The National Cyber Security Centre (NCSC) published its Guidance on Cyber Governance for Management Board Members in NIS2 entities (PDF, 2.9MB) in July. The guidance is a timely reminder that cybersecurity is no longer solely an operational or IT issue: management boards are expected to actively oversee cyber risk and may face significant consequences for non-compliance. This article highlights the key points from the Guidance and the practical steps organisations should now consider. 

What is NIS2 and Who Does it Apply To?

The Network and Information Security Directive 2022/2555 (NIS2) updates the European Union’s cybersecurity framework for essential and important entities. It expands the sectors in scope, strengthens cybersecurity and resilience requirements, and introduces enhanced supervisory and enforcement powers. 

In-scope entities are classified as either “essential” or “important”, with essential entities subject to more proactive supervision and important entities generally subject to reactive supervision following an incident or indication of non-compliance. 

In Ireland, NIS2 will be transposed through the National Cyber Security Bill. Organisations that fall within scope should use the period before implementation to assess whether their governance arrangements, cyber risk reporting and incident response processes are capable of meeting the expected standard. 

Management Board Responsibilities and Liabilities

Article 20 of NIS2 requires Member States to ensure that the management bodies of essential and important entities approve cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements. A clear message from the Guidance is that cybersecurity is now firmly a board-level issue, requiring active oversight rather than passive approval.

Boards should approve a documented cyber risk strategy, ensure risks have clear owners with appropriate authority and budget, and receive sufficiently regular reporting to maintain an up-to-date view of the organisation’s risk status.

Enforcement and Penalties

NIS2 provides national authorities with a range of enforcement powers for non-compliance, including warnings, binding instructions, compliance orders, security audits, and administrative fines. For essential entities, authorities may also suspend certification or authorisation and temporarily prohibit certain senior managers from exercising managerial functions.

The financial penalties are significant:

• For important entities: at least €7,000,000 or 1.4% of the total worldwide annual turnover in the preceding financial year, whichever is higher.
• For essential entities: at least €10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year, whichever is higher.

Incident Reporting Obligations

• Entities in scope must notify the NCSC of significant incidents. The Guidance emphasises the need for incident reporting readiness, including a documented incident response plan, clear incident classification criteria, an identified response team and procedures for engaging with external parties such as the NCSC, law enforcement, affected persons and the media.
• Organisations should also be able to restore critical services within defined tolerances, test response arrangements, and conduct post-incident reviews to strengthen resilience and reduce the risk of repeat failures.

The Business Implications of Cyber Risk

The Guidance uses real-world case studies, such as the 2021 HSE ransomware attack and the 2025 Collins Aerospace cyber-attack, to illustrate the operational, financial, legal and reputational consequences of cyber incidents. It encourages boards to consider cyber risk through the lenses of physical harm, financial loss and organisational weakening, including reputational damage and loss of stakeholder trust.

Establishing an Effective Cyber Resilience Strategy

Pursuant to NIS2, the Management Board is expected to demonstrate proactive governance through appointing clear cybersecurity leadership, ensuring effective reporting lines to and from the Management Board and embedding continuous improvement through monitoring, incident learning, KPIs, risk reviews and cyber audits.

The Guidance structures resilience around exposure, defences and consequences: where the organisation is vulnerable, how strong its protections are, and how well it can recover and adapt. It also highlights supply chain risk, including the need for proportionate supplier assessments, contractual controls, ongoing monitoring, incident notification obligations and visibility over critical sub-contractors.

The Cyber Fundamentals Framework

The Guidance highlights the NCSC’s Cyber Fundamentals (CyFun) Framework as a practical means of demonstrating compliance with NIS2. Built around the core functions of Govern, Identify, Protect, Detect, Respond and Recover, the framework provides organisations with a structured approach to assessing cyber resilience and identifying areas requiring further attention ahead of NIS2 implementation.

Next Steps for Management Boards

For management boards, the Guidance points towards five practical priorities: 

• Establish or improve a cybersecurity programme, using the CyFun Framework as a structured tool.
• Integrate cybersecurity into enterprise-wide risk management, employing an Enterprise Risk Management approach to balance cyber risk alongside other risk considerations.
• Ensure the Board is briefed on NIS2 and cyber risk.
• Assign ownership for NIS2 compliance, ensuring that roles, responsibilities, and accountabilities are clearly communicated and understood.
• Build cyber awareness into leadership development, noting that NIS2 requires Management Board members to undertake training to identify risks and assess cybersecurity risk-management practices.

Taken together, the Guidance provides a clear indication of expected cyber governance standards. Organisations likely to fall within scope should assess their governance structures, risk management processes, supplier controls and board reporting arrangements ahead of the implementation of the National Cyber Security Bill.

Further Information

Further information is set out in our briefing, “Are you cyber ready? Key points of the NIS2 Directive”, and video series, “Network and Information Security Directive (NIS2)”. If you would like to discuss how the Guidance may affect your organisation, please contact a member of the Technology and Innovation Group.

The authors would like to thank Seoda Smyth for her contribution to this article.