Article 20Governance
What it says
1. Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.
The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.
2. Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.
NIS2, the European Union directive on network and information security, Article 20
What it means in practice
Member States must ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken to meet Article 21, oversee how they are implemented, and can be held liable for the entity’s infringements of that Article. National rules on the liability of public institutions, public servants and elected or appointed officials are left untouched.
Members of management bodies must also be required to follow training, so that they can identify risks and assess risk-management practices and their effect on the entity’s services. Member States must encourage entities to offer similar training to employees on a regular basis.
Two points follow. The duty is placed on the management body itself, as approver and overseer, and it comes with exposure to liability, so it is not simply a reporting line to the security function. And the two training provisions differ in strength: for members of the management body, training is something they are required to follow; for employees, it is something Member States encourage. As with the rest of the Directive, these duties reach an entity through its Member State’s law.
What a supervisor would ask to see: the management body’s record of approving the Article 21 measures, its oversight reviews and the training each member has followed. The NIS2 pack’s evidence records (P12-A07, EV-03 and EV-04) list the approval and oversight records.
What is in the packs for this
Each one helps with this requirement.
- Excel
NIS2 Readiness Self-Assessment
in NIS2 Implementation & ReadinessReadiness items GV-01 to GV-03 rate whether the management body approves the measures, oversees them and has trained every member. - Word
Management Body Cybersecurity Accountability Record
in NIS2 Implementation & ReadinessParts B and C record the management body's approval of the risk-management measures and its oversight reviews; Part F records the members' training; the note on personal liability sits with them. - Excel
Management Body Cybersecurity Training Plan
in NIS2 Implementation & ReadinessThe Members, Sessions and Attendance sheets plan and record the cybersecurity training each member of the management body follows, with the topics it covers. - Excel
NIS2 Documentation & Evidence Checklist
in NIS2 Implementation & ReadinessEvidence records EV-03 and EV-04 list the management body's approval and oversight records a supervisor may ask for. - Word
Board Reporting Narrative Model
in Board Cybersecurity ReportingThe narrative model helps the cybersecurity lead report to the board so that it can oversee the measures; the regulated-entity adaptation covers the management body's duties. - Word
Board Question Bank & Preparation Brief
in Board Cybersecurity ReportingQuestion BQ-16 prepares the answer on what NIS2 asks of the board itself, BQ-17 on personal liability, and BQ-18 on the board's own training. - Excel
Role-Based Security Training Matrix
in Security Awareness ProgrammeRow RG-05 sets the training for every member of the management body, pointing to the training plan in the NIS2 pack.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.