Article 20Governance
1. Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.
The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.
2. Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.
NIS2, the European Union directive on network and information security, Article 20
Member States must ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken to meet Article 21, oversee how they are implemented, and can be held liable for the entity’s infringements of that Article. National rules on the liability of public institutions, public servants and elected or appointed officials are left untouched.
Members of management bodies must also be required to follow training, so that they can identify risks and assess risk-management practices and their effect on the entity’s services. Member States must encourage entities to offer similar training to employees on a regular basis.
Two points follow. The duty is placed on the management body itself, as approver and overseer, and it comes with exposure to liability, so it is not simply a reporting line to the security function. And the two training provisions differ in strength: for members of the management body, training is something they are required to follow; for employees, it is something Member States encourage. As with the rest of the Directive, these duties reach an entity through its Member State’s law.
What is in the packs for this
Each one helps with this requirement.
NIS2 Readiness Self-AssessmentExcel
in NIS2 Implementation & Readiness
Readiness items GV-01 to GV-03 rate whether the management body approves the measures, oversees them and has trained every member.
Management Body Cybersecurity Accountability RecordWord
in NIS2 Implementation & Readiness
Parts B and C record the management body's approval of the risk-management measures and its oversight reviews; Part F records the members' training; the note on personal liability sits with them.
Management Body Cybersecurity Training PlanExcel
in NIS2 Implementation & Readiness
The Members, Sessions and Attendance sheets plan and record the cybersecurity training each member of the management body follows, with the topics it covers.
NIS2 Documentation & Evidence ChecklistExcel
in NIS2 Implementation & Readiness
Evidence records EV-03 and EV-04 list the management body's approval and oversight records a supervisor may ask for.
Board Reporting Narrative ModelWord
in Board Cybersecurity Reporting
The narrative model helps the cybersecurity lead report to the board so that it can oversee the measures; the regulated-entity adaptation covers the management body's duties.
Board Question Bank & Preparation BriefWord
in Board Cybersecurity Reporting
Question BQ-16 prepares the answer on what NIS2 asks of the board itself, BQ-17 on personal liability, and BQ-18 on the board's own training.
Role-Based Security Training MatrixExcel
in Security Awareness Programme
Row RG-05 sets the training for every member of the management body, pointing to the training plan in the NIS2 pack.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.