NIS2 Makes Board Members Personally Accountable and Requires Them to Be Trained
There is a lot of discussion about the technology behind NIS2: firewalls, logging, and incident management. What receives less attention is that the legislation explicitly outlines what management must do, and one requirement is easy to overlook: the board of directors and CEO must undergo cybersecurity training to make informed decisions.
This is no mere formality. Since the Cybersecurity Act came into force in January, management has been personally accountable for approving and overseeing the organization’s security measures. In serious cases, supervisory authorities can also impose temporary bans on individuals holding management positions. “We trusted the IT department to handle it” is no longer a valid excuse. Fines can reach up to SEK 75 million in the most serious cases.
This creates an unusual situation: legislation where the required expertise is just as important in the boardroom as it is in the server room. Most boards are accustomed to reviewing financial reports, not assessing whether a cybersecurity risk assessment is reasonable.
We are already seeing this become a bottleneck for many companies. The challenge is not necessarily the technology itself, but finding the right training for the intended audience. An in-depth technical course designed for security specialists is not the right level for a board. What is needed is training that provides sufficient understanding to ask the right questions and make informed decisions, without requiring board members to become security experts themselves.
That is exactly the type of course we have developed at FutureSpex, specifically for management teams and boards that need to demonstrate they have fulfilled their legal responsibilities. Not just in theory, but with documented training to show for it if a supervisory authority comes asking.
Sources:
Comments