Management Body Cybersecurity Accountability Record
Evidences management approval of risk-management measures and oversight of their implementation.
Available soon
- Format
- Word
- Size
- 65 KB
- Length
- 20 pages
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
The training interval is this pack's default, not the Directive's.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this record
NIS2 asks three things of the management body of an essential or important entity. It must approve the cybersecurity risk-management measures, oversee how they are put in place, and follow training. Its members can be held liable for infringements (Article 20). This record is where you show that it did so: every approval, every oversight review with what was asked and decided, and how each decision was followed up.
A supervisor may ask for documented policies and evidence that they are implemented (Articles 32(2) and 33(2)). Minutes alone rarely show oversight: a line saying "the board noted the cyber report" shows receipt. This record keeps the questions, the answers and the decisions in one place, so the evidence is ready when asked for (NR-11).
Guidance — delete before approval
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
Personal liability. This record helps members show what they did. It does not say whether any member is or is not liable, and it is not a defence prepared for anyone. Questions about a member's own position, insurance or indemnity go to counsel.
Who the management body is
The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. Which body that is depends on how the entity is governed, as this pack says wherever it names the board or its equivalent.
Structure | The management body | Committees and other bodies | Confirm with counsel |
|---|---|---|---|
Board of directors (one tier) | The board of directors, executive and non-executive members together. | A board committee, such as [[an audit and risk committee]], may prepare the papers and recommend. The approval is the board's, minuted at a board meeting. | Whether national law lets the board delegate the approval to a committee. |
Two-tier (management board and supervisory board) | The management board, which runs the entity. | The supervisory board receives the reports and may ask questions; its own role is whatever national company law gives it. | Whether national law treats the supervisory board as part of the management body for NIS2. |
No board, such as an owner-managed company | [[The people national law makes responsible for running the entity, such as its managing directors or partners]]. | Where there is one person, that person approves and oversees, and records it here in the same way. | Who national law counts, and how the approval is to be recorded where no meeting is held. |
What the record holds, and when
Part | Completed | By | Rule |
|---|---|---|---|
A The management body | Once; again when the structure or the members change | Board secretary | Article 20 |
B Approval of the measures | At each approval: at least once a year, and after any material change | Board secretary, from the minute | NR-03 |
C Oversight reviews | At each meeting that receives the cyber report: at least once a quarter | Board secretary, with the NIS2 lead | NR-04 |
D Decisions and actions | After each meeting, until every item is closed | Board secretary | P03 BR-09 |
E Blocking gaps reported | When a readiness assessment finds a blocking gap | NIS2 lead | NR-10 |
F Training of the members | After each session; the full record is the Management Body Cybersecurity Training Plan | Board secretary | NR-05 |
G Annual statement | At the annual approval | Chair of the management body | NR-03 |
The rules this record serves
NR-01 The scope decision must be recorded in writing, with the facts and reasoning behind each answer, confirmed with counsel and approved by the management body. It must be reviewed at least once a year and whenever a scope trigger occurs.
NR-03 The management body must approve the Article 21 measures, recorded with the date, what was approved and the minute reference, and must approve them again at least once a year and after any material change (Article 20(1)).
NR-04 The management body must oversee the measures: it must receive a report on them, the readiness result and the open gaps at least once a quarter, and its questions and decisions must be minuted (Article 20(1)).
NR-05 Every member of the management body must follow cybersecurity training (Article 20(2)), and similar training must be offered to staff on a regular basis. The Directive sets no interval. This pack's default is at least once a year for each member, and within [[3]] months of appointment for a new member; attendance and content are recorded.
NR-10 A blocking gap must be reported to the management body at its next meeting, or within [[10]] working days to its chair where the next meeting is later than that.
Steps
- The board secretary completes Part A when the record is adopted, and confirms with counsel who counts as the management body.
- Before each approval, the NIS2 lead sends the papers: the NIS2 Article 21 Measure-to-Control Mapping Library with the entity's own policies against each measure, the latest readiness result (NIS2 Readiness Self-Assessment) and the open gaps (NIS2 Gap & Remediation Tracker).
- After the meeting, the secretary completes Part B from the minute, and marks each of the ten measures as approved or not.
- At each quarterly meeting, the board secretary adds a Part C block: the reports received, the questions and answers, and the decisions.
- Every decision and follow-up goes into Part D with an owner and a date, and stays there until it is closed.
- When a readiness assessment finds a blocking gap, the NIS2 lead reports it as NR-10 sets and records it in Part E.
- After each training session, the board secretary updates the Management Body Cybersecurity Training Plan and Part F.
- Once a year, at the annual approval, the chair signs the statement in Part G.
Guidance — delete before approval
Keep this record with the board minutes, and give the minute reference for every entry. A supervisor will compare the two.
Where the minute is short, this record carries the detail: the questions and answers in Part C are what shows oversight. Agree with the chair that the minute refers to this record.
Field guidance
Field | What a good entry looks like | Common reason an entry is sent back |
|---|---|---|
B What was approved | The documents by name and version, and the date of the Article 21 library used. | "The cyber strategy" with no document named. |
B The ten measures | Each point marked, with any change since the approval. | One tick for all ten, with a measure still missing. |
C Reports received | Each paper named, with the one fact it told the body. | "Report noted". |
C Questions | The question as asked, and the answer as given. | A summary of discussion with no question in it. |
C Decisions | A decision with an outcome, and an owner for what follows. | "The board discussed" with no outcome. |
D Actions | One action each, owned by a role, with a date and a status. | Actions that disappear from one meeting to the next. |
E Blocking gaps | The route NR-10 gives, with its deadline and the date it was met. | Reported at the next meeting when that was months away. |
The record
Guidance — delete before approval
Replace the placeholders with blank space when you adopt the record, or leave them as prompts. Keep one copy per year, with Part A carried forward.
Part A — The management body
Complete once, and again whenever the structure or the membership changes.
A1 The entity and its management body | |||
Entity | [[Legal name, and what it does]] | ||
NIS2 classification from the scope assessment | [[Essential / Important entity; the row of the scope test that decided; date approved (NR-01)]] | ||
Governance structure see "Who the management body is" | [[Board of directors / Two-tier / No board: and who sits on it]] | ||
Who counts as the management body confirmed with counsel | [[Who confirmed it, when, and what national law counts]] | ||
Committee, if any prepares and recommends only | [[Name of committee, and what it does for the body; or none]] | ||
NIS2 lead | [[Name and role of the person who reports to the body on NIS2]] | Board secretary | [[Name]] |
The members. Training dates are kept in full in the Management Body Cybersecurity Training Plan; this table shows who the record covers.
Member | Role on the management body | Appointed | Trained (latest) | Next training due |
|---|---|---|---|---|
[[Name]] | [[e.g. Chair (non-executive)]] | [[YYYY-MM-DD]] | [[YYYY-MM-DD]] | [[YYYY-MM-DD]] |
[[Name]] | [[…]] | [[…]] | [[…]] | [[…]] |
Part B — Approval of the risk-management measures
NR-03: The management body must approve the Article 21 measures, recorded with the date, what was approved and the minute reference, and must approve them again at least once a year and after any material change (Article 20(1)). One block per approval. Keep every earlier block: together they show an unbroken line of approvals.
B1 Approval | |||
Date | [[YYYY-MM-DD]] | Minute reference | [[e.g. B/2026/07-5]] |
Meeting | [[Board meeting / written resolution, date]] | ||
What was approved name the documents and their versions | [[The Article 21 measures as set out in …; the policies approved with them]] | ||
Papers the body had so it could judge what it approved | [[The NIS2 Article 21 Measure-to-Control Mapping Library; the readiness result; the risk register; …]] | ||
Conditions or reservations | [[Any condition the body set, with its owner and date; or none]] | ||
Next approval due 12 months, or after a material change | [[YYYY-MM-DD]] | ||
The ten measures of Article 21(2), point by point. Mark each as covered by this approval or not, and record any later change that needs approval again (NR-03).
Point | Measure | Approved | Changes since approval |
|---|---|---|---|
(a) | Risk analysis and security policies | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(b) | Incident handling | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(c) | Business continuity and crisis management | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(d) | Supply chain security | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(e) | Security in acquisition, development and maintenance | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(f) | Assessing effectiveness | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(g) | Cyber hygiene and training | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(h) | Cryptography and encryption | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(i) | People, access and assets | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
(j) | Multi-factor authentication and secured communications | [[Yes / No]] | [[None / what changed, when, and when it comes back for approval]] |
Part C — Oversight reviews
NR-04: The management body must oversee the measures: it must receive a report on them, the readiness result and the open gaps at least once a quarter, and its questions and decisions must be minuted (Article 20(1)). One block per meeting. The questions and the answers given are the best evidence that the body oversees and does not only receive.
C1 Review | |||
Date | [[YYYY-MM-DD]] | Minute reference | [[…]] |
Quarter reported | [[Qn YYYY]] | Members present | [[n of n]] |
Presented by | [[NIS2 lead, and who took the minute]] | ||
C2 Reports received. Each row names the paper and what it told the body.
Report | Received | What it told the body |
|---|---|---|
Quarterly cyber report (Board Cybersecurity Reporting pack) | [[Yes / No]] | [[Position against appetite; the measures off target]] |
NIS2 readiness result (NIS2 Readiness Self-Assessment) | [[Yes / No]] | [[Not ready / Ready, with actions / Ready; blocking gaps]] |
Open gaps (NIS2 Gap & Remediation Tracker) | [[Yes / No]] | [[Priority 1 and 2 gaps, owners and dates]] |
Significant incidents and reports (Security Incident Management pack) | [[Yes / No]] | [[Incidents, and whether each report was on time]] |
Members' training (Management Body Cybersecurity Training Plan) | [[Yes / No]] | [[n of n trained; who is due]] |
C3 Questions asked, and the answers given. Record the question as asked and the answer as given; a follow-up becomes an action in Part D.
Question | Answer given | Follow-up |
|---|---|---|
[[Question, as asked]] | [[Answer, as given]] | [[MB-nn / none]] |
[[…]] | [[…]] | [[…]] |
C4 Decisions taken. Every ask is a decision with options, a recommendation, cost and the risk of not deciding (P03 BR-06).
ID | Decision | Outcome |
|---|---|---|
MB-[[nn]] | [[What was put to the body]] | [[Approved / Agreed / Not approved / Deferred to …]] |
MB-[[nn]] | [[…]] | [[…]] |
Part D — Decisions and actions to follow up
Actions the board agrees are recorded, owned and reported on at the next meeting until closed (P03 BR-09). Keep one list for the record, carried from meeting to meeting.
ID | Decision or action | Owner | Due | Status at [[YYYY-MM-DD]] |
|---|---|---|---|---|
MB-[[nn]] | [[…]] | [[Role]] | [[YYYY-MM-DD]] | [[Open / Done YYYY-MM-DD / Overdue]] |
MB-[[nn]] | [[…]] | [[…]] | [[…]] | [[…]] |
Part E — Blocking gaps reported
NR-10: A blocking gap must be reported to the management body at its next meeting, or within [[10]] working days to its chair where the next meeting is later than that. A blocking gap is a duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all.
Gap | Raised | Next meeting | Route and deadline (NR-10) | Status |
|---|---|---|---|---|
[[GAP-nn: what is missing]] | [[YYYY-MM-DD]] | [[YYYY-MM-DD]] | [[At the next meeting / to the chair within 10 working days]] | [[Reported YYYY-MM-DD]] |
Part F — Training of the members
F1 Training | |||
Members trained within the last 12 months | [[n of n, and the date of the session]] | ||
Members due or new new members within 3 months | [[Who is due, by when, and whether they are booked]] | ||
Full record | [[Management Body Cybersecurity Training Plan, as at YYYY-MM-DD]] | ||
Part G — Annual statement and sign-off
Once a year, at the annual approval, the chair confirms that this record is complete for the year.
G1 Statement | |||
The body approved the measures, reviewed them each quarter, followed its training and followed up its decisions, as this record shows | [[Confirmed / Confirmed except: …]] | ||
Chair of the management body | [[Name, signature, date]] | ||
Board secretary | [[Name, signature, date]] | ||
Worked example — a board's first year under NIS2
This is the record kept by the board of a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. It is in scope as an important entity. The board approved the measures on 30 Jul 2026, with measure (h) outstanding until its policy is written, at the meeting that also received the quarterly cyber report for Q2 2026. Its first readiness self-assessment, on 30 Sep 2026, found 1 blocking gap. The next meeting is on 29 Oct 2026. The organisation, names and dates are fictional; replace them with your own.
Guidance — delete before approval
Part E shows NR-10 at work: the next meeting is 21 working days after the assessment, more than 10, so the blocking gap goes to the chair first, by 14 Oct 2026.
The board's figures are the Board Cybersecurity Reporting pack's; the gaps and the readiness result are the NIS2 Readiness Self-Assessment and the NIS2 Gap & Remediation Tracker; the training dates are the Management Body Cybersecurity Training Plan.
Delete this worked example from your adopted record.
Part A — The management body
Complete once, and again whenever the structure or the membership changes.
A1 The entity and its management body — EXAMPLE | |||
Entity | A wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders | ||
NIS2 classification from the scope assessment | Important entity (scope test row ST-13), approved by the board on 21 May 2026; next scope review by 8 May 2027 (NR-01) | ||
Governance structure see "Who the management body is" | Board of directors (one tier). A board of seven: the chair, the chief executive, the chief financial officer and four non-executive directors | ||
Who counts as the management body confirmed with counsel | [[external counsel]] confirmed on 8 May 2026, with the scope assessment, that the board is the management body | ||
Committee, if any prepares and recommends only | None: the full board approves and oversees | ||
NIS2 lead | Head of Information Security | Board secretary | Company Secretary |
The members. Training dates are kept in full in the Management Body Cybersecurity Training Plan; this table shows who the record covers.
Member | Role on the management body | Appointed | Trained (latest) | Next training due |
|---|---|---|---|---|
M-01 | Chair (non-executive) | 1 Jun 2019 | 26 Feb 2026 | 26 Feb 2027 |
M-02 | Chief Executive | 11 Jan 2021 | 26 Feb 2026 | 26 Feb 2027 |
M-03 | Chief Financial Officer | 5 Sep 2022 | 26 Feb 2026 | 26 Feb 2027 |
M-04 | Non-executive director | 2 Mar 2020 | 26 Feb 2026 | 26 Feb 2027 |
M-05 | Non-executive director | 15 May 2023 | 26 Feb 2026 | 26 Feb 2027 |
M-06 | Non-executive director | 4 Nov 2024 | 26 Feb 2026 | 26 Feb 2027 |
M-07 | Non-executive director | 15 Jul 2026 | Not yet: booked 8 Oct 2026 | 15 Oct 2026 |
Part B — Approval of the risk-management measures
NR-03: The management body must approve the Article 21 measures, recorded with the date, what was approved and the minute reference, and must approve them again at least once a year and after any material change (Article 20(1)). One block per approval. Keep every earlier block: together they show an unbroken line of approvals.
B1 Approval — EXAMPLE | |||
Date | 30 Jul 2026 | Minute reference | [[B/2026/07-5]] |
Meeting | Board meeting, 30 Jul 2026 | ||
What was approved name the documents and their versions | The Article 21 measures as set out in the Article 21 library, with measure (h), cryptography, recorded as outstanding until its policy is approved; the security policy set and the risk appetite; oversight through the quarterly cyber report. | ||
Papers the body had so it could judge what it approved | The NIS2 Article 21 Measure-to-Control Mapping Library with the entity's own policies against each measure; the scope assessment (NIS2 Scope & Entity Classification Assessment); the Q2 cyber report | ||
Conditions or reservations | Measure (h) recorded as outstanding: no written policy on the use of cryptography and key management yet. The policy comes back for approval on 29 Oct 2026 (decision D-1), which completes this approval. | ||
Next approval due 12 months, or after a material change | By 30 Jul 2027 (12 months), or sooner after a material change | ||
The ten measures of Article 21(2), point by point. Mark each as covered by this approval or not, and record any later change that needs approval again (NR-03).
Point | Measure | Approved | Changes since approval |
|---|---|---|---|
(a) | Risk analysis and security policies | Yes | None to approve |
(b) | Incident handling | Yes | None to approve |
(c) | Business continuity and crisis management | Yes | None to approve |
(d) | Supply chain security | Yes | None to approve |
(e) | Security in acquisition, development and maintenance | Yes | None to approve |
(f) | Assessing effectiveness | Yes | None to approve |
(g) | Cyber hygiene and training | Yes | None to approve |
(h) | Cryptography and encryption | No: outstanding | No written policy on the use of cryptography and key management yet; confirmed by the self-assessment on 30 Sep 2026 (GAP-01). The written policy goes to the board on 29 Oct 2026, and approving it completes the approval of the measures (decision D-1). |
(i) | People, access and assets | Yes | None to approve |
(j) | Multi-factor authentication and secured communications | Yes | None to approve |
Part C — Oversight reviews
NR-04: The management body must oversee the measures: it must receive a report on them, the readiness result and the open gaps at least once a quarter, and its questions and decisions must be minuted (Article 20(1)). One block per meeting. The questions and the answers given are the best evidence that the body oversees and does not only receive.
C1 Review — EXAMPLE | |||
Date | 30 Jul 2026 | Minute reference | [[B/2026/07-5]] |
Quarter reported | Q2 2026 | Members present | 7 of 7 members |
Presented by | Head of Information Security, with board secretary taking the minute | ||
C2 Reports received. Each row names the paper and what it told the body.
Report | Received | What it told the body |
|---|---|---|
Quarterly cyber report (Board Cybersecurity Reporting pack) | Yes | 3 of 12 top risks outside appetite. Priority 1 and 2 weaknesses fixed on time: 90%. Critical suppliers assessed: 6 of 14. Staff trained: 88%. |
NIS2 readiness result (NIS2 Readiness Self-Assessment) | No | Not yet assessed. The board asked for the first self-assessment at quarter end (MB-2026-02). |
Open gaps (NIS2 Gap & Remediation Tracker) | No | None tracked yet: gaps come from the first self-assessment. |
Significant incidents and reports (Security Incident Management pack) | Yes | 1 significant incident in the quarter. |
Members' training (Management Body Cybersecurity Training Plan) | Yes | 6 of 7 trained. The member appointed on 15 Jul 2026 is due by 15 Oct 2026. |
The measures, for approval (Part B) | Yes | The NIS2 Article 21 Measure-to-Control Mapping Library with the entity's own policies against each measure. |
C3 Questions asked, and the answers given. Record the question as asked and the answer as given; a follow-up becomes an action in Part D.
Question | Answer given | Follow-up |
|---|---|---|
Are we sure we are an important entity and not an essential one? | Yes. We are a food business in wholesale distribution (Annex II) and large, so row ST-13 of the scope test applies. Counsel confirmed it on 8 May 2026 and this board approved it on 21 May 2026. | None |
What does approving the measures commit this board to? | Overseeing them every quarter, approving them again at least once a year and after any material change, and following training. Members can be held liable for infringements (Article 20(1)). Questions about any member's own position go to counsel. | None |
Which of the 3 risks outside appetite would a supervisor ask about first? | R-01, "ransomware takes online ordering offline for more than 2 days". The recovery rebuild (TA-01) is being costed and will come to this board for a decision. | TA-01 to come to the board with options, cost and a recommendation |
How do we know the measures work, and not only that they are written down? | Through the quarterly measures in this report, the exercises and the incident reviews. A readiness self-assessment against NIS2 would show where records are missing. | First readiness self-assessment at quarter end |
C4 Decisions taken. Every ask is a decision with options, a recommendation, cost and the risk of not deciding (P03 BR-06).
ID | Decision | Outcome |
|---|---|---|
MB-2026-01 | Approve the Article 21 measures as set out in the Article 21 library, with measure (h), cryptography, recorded as outstanding until its policy is approved; the security policy set and the risk appetite; oversight through the quarterly cyber report. | Approved |
MB-2026-02 | Carry out the first NIS2 readiness self-assessment at quarter end and bring its result and the gaps to the next meeting | Agreed |
MB-2026-03 | Book the new member's induction training within the 3 months (NR-05) | Agreed |
MB-2026-04 | Bring the recovery rebuild (TA-01) to the board with options, cost and a recommendation | Agreed |
Part D — Decisions and actions to follow up
Actions the board agrees are recorded, owned and reported on at the next meeting until closed (P03 BR-09). Keep one list for the record, carried from meeting to meeting.
ID | Decision or action | Owner | Due | Status at 30 Sep 2026 |
|---|---|---|---|---|
MB-2026-00 | Approve the NIS2 scope and classification assessment (NR-01) | NIS2 lead | 21 May 2026 | Done 21 May 2026. Next review by 8 May 2027 |
MB-2026-01 | Approve the Article 21 measures as set out in the Article 21 library, with measure (h), cryptography, recorded as outstanding until its policy is approved; the security policy set and the risk appetite; oversight through the quarterly cyber report. | NIS2 lead | 30 Jul 2026 | Done: minute [[B/2026/07-5]] |
MB-2026-02 | Carry out the first NIS2 readiness self-assessment at quarter end and bring its result and the gaps to the next meeting | Head of Information Security | 30 Sep 2026 | Done 30 Sep 2026 |
MB-2026-03 | Book the new member's induction training within the 3 months (NR-05) | Board secretary | 15 Oct 2026 | Booked for 8 Oct 2026, inside the due date |
MB-2026-04 | Bring the recovery rebuild (TA-01) to the board with options, cost and a recommendation | Head of IT | — | On the 29 Oct 2026 agenda as decision D-2 |
D-1 | Approve the cryptography policy, completing the approval of the measures with measure (h) | Head of Information Security | 29 Oct 2026 | For decision on 29 Oct 2026; closes GAP-01 |
D-2 | Approve €180,000 to rebuild the ordering platform's recovery so it can be restored within 24 hours | Head of IT | 29 Oct 2026 | For decision on 29 Oct 2026; closes GAP-03 |
Part E — Blocking gaps reported
NR-10: A blocking gap must be reported to the management body at its next meeting, or within [[10]] working days to its chair where the next meeting is later than that. A blocking gap is a duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all.
Gap | Raised | Next meeting | Route and deadline (NR-10) | Status at 30 Sep 2026 |
|---|---|---|---|---|
GAP-01: No written policy on the use of cryptography, encryption and key management | 30 Sep 2026 | 29 Oct 2026: 21 working days away | To the chair by 14 Oct 2026, 10 working days after it was raised | Due. The NIS2 lead tells the chair, then the board decides on 29 Oct 2026 (D-1) |
The Priority 2 gaps go in the next cyber report, each with its owner and date (NIS2 Gap & Remediation Tracker):
Gap | Readiness item | Owner | Due |
|---|---|---|---|
GAP-02: The member appointed on 15 Jul 2026 is not yet trained | GV-03 Every member of the management body trained | Board secretary | 15 Oct 2026 |
GAP-03: The ordering platform cannot yet be restored within 24 hours, and three critical services have no restore test | RM-c Article 21(2)(c): business continuity and crisis management | Head of IT | 15 Dec 2026 |
GAP-04: Five Tier 1 suppliers not yet assessed | RM-d Article 21(2)(d): supply chain security | Information Security Manager | 8 Dec 2026 |
GAP-05: Priority 1 and 2 weaknesses fixed on time below target | RM-e Article 21(2)(e): security in acquisition, development and maintenance | Head of IT | 31 Oct 2026 |
GAP-06: Second factors sent by text message can be phished | RM-j Article 21(2)(j): multi-factor authentication and secured communications | Head of IT | 29 Dec 2026 |
GAP-07: Staff awareness training below its target: 92% of staff trained against 95% | RM-g Article 21(2)(g): cyber hygiene and training | HR Learning Lead | 29 Dec 2026 |
Part F — Training of the members
F1 Training — EXAMPLE | |||
Members trained within the last 12 months | 6 of 7 members, at the 26 Feb 2026 session (P03 BM-08) | ||
Members due or new new members within 3 months | Member M-07, appointed 15 Jul 2026: induction booked for 8 Oct 2026, due by 15 Oct 2026. The others: next annual session by 26 Feb 2027 | ||
Full record | Management Body Cybersecurity Training Plan, as at 30 Sep 2026 | ||
Part G — Annual statement and sign-off
Once a year, at the annual approval, the chair confirms that this record is complete for the year.
G1 Statement — EXAMPLE | |||
The body approved the measures, reviewed them each quarter, followed its training and followed up its decisions, as this record shows | Not yet due: the first statement is made at the annual approval, by 30 Jul 2027 | ||
Chair of the management body | [[Name]], chair: to sign with the annual statement | ||
Board secretary | [[Name]], board secretary: record kept up to date after each meeting | ||
The next oversight review is on 29 Oct 2026. Its papers are the Q3 2026 cyber report ("We are outside our cyber risk appetite on 2 of 12 top risks, both within tolerance, and we expect to be back within appetite by the end of Q4 2026 if the board approves today's decision."), the readiness result ("Important entity. Not ready: 1 blocking gap (Article 21(2)(h): cryptography and encryption), due 30 Oct 2026; 6 other items in place but not yet operating."), the gaps in Part E, and decisions D-1 and D-2. After the meeting a new Part C block is added and Part D is brought up to date. (EXAMPLE)
Related documents
Document | Relationship |
|---|---|
NIS2 Scope & Entity Classification Assessment | The classification in Part A, and the scope decision the body approves (NR-01) |
NIS2 Article 21 Measure-to-Control Mapping Library | The ten measures the body approves in Part B |
NIS2 Readiness Self-Assessment | The readiness result the body receives in Part C, and the blocking gaps of Part E |
Management Body Cybersecurity Training Plan | The full training record behind Part F |
NIS2 Documentation & Evidence Checklist | Lists this record as the evidence of approval and oversight (EV-03, EV-04) |
NIS2 Gap & Remediation Tracker | The gaps and their owners reported in Parts C and E |
NIS2 Management Briefing Deck | The briefing that takes the body through its duties and decisions |
Board Cybersecurity Report Deck Template (Board Cybersecurity Reporting pack) | The quarterly cyber report received in Part C |
Board Question Bank & Preparation Brief (Board Cybersecurity Reporting pack) | Questions a board may ask, and good answers, for Part C |
Security Incident Management Policy (Security Incident Management pack) | The incident decisions reserved for the board or its equivalent |
Adapting this template
Guidance — delete before approval
Small organisation: where the management body is one or two people, a meeting may be a short note signed by each. Keep the same parts: an approval with a date, a quarterly review with what was looked at and what was decided, and the training. Where the NIS2 lead is also a member of the body, the chair of the management body or [[another member]] signs Part G, so nobody signs off their own report.
Regulated entity (NIS2, DORA): national law may add to Article 20, for example who counts as the management body, how often it must be trained, or whether it may delegate. Check [[national law transposing NIS2: title, number and date]] with counsel (NR-12). For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2. A financial entity under DORA has its own duties for its management body (DORA Article 5); where DORA applies instead of NIS2 (Article 4(1)), keep this record in the shape DORA asks for.
IT run by a service provider: the provider may present to the body, but the approval and the oversight are the body's and cannot be handed over. Record the provider's reports in Part C like any other paper, and put actions on the provider under the contract owner in your organisation.
Group of companies: each entity in scope has its own management body and its own record. A group board may approve a common set of measures, but each subsidiary's body approves them for itself and minutes it.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement. Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Clause 5.1 — Leadership and commitment | Parts B and C: top management's commitment shown through approval and review |
ISO/IEC 27001:2022 | Annex A 5.4 — Management responsibilities | Part D: management requiring the measures to be applied, and following up |
NIST CSF 2.0 | GV.RR-01 — “Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving” | Parts A to G: leadership responsible and accountable for cybersecurity risk |
NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | Parts B and C: approval of the measures and oversight of their implementation; the note on liability |
NIS2 — Directive (EU) 2022/2555 | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | Part B: the measures approved, appropriate and proportionate to the risks |
NIS2 — Directive (EU) 2022/2555 | Article 32(6) — any natural person responsible for or acting as a legal representative of an essential entity has the power to ensure its compliance, and it must be possible to hold such persons liable for breach of their duties to ensure compliance | How to use this record, and the note on personal liability: those responsible for an essential entity |
NIS2 — Directive (EU) 2022/2555 | Article 33(5) — “Article 32(6), (7) and (8) shall apply mutatis mutandis” to important entities | The same for important entities |
NIS2 — Directive (EU) 2022/2555 | Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices | Part F: the members' training |
NIS2 — Directive (EU) 2022/2555 | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | Parts D and E: corrective measures taken without undue delay |
Definitions
Term | Meaning in this record |
|---|---|
Management body | The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. |
Approval | A minuted decision of the management body that it approves the Article 21 measures named in Part B (NR-03). |
Oversight review | A meeting at which the management body receives reports on the measures, the readiness result and the open gaps, asks its questions and takes decisions. |
Article 21 measures | The cybersecurity risk-management measures of Article 21: appropriate and proportionate to the risks, and including at least the ten in Article 21(2), points (a) to (j). |
Blocking gap | A duty NIS2 places on the entity directly (registration, the management body's duties, one of the ten measures, incident reporting) that is not yet in place at all. |
Material change | A change that alters what the body approved: a new or withdrawn measure or policy, a change in scope or classification, or a significant incident that shows a measure did not work. |
Readiness result | Not ready, Ready, with actions or Ready, from the NIS2 Readiness Self-Assessment. |
Minute reference | The reference of the minute of the meeting that took the decision, so the record and the minutes can be read together. |
MB-nn | The number of a decision or action of the management body in this record. |