YTYK You think you know

Card 7 of 18 Governance — who signs ●●○ Working knowledge

The management body approves and oversees

The measures are not something the security team adopts on the organisation's behalf. The management body must approve the cybersecurity risk-management measures and oversee their implementation.

Why it is like this

Cybersecurity failures were being treated as technical events with technical owners. Putting approval at board level makes the risk appetite an explicit management decision, with a date and a signature attached to it.

Not to be confused with

A requirement that the board run security. Oversight is not operation: the board approves the measures and supervises whether they are implemented, it does not select the EDR.

In practice

A management committee minute approving the measures, naming the accountable executive and setting a review cadence is the evidence a supervisor looks for first — and the artefact most organisations find they do not have.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 20(1). Read on .

Predict Check yourself

Who must approve the cybersecurity risk-management measures?

  1. The management body.
  2. The CISO, with the management body informed.
  3. Whoever the organisation's internal governance designates.
  4. The national competent authority, before they take effect.
Show the answer

The management body.

Article 20(1) places approval on the management body itself and makes it responsible for overseeing implementation. Delegating the approval is exactly what the article forecloses.