NIS2 Boards Held Personally Liable for Access‑Control Decisions Across the EU
What Happened — Article 20 of the EU NIS2 Directive now obliges the management bodies of “essential” and “important” entities to approve and oversee the implementation of access‑control measures. Boards must be able to demonstrate that policies such as least‑privilege, MFA, and continuous authentication are in place, that a responsible officer is resourced to manage the risk, and that any deficiencies are reported to them. The rule is already enforceable in most EU Member States; four states are currently before the Court of Justice for failing to transpose the requirement. An estimated 160 000 organisations fall under NIS2’s scope, and many are revisiting governance structures to satisfy the new accountability mandate.
Why It Matters for Trust & Control Assurance — This regulatory shift tests the Access‑Control Governance control objective: boards must obtain verifiable evidence that approved controls are operating, a signal that the organization can produce defensible audit artifacts across multiple frameworks.
Who Is Affected — All EU‑based essential and important entities (e.g., energy utilities, digital service providers, health‑care operators, financial market infrastructures).
Recommended Actions
- Map your access‑control policies to the Verisq Common Framework (VCF) control “Access Management & Authorization”.
- Institute a formal board‑level reporting cadence that includes evidence of MFA rollout status, privileged‑account reviews, and remediation of gaps.
- Appoint an independent Information & Communication Systems Security Officer (or equivalent) with budget authority and document the role in your governance charter.
- Provide mandatory cybersecurity training for board members and cascade comparable training to all employees.
Source: Security Affairs
Technical Notes
- NIS2 Article 21 enumerates required technical measures: role‑based access control, asset inventory, MFA or continuous authentication where appropriate.
- Greece’s transposition adds a statutory “Information and Communication Systems Security Officer” role, illustrating how national laws may tighten the generic EU text.
Source: same as above