least once a quarterStepMinute the questions, the answers and the decisionsStepFollow each decision up until it is closedDecisionHas a readiness assessment found a blocking gap?StepReport it at the next meeting, or to the chair if that is laterDecisionHas anything materially changed since the approval?DecisionIs the yearly approval due?OutcomeRe-approve, and the chair signs the year's statement

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 16 steps.

  1. Start

    You must show the body approves and oversees the measures

    NIS2 asks the management body to approve the cybersecurity risk-management measures, oversee how they are put in place, and follow training, and its members can be held liable. A supervisor may ask for evidence. Minutes alone rarely show oversight: "the board noted the cyber report" shows receipt. One record keeps the questions, answers and decisions together.

    In the pack

  2. Step

    Confirm with counsel who the management body is

    NIS2 does not define the term, so confirm with counsel what national law counts. In a one-tier structure it is the board of directors; in a two-tier structure, the management board, and counsel says whether the supervisory board also counts. Where there is no board, it is the people national law makes responsible for running the entity. Record who confirmed it and when.

    In the pack

  3. Decision

    Does a board committee prepare or recommend for the body?

    A board committee, such as an audit and risk committee, may prepare the papers and recommend. The approval of the measures is still the management body's own, minuted at its own meeting. A committee does not approve in the body's place.

    In the pack

  4. Step

    The committee recommends; the body itself approves

    Let the committee prepare and recommend, and have the management body take the approval and minute it. Record what the committee does for the body. National law may add rules on delegation, so raise your structure with counsel when you confirm who the body is.

    In the pack

  5. Step

    Send the papers the body needs to judge the measures

    Before each approval the NIS2 lead sends the ten measures with your own policies set against each one, the latest readiness result and the open gaps. Record which papers the body had, so it is clear it could judge what it approved. The pack's management briefing takes the body through its duties and the decisions it is asked to take.

    In the pack

  6. Step

    Record the approval: date, documents, minute reference

    Name the documents approved by name and version, not "the cyber strategy". Give the date, the meeting or written resolution and the minute reference, and any condition the body set, with its owner and date. Keep every earlier approval: together they show an unbroken line.

    In the pack

  7. Decision

    Does the approval cover all ten measures?

    Mark each of the ten measures as covered by this approval or not. One tick for all ten, with a measure still missing, is a common reason an entry is sent back. If you cannot say a measure is covered, answer no.

    In the pack

  8. Step

    Record what is outstanding and when it comes back

    Record the measure as outstanding, the reason, and the meeting at which it comes back for approval. In the pack's worked example, the board approved nine measures and recorded cryptography as outstanding until its policy was written. Approving that policy later completes the approval.

    In the pack

  9. Step

    Review the measures at least once a quarter

    At each meeting that receives the cyber report, the body receives a report on the measures, the readiness result and the open gaps. The pack's record also lists significant incidents and whether each report was on time, and the members' training. Name each paper and the one fact it told the body, not "report noted".

    In the pack

    See also

  10. Step

    Minute the questions, the answers and the decisions

    Record each question as asked and the answer as given. The questions and answers are the best evidence that the body oversees and does not only receive. Record each decision with its outcome and an owner for what follows. Where the minute is short, agree with the chair that it refers to this record.

    In the pack

  11. Step

    Follow each decision up until it is closed

    Each decision or action gets an owner by role, a due date and a status, and is reported at the next meeting until it is closed. An action that disappears from one meeting to the next is a common reason an entry is sent back. The action list is also the evidence that the body oversees cyber risk rather than simply hearing about it.

    In the pack

  12. Decision

    Has a readiness assessment found a blocking gap?

    A blocking gap is a duty NIS2 places on the entity directly that is not in place at all: registration, the management body's duties, one of the ten measures, or incident reporting. If you cannot tell whether a gap is blocking, treat it as blocking.

    In the pack

    See also

  13. Step

    Report it at the next meeting, or to the chair if that is later

    In the pack's default, a blocking gap goes to the body at its next meeting, or to its chair within 10 working days where the next meeting is later than that. Record the route, the deadline and the date it was met. The pack's example sent one to the chair because the next board was 21 working days away.

    In the pack

    See also

  14. Decision

    Has anything materially changed since the approval?

    A material change alters what the body approved: a new or withdrawn measure or policy, a change in scope or classification, or a significant incident that shows a measure did not work. Any of these sends the measures back for approval. If you are not sure, treat it as material.

    In the pack

  15. Decision

    Is the yearly approval due?

    In the pack's default the body approves the measures again at least once a year, even with nothing material changed. Until then, keep holding the quarterly reviews.

    In the pack

  16. Outcome

    Re-approve, and the chair signs the year's statement

    At the annual approval the chair confirms that the body approved the measures, reviewed them each quarter, followed its training and followed up its decisions, as the record shows. Where the NIS2 lead is also a member, the chair or another member signs, so nobody signs off their own report. Keep the record with the minutes, with a minute reference for each entry.

    In the pack

    See also

Practical checklist

  1. Confirm with counsel who the management body is, and record who confirmed it and when.
  2. Send the body the ten measures with your policies against each, the readiness result and the open gaps before each approval.
  3. Record each approval: date, documents by name and version, minute reference and any conditions.
  4. Mark each of the ten measures as covered or not, and record when any outstanding one comes back.
  5. At least once a quarter, record the reports received, the questions as asked, the answers as given and the decisions.
  6. Give each decision an owner, a due date and a status, and report it at each meeting until closed.
  7. Report any blocking gap at the next meeting, or to the chair within 10 working days if that meeting is later.
  8. Re-approve after any material change and at least yearly, and have the chair sign the annual statement.

Evidence to have ready

  • Counsel's confirmation of who counts as the management body.
  • Each approval with its date, the documents approved by name and version, the minute reference and the ten measures marked.
  • Each quarterly oversight review: reports received, questions and answers, and decisions with outcomes.
  • The action list carried from meeting to meeting, with owners, due dates and status.
  • The blocking gaps reported with route and date, the members' training record, and the chair's signed annual statement.

Assumptions

  • Your entity is in scope of NIS2 as essential or important, and the scope decision has been made.
  • This follows the CISO Times NIS2 pack. It is not legal advice. National law may add to the Directive, for example on who counts as the management body or whether it may delegate, so confirm with counsel.
  • The yearly and quarterly cadences and the 10 working days for a blocking gap are the pack's defaults. National law or your own procedure may set others.
  • Who the management body is depends on how you are governed: the board of directors; the management board in a two-tier structure; where there is no board, the people national law makes responsible for running the entity.

Not covered here