NIS2 Holds Boards Accountable for Access Control Oversight

NIS2 Article 20 places management bodies of essential and important entities under liability for the cybersecurity measures they approve, oversee, and report on, with enforcement powers exercised under national law across most EU states. The article notes that directors are not tasked with micromanaging day‑to‑day access decisions, such as who has administrator rights, but they must ensure that access controls are in place, that a responsible risk owner exists, and that problems are addressed.

Greece’s transposition goes further by mandating an Information and Communication Systems Security Officer to coordinate compliance, with independent operation from the data protection officer. An estimated 160,000 entities fall within NIS2’s reach across the EU.

The piece emphasises that board reports should show not only policy requirements but how controls are enacted in practice, including exceptions and prolonged or unreviewed exemptions, and supplier access after contracts end. Regulators increasingly expect evidence of effectiveness, such as who can access critical systems, why access was granted, who approved it, the validity period, and when changes occurred.

The article references a Passwork NIS2 access management report in which regulators and independente security leaders describe boards demanding proof that controls work, rather than a summary of policy. On exposure risk, the report underlines that CISOs should brief boards on ownership of the access-control risk and whether those responsible have authority to remediate, with board reporting highlighting unresolved exceptions and accountability for closure.

The piece also outlines the potential penalties: for essential entities, fines can reach at least €10,000,000 or 2% of global turnover, rising to €7,000,000 or 1.4% for important entities, under Article 32 and Article 20’s overarching liability framework.