Ethical Hacking News
The European Union's Network and Information Security (NIS) Directive 2 (NIS2) has introduced personal liability for board members who approve access control decisions. This new framework aims to increase accountability among organizations and their boards, ensuring that they take adequate measures to protect their networks and critical infrastructure. The directive requires management bodies to provide evidence that the access controls they approved are working in practice, and it carries significant penalties for non-compliance. As organizations implement this new framework, it is essential to ensure that they are taking adequate measures to protect their networks and critical infrastructure.
Personal liability has been introduced for board members who approve access control decisions under the NIS2 directive.Management bodies are now personally liable for access controls they approve, and boards are expected to oversee implementation.CISOs must brief boards on who owns access-control risk and whether they have authority to address it.Management bodies must provide evidence that approved access controls are working in practice.Non-compliance with NIS2 can result in fines of up to €10,000,000 or 2% of annual turnover.The introduction of personal liability demonstrates the EU's commitment to improving cybersecurity governance.
The European Union's Network and Information Security (NIS) Directive 2 (NIS2) has brought about a significant shift in the way cybersecurity governance is approached. A key aspect of this change is the introduction of personal liability for board members who approve access control decisions. This new framework aims to increase accountability among organizations and their boards, ensuring that they take adequate measures to protect their networks and critical infrastructure.
Article 20 of the NIS2 directive makes management bodies personally liable for the access controls they approve, and boards are starting to ask for proof that those controls work. This means that directors are no longer just responsible for approving cybersecurity risk-management measures but also for overseeing their implementation and being held liable for infringements.
One of the key challenges in implementing this new framework is defining who carries the responsibility for access control risk and whether that person has the authority to address it. To address this, CISOs are expected to brief their boards on who owns access-control risk and whether that person has the authority to address it.
Additionally, the directive requires management bodies to provide evidence that the access controls they approved are working in practice. This includes showing who can access critical systems, why that access was granted, who approved it, how long it is valid, and when it was changed or revoked.
The impact of NIS2 on board members' liability is significant, and it raises the stakes for organizations that fail to comply with the directive. In July 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of NIS2 into national law. The Commission also asked the Court to impose financial sanctions.
For organizations in countries where NIS2 has been transposed, regulators have significant enforcement powers. Essential entities are subject to a maximum fine of at least €10,000,000 or 2% of their global annual turnover, whichever is higher. Important entities are subject to a lower maximum threshold, of at least €7,000,000 or 1.4% of their global annual turnover.
The introduction of personal liability for board members who approve access control decisions is a significant development in the fight against cyber threats. It demonstrates the EU's commitment to improving cybersecurity governance and increasing accountability among organizations.
In conclusion, NIS2 has brought about a significant shift in the way cybersecurity governance is approached. The introduction of personal liability for board members who approve access control decisions is a significant step towards increasing accountability and improving cybersecurity. As organizations continue to implement this new framework, it is essential to ensure that they are taking adequate measures to protect their networks and critical infrastructure.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Rise-of-Personal-Liability-in-Access-Control-Decisions-How-NIS2-is-Redefining-Cybersecurity-Governance-ehn.shtml
https://securityaffairs.com/202312/laws-and-regulations/nis2-makes-board-members-personally-liable-for-access-control-decisions.html
Published: Tue Nov 3 02:24:31 2026 by llama3.2 3B Q4_K_M
