A director who has been warned they can now be held personally liable for a cyber failure usually asks the wrong follow-up: how bad is the liability? The more useful question sits underneath it, what are they actually supposed to do to avoid it? Under NIS2, liability is only the consequence of failing a set of specific duties, and those duties, not the penalty, are where a board's attention is better spent.
Article 20 places three obligations on the management body: approve the cybersecurity risk-management measures, oversee their implementation, and undertake training. Each sounds simple and each means more in practice than it appears.
Duty one: approve - which means understand well enough to approve
The first duty is that the management body must approve the Article 21 risk-management measures.
The word "approve" is doing quiet work here, because approval that is not informed is not really approval at all.
A board cannot meaningfully approve a set of cybersecurity measures it does not understand, so the approval duty implies a comprehension duty: the measures have to be presented in terms the board can actually evaluate, and the board has to engage with them rather than rubber-stamp a paper from the security team.
In practice this means the measures come to the board as decisions it can interrogate, what risks they address, what they cost, what they leave uncovered - not as a technical appendix to be noted. The duty is not "sign here." It is "understand what you are signing for, and take responsibility for it."
This is also why the approval cannot be delegated away. A board can delegate the doing of cybersecurity to its security function; it cannot delegate the approving, because the directive puts that specific act at the management-body level.
Duty two: oversee - which is continuous, not annual
The second duty is to oversee the implementation of the measures.
Oversight is a different activity from approval, and a more ongoing one. Approval happens at a point in time; oversight continues after it.
In practice, oversight means the board has to stay informed about whether the measures it approved are actually being implemented and working, not revisit the topic once a year when the audit lands. That implies a reporting line: regular, intelligible information about the entity's cybersecurity posture, incidents and gaps, structured so the board can tell whether the programme is on track or drifting.
A board that approved a strong set of measures and then heard nothing until an incident has not discharged the oversight duty, however good the original approval.
The practical test is simple: if asked, could each member of the management body say how they know the measures are working? If the honest answer is "we approved them and assumed," the oversight duty is not being met.
Duty three: train - and it is the board that must be trained
The third duty is the one boards most often overlook, because it points at them personally. Members of the management body must undertake cybersecurity training.
This is not the staff-awareness training the organisation rolls out to employees. It is training for the directors, so they are equipped to do the first two duties properly.
The logic is tight: you cannot meaningfully approve or oversee cybersecurity measures if you cannot follow what they are for. The training duty exists to close that gap, to give the people signing off on the risk-management programme enough literacy to assess the risks and challenge the answers they are given.
In practice it means board-level cybersecurity education, proportionate to the role and recorded so it can be evidenced. A management body that has never been trained is, by the directive's own logic, not equipped to discharge the duties it carries.
How the three fit together
Read as a set, the three duties describe a loop, not a checklist. The board is trained so that it can understand the measures; it approves them on the basis of that understanding; and it oversees their implementation continuously, feeding back into the next round of approval as the risk picture changes.
Remove any one and the others weaken: approval without training is rubber-stamping, oversight without approval has nothing to oversee against, and training without the other two is education with no purpose.
What NIS2 is really doing with Article 20 is refusing to let cybersecurity sit entirely below board level. It makes the management body a participant, not just a signatory - and the three duties are the mechanics of that participation. The liability provisions get the headlines, but a board that genuinely discharges these three duties is a board that has made the liability question largely academic.
What this means for a board, in practice
The practical implications are concrete, and four things follow for anyone who sits on an in-scope management body. The board needs cybersecurity on its agenda as a standing item, not an occasional one, so oversight is continuous; and it needs the Article 21 measures presented in terms it can evaluate, so approval is informed.
It also needs its own members trained and recorded, proportionate to their role, so the first two are possible - and a regular, intelligible reporting line from the security function, so the gap between what the board approved and what is actually happening stays visible.
None of that is exotic. It is governance applied to cybersecurity - which is precisely what Article 20 requires, and precisely what most boards have not yet built.
Frequently asked questions
What does NIS2 require of a company's board or management?
Montro's summary: under Article 20, the management body of an in-scope entity has three duties - to approve the Article 21 cybersecurity risk-management measures, to oversee their implementation, and to undertake cybersecurity training themselves.
These are active obligations, not a formality: approval has to be informed, oversight has to be continuous, and the training is aimed at the directors personally so they can do the other two properly.
Can the board delegate NIS2 cybersecurity responsibility to IT?
The implementation, yes; the governance duties, no. A management body can have its security function carry out the measures, but Article 20 places the approval, oversight and training duties on the management body itself, and those cannot be fully delegated away.
The board remains responsible for approving the measures and overseeing them, whoever performs the underlying work.
Does NIS2 require board members to be trained?
Yes, and this is distinct from staff awareness training. Article 20 requires members of the management body to undertake cybersecurity training themselves, so they are equipped to identify and assess the risks they are approving and overseeing.
In practice this means board-level cybersecurity education, proportionate to the role and recorded so it can be evidenced, a management body that has never been trained is not equipped to discharge its other Article 20 duties.
What is the difference between approving and overseeing under NIS2?
Approval is a point-in-time act, the board signs off the Article 21 measures, having understood them. Oversight is continuous, the board stays informed, through a regular reporting line, about whether those measures are actually being implemented and working.
A board can discharge the approval duty well and still fail the oversight duty if it approves strong measures and then hears nothing until an incident. The two are separate obligations and need to be met separately.
