Senior management should be accountable, with cybersecurity ownership embedded in governance rather than left solely to technical teams. NIS2 explicitly pushes organisations to appoint leadership roles that can oversee risk, reporting, and enforcement readiness. In practice, accountability should span executive sponsors, security leadership, and operational owners so compliance and resilience are managed together.
Who owns NIS2 readiness in connected mobility?
NIS2 readiness is not a task to hand off entirely to security operations. In connected mobility organisations, the accountable owner should be senior management, because the directive expects leadership to govern risk, approve priorities, and ensure enforcement readiness. Operational delivery can sit with security, IT, product, and engineering, but accountability must remain at executive level.
Connected mobility increases the importance of this split because the risk surface spans vehicles, back-end platforms, suppliers, telematics, cloud services, and incident reporting obligations. If accountability sits too low in the organisation, the company can end up with controls that exist on paper but are not funded, enforced, or escalated quickly enough when business and safety decisions conflict.
That is why NIS2 readiness should be treated as a governance issue first, and a technical programme second. The accountable executive owns the decision to prioritise remediation, accept residual risk, and align cross-functional teams around evidence of resilience rather than isolated technical tasks.
How accountability should be structured across the organisation
The practical model is shared execution with single-point accountability. Executive leadership should own the readiness outcome, while security leadership translates the directive into control requirements, assurance activity, and reporting. Operational owners then implement the work in domains such as infrastructure, software, supplier management, and incident response.
This structure matters because NIS2 readiness touches multiple control planes at once: governance, incident handling, access control, resilience, and third-party oversight. For a connected mobility business, those responsibilities often sit in different teams, so readiness fails when no one is clearly accountable for end-to-end closure.
Accountability should also cover the evidence trail. Leaders need to be able to show who approved risk decisions, who owns corrective actions, and how readiness gaps are tracked through to closure. Without that, even strong technical controls can fail the basic test of demonstrable governance.
What usually breaks when accountability is unclear
When accountability is diffuse, readiness work tends to fragment into compliance tasks, security tasks, and engineering tasks that are never joined up. The result is delayed remediation, weak ownership of incident reporting, inconsistent supplier follow-up, and poor visibility into whether resilience requirements are actually being met.
Connected mobility organisations are especially exposed to this failure mode because external dependencies are part of normal operations. A supplier, platform team, or vehicle software release process may all control different parts of the same risk, so the organisation needs one accountable owner to force decisions when those dependencies conflict.
That is the real readiness issue: not whether control activities exist, but whether someone at leadership level can make them stick across organisational boundaries.
Risk and Threat Considerations
Readiness risk rises when cybersecurity accountability is treated as a technical delegation rather than a leadership duty. In connected mobility, that creates exposure across incident reporting, supplier assurance, access governance, and recovery planning, especially where a single failure can affect fleets, customers, or critical services.
Failure mechanism: teams optimise their own control areas, but no executive owns the combined risk, so gaps persist between governance, operations, and evidence.
Impact: the organisation may miss NIS2 obligations, respond too slowly to incidents, or be unable to prove that resilience and oversight were managed as a board-level concern.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while NIS2 and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIS2 | GV.OC-01 — Organisational Context | NIS2 readiness in connected mobility depends on governance ownership and leadership accountability. |
| GV.RR-01 — Roles, Responsibilities, and Authorities | The question is specifically about who is accountable for readiness across teams. | |
| GV.RM-01 — Risk Management Strategy | Readiness requires leadership decisions on prioritisation, residual risk, and enforcement. | |
| Recommendation — Assign executive accountability for NIS2 readiness and review it through formal governance. Define a single accountable leader and clear operational owners for each readiness workstream. Use a leadership-owned risk strategy to drive remediation priorities and exception decisions. | ||
| ISO/IEC 27001:2022 | A.5.2 — Information security roles and responsibilities | Leadership accountability for cybersecurity readiness is a core governance requirement. |
| Recommendation — Document security roles and responsibilities with explicit management accountability. | ||
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | The answer centers on governance ownership and cross-functional responsibility. |
| Recommendation — Set clear accountability for readiness, then assign delivery responsibilities to supporting teams. | ||
Practitioner Guidance
What to prioritise: assign one named executive accountable for NIS2 readiness, then make security, legal, operations, and engineering responsible for defined deliverables under that owner. The key test is whether each major obligation has a clear decision-maker, a named executor, and a reporting path back to leadership.
What to verify: confirm that readiness evidence is not scattered across teams. You should be able to trace risk acceptance, remediation status, incident escalation, and supplier oversight to a single governance structure that leadership reviews on a regular cadence.
Practitioner takeaway: NIS2 readiness succeeds when executive accountability is real and measurable, not symbolic, because only leadership can force the cross-functional trade-offs that connected mobility resilience demands.
