Cybersecurity: management accountability can no longer be fully delegated
The NIS2 directive explicitly assigns approval and oversight of cybersecurity measures to management bodies. What this changes for a multi-company structure.
For a long time, cybersecurity remained a specialist matter: the executive signed a budget, the technical team did the rest. The EU's NIS2 directive breaks with that pattern. Its Article 20 gives the management bodies of the entities concerned the approval of cybersecurity risk-management measures and the oversight of their implementation, with accountability in case of failure; it also provides for managers to undergo training to understand the risks (UST, GlobalCert).
A framework that isn't only for large entities
NIS2 applies to essential and important entities across many sectors, including mid-sized companies. Transposition varies from one Member State to another and is running late in some, France among them. But the spirit — management answers for cybersecurity — also spreads indirectly: buyers demand guarantees from their providers that ultimately amount to commitments by management.
What "overseeing" means
A manager doesn't have to configure a firewall. They must be able to answer governance questions with evidence:
- What are our critical assets and services, and what would we lose if they were unavailable for a week?
- Who is responsible for security, and to whom do they report?
- Which baseline measures are in place: multi-factor authentication, tested backups, patching, logging?
- How would an incident be detected, escalated and notified within deadlines?
- What do our providers do to protect our data?
In a group: a common frame, local implementations
In a multi-company structure, the temptation is either to centralize everything, at the risk of disconnecting decisions from the field, or to leave everything to subsidiaries, at the risk of heterogeneity. A middle path is to set a common minimum baseline at group level — same baseline measures, same escalation times, same reporting format — and let each entity apply it to its own tools. Group management then only has to read a comparable dashboard.
Not window-dressing compliance
A signed document is not protection. Requirements bear on effectiveness: backups restored, a crisis exercise carried out, access reviewed. That difference between assertion and proof separates real governance from declarative governance.
This article is general information, not legal advice: whether NIS2 applies depends on each entity's sector, size and national law.