Protected interests under NIS2: what should the board govern?

Which interests may be relevant?

The appropriate set follows from the organisation's purpose, sector and stakeholders. Most boards consider continuity, safety, financial stability, legal and contractual obligations, reputation, personal data, confidential information and the integrity of products or services.

Public and care-related organisations may add accessibility, societal impact and trust in essential services.

Why this helps in the boardroom

A technical vulnerability becomes board-relevant when it can affect an interest that matters. Expressing risk through protected interests makes impact clearer, supports comparison between scenarios and helps explain why a measure is proportionate.

It also creates shared language between IT, operations, risk, finance, privacy, management and supervision.

The same measure can have a different board meaning

Strong authentication may protect confidential information in one process, prevent unsafe operational access in another and preserve public trust in a third. The technology can be similar while the protected interest, urgency and evidence differ.

Naming the interest helps the board assess scope, exceptions and residual risk.

Use the classification in practice

• define the organisation's protected interests and owners;
• connect critical processes and information assets to those interests;
• assess scenarios by impact on one or more interests;
• select measures and recovery objectives that protect them;
• report material changes, exceptions and residual risk.

Protected interests as a basis for priorities

Use protected interests in the risk appetite, business-impact analysis, supplier classification, incident escalation and management reporting. This creates a consistent basis for priorities and decisions across the NIS2 control cycle.

Frequently asked questions