NIS2 Makes Board Members Personally Liable for Access Control Decisions
NIS2 Article 20 makes board members personally liable for cybersecurity controls they approve.
Under NIS2 Article 20, management bodies of essential and important entities across the EU must approve, implement, and oversee cybersecurity risk-management measures—including access controls—and can face personal liability for infringements. Boards are now demanding evidence that approved controls actually work in practice, shifting from policy summaries to documented proof of implementation, with approximately 160,000 entities falling within NIS2 scope.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Passwork?
Get an email when a new story names Passwork, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNIS2 Article 20 marks a fundamental shift in European cybersecurity governance by making board members personally liable for failures in approving and overseeing cybersecurity risk-management measures, including access controls. This matters because for years, executives could treat cybersecurity as a delegated IT function with little personal accountability, leaving access control decisions under-resourced and under-scrutinised. Now, with approximately 160,000 entities in scope, boards can no longer rely on policy summaries—they must produce documented, verifiable evidence that approved controls are actually implemented and effective. The personal liability dimension transforms access control from a technical checkbox into a boardroom-level governance imperative, incentivising genuine oversight rather than paper compliance.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.