NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work.
NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by the directive, oversee their implementation, and can be held liable for infringements, subject to national law.
That obligation is live across most of the EU, with four member states going to the Court of Justice in July for failing to notify full transposition.
Access control is one of the required measures. Directors are not expected to decide who gets administrator rights or review individual user accounts. They do, however, need to know that access is being controlled, that someone has responsibility for managing the risk, and that problems are being addressed.
An estimated 160,000 entities fall within the scope of NIS2 across the EU.
Approval is only part of the job
Article 20 requires management bodies to both approve cybersecurity risk-management measures and oversee their implementation. It also requires the members of those bodies to undergo cybersecurity training, and to offer comparable training to employees on a regular basis.
The measures themselves are set out in Article 21. They include access control policies and asset management, along with the use of multi-factor authentication or continuous authentication solutions where appropriate.
Many organizations have traditionally left these decisions to security and IT teams. Under NIS2, the board still needs to know whether the measures it approved are being implemented.
Day-to-day responsibility can remain with the CISO and IT teams. The difficulty comes when the person responsible for a risk does not control the budget, systems, or people needed to address it.
Greece’s implementation goes further in defining who carries that responsibility. Its NIS2 law requires essential and important entities to appoint a suitably qualified member of their organization as an Information and Communication Systems Security Officer. The officer coordinates compliance, must have the resources needed to do the job, and operates independently of the company’s data protection officer.
Access problems also need to reach the board in terms that it can act on. If an MFA rollout has failed or administrators have more access than they need, the board needs to understand the risk of leaving it unresolved. The CISO may be responsible for the risk without controlling the budget or teams needed to fix it.
The board needs evidence
Board reports often show what the access control policy requires, rather than whether it is being followed.
For example, a company policy will likely require MFA and the removal of accounts when employees leave.
However, the board also needs to know about the exceptions, including old accounts that remain active, excessive privileges, MFA exemptions that have never been reviewed, and suppliers whose access has outlasted their contracts.
The board needs information about how the controls are working in practice.
In a NIS2 access management report from European password and secrets manager Passwork, regulators from two national cybersecurity authorities and independent security leaders describe boards that have absorbed the liability change and now ask for proof that controls work, where they once accepted a summary of the policy.
Organizations should be able to show who can access critical systems, why that access was granted, who approved it, how long it is valid, and when it was changed or revoked. The board needs to know whether that evidence exists and what it says about material access risk.
Personal liability raises the stakes
Implementation is still catching up in parts of Europe. In July 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of NIS2 into national law. The Commission also asked the Court to impose financial sanctions.
For organizations in countries where NIS2 has been transposed, regulators have significant enforcement powers.
For essential entities, member states must set a maximum fine of at least €10,000,000 or 2% of the global annual turnover, whichever is higher. Important entities are subject to a lower maximum threshold, of at least €7,000,000 or 1.4% of their global annual turnover, in a similar capacity.
Article 32 also allows competent authorities, in specific circumstances, to seek the temporary prohibition of someone at CEO or legal representative level from exercising managerial functions in an essential entity. This can happen where enforcement action has failed to produce the required response. It is not an automatic consequence of a cyber incident.
Article 20 separately requires member states to ensure that management bodies can be held liable for infringements of Article 21, subject to the applicable rules under national law.
Approving the policy is not the end of the board’s involvement. It also needs information on whether the policy is being followed and what is happening with known problems.
Verizon’s 2026 Data Breach Investigations Report found credential abuse somewhere in the chain of 39% of breaches, more than any other vector. Stolen credentials also circulate at scale, as the exposed database of 24 billion credential records reported in June showed. Directors should expect an answer on which accounts and credentials reach critical systems, who is responsible for them, and whether that access is being controlled.
Give access risk an owner with authority
CISOs briefing their boards should be able to say who owns access-control risk and whether that person has the authority to address it. The board also needs evidence of what is happening.
When an access problem is identified, someone needs to be responsible for getting it fixed. That might mean removing unnecessary privileges or dealing with an MFA exception that has remained in place. If the fix depends on another team’s budget or resources, the board needs to know.
Board reporting should show whether the controls it approved are working, flag significant exceptions that remain unresolved, and who is accountable for closing them.
Author the author:
Kirsten Doyle has spent 27 years writing about technology and has covered the industry through some of its most significant shifts. Her focus areas include cybersecurity, cloud, channel, enterprise IT, and data centre operations. She works across many formats: news, features, white papers, eBooks, and thought leadership. Kirsten has many years of experience in journalism and editing for both print and digital media, and has supported plenty of go-to-market and PR programmes with technically grounded writing that holds up to scrutiny. She is also a regular writer at Bora.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, NIS2)
Source: Security Affairs · 2026-11-03