The board, executive management and the wider organisation.
These are the three levels that need to be involved when assigning responsibilities for NIS2.
By now, most organisations are aware that management plays a significant role in implementing NIS2 and that individual members of management can be held personally liable if the organisation fails to comply with the requirements.
But maybe you are still wondering exactly who is responsible for what and how the tasks should be divided across the organisation.
In a webinar on management’s role under NIS2, Cerivo’s COO, Martin Vasehus, breaks down these responsibilities.
Management's role: appoint a sponsor
The first step is to appoint a sponsor, whose role is to approve, oversee and ensure that the right priorities are in order.
“You appoint someone to take responsibility. It could be someone from executive management or the board of directors. Ideally, you would have both. Naturally, the person from management needs to be much more involved than the person from the board. But I recommend having a sponsor at the highest level of management,” Vasehus explains.
The sponsors’ involvement in NIS2 can take different forms. Executive management may work closely with the individual risk assessments, while the board typically needs a more consolidated overview, such as a heatmap and a brief summary.
In private companies, the board must consider the company’s risks at least once a year, making it a natural opportunity to incorporate cybersecurity risks and NIS2 into the overall risk assessment.
In addition to appointing a sponsor, a team needs to be established to manage the day-to-day work with NIS2.
The organisation’s role
The team of employees, which Vasehus refers to as “the organisation”, is responsible for driving the day-to-day work with NIS2, gathering knowledge from across the organisation and reporting progress, challenges and needs back to management.
This is also where the work with risk assessments begins.
The designated team must identify and assess the organisation’s cybersecurity risks, establish a consolidated overview and propose appropriate security measures.
From there, it is the sponsor’s responsibility to consider the organisation’s overall risk exposure, whether the proposed measures are appropriate and whether the residual risk is acceptable – from a societal as well as a commercial perspective.
NIS2 in practice: Are our measures working?
Once management has approved the security measures, the focus shifts to implementation and ongoing operations.
The organisation must implement the measures, including the necessary policies and procedures. It must then document progress, delays and challenges and demonstrate that the measures are effective.
Management’s role – the sponsor – is to oversee compliance with the agreed measures and determine whether priorities need to be adjusted.
And adjustment is important as circumstances can quickly change, explains Martin Vasehus.
“Assessing the effectiveness of security measures is a continuous process that you repeat year after year – and you’ll often find small gaps. Something new might happen. You might replace one IT system with another, acquire a fifth company that needs to be integrated or expand into a new business area.”
Regular reporting helps management stay informed and take action when needed. This could include quarterly updates on progress and the effectiveness of security measures, along with an annual review by the board. What matters most is having a consistent process that gives management the overview it needs to make informed decisions.
Finally, there’s one thing that should involve everyone, from the sponsor to the wider organisation: Training.
Under NIS2, management is legally required to undergo training to ensure it has sufficient knowledge and skills to oversee the organisation’s cybersecurity risks. Employees should also be offered relevant training and education, so they are equipped to fulfil their responsibilities.
As Martin Vasehus puts it:
“Management doesn’t need to be experts in cybersecurity. But they need to understand the risks well enough to make decisions about them.”
Want to learn more about the different roles and responsibilities under NIS2?
Watch the webinar here.
Webinar: How to put management’s NIS2 responsibilities into practice