NIS2 director liability: what is the real board-level risk?

Where the board-level emphasis lies

Directors are not expected to configure technology themselves. They are expected to understand material risks, approve appropriate measures, ensure that responsibilities and resources are organised and follow whether implementation is effective.

Training supports this role by giving directors the knowledge needed to assess risk, measures and consequences rather than relying on untested assumptions.

What directors should be able to do

A director should be able to connect cyber risk with critical services and protected interests, understand the basis of management's conclusion, challenge material exceptions and make explicit decisions on priorities and residual risk.

• ask for a current and understandable risk picture;
• approve measures and resources on a proportionate basis;
• assign ownership and agree reporting and escalation;
• follow incidents, tests, exceptions and overdue actions;
• record key considerations and decisions.

When governance risk increases

The risk of criticism increases when material warnings receive no timely response, ownership remains unclear, known gaps persist without an accepted plan, or the board cannot explain the basis of its decisions. A missing audit trail can also make an otherwise reasonable process difficult to demonstrate.

Constructive challenge and documented prioritisation help the board show that it acted with care, context and proportionality.

How boards keep the risk manageable

Schedule role-appropriate training, agree the information required for oversight, maintain a decision log and review the implementation roadmap at defined intervals. Use independent assurance where the risk or uncertainty warrants it.

This approach supports resilience and creates a clear account of how the board fulfilled its role.

Frequently asked questions