Cyber risk is now a named legal duty of boards and senior executives, and several regimes attach personal consequences to directors who do not approve, oversee and understand it. The EU NIS2 Directive and its national laws make management bodies approve and oversee security measures, follow training and answer for infringements. DORA gives the management body of a financial entity "the ultimate responsibility" for ICT risk. In the United States, SEC rules make listed companies describe board oversight in every annual report, and New York's NYDFS Part 500 requires the CEO and CISO to sign an annual compliance filing. This guide compares what each regime asks of directors personally, where liability actually comes from, the dates that apply and the evidence a board should hold. It is for directors, company secretaries, general counsel, CISOs and GRC leads, and complements the CISO Personal Liability Guide, which looks at the same problem from the security leader's side.
Status checked 27 October 2026. NIS2 applies through national transposition laws, which most Member States have now adopted; DORA has applied since 17 January 2025; the SEC disclosure rules have applied since December 2023; NYDFS Part 500 governance duties in section 500.4 have applied since 1 November 2024. This page is not legal advice.
Key takeaways
- Approval, oversight and training are the common core. NIS2 Article 20, DORA Article 5 and NYDFS 500.4(d) all ask the board to approve the programme, oversee it and know enough to challenge it.
- EU law can reach individuals directly. NIS2 lets authorities, as a last resort, temporarily ban a person from managerial functions in an essential entity, and Germany's BSIG section 38 makes managers liable to their company for culpable breaches.
- US exposure runs through statements and signatures. The SEC regime asks what the 10-K says about board oversight; NYDFS asks the highest-ranking executive and the CISO to certify material compliance by 15 April each year.
- Concealment creates the worst outcomes. The Uber 2016 breach ended in a criminal conviction of the chief security officer for hiding it, not for the breach itself.
- Evidence is the defence. Minutes, training records, risk acceptances and written challenge of management reports show that a director did the job; their absence is what regulators find.
Scope: who and what is covered
Each regime defines the accountable body differently, so the first step is to map which of your boards and executives each one reaches.
| Regime | Accountable body | Entities in scope | Primary text |
|---|---|---|---|
| NIS2 Directive (EU) 2022/2555 | "Management bodies" of essential and important entities, defined by national law (in Germany, the Geschäftsleitung) | Medium and large entities in Annex I and II sectors, plus some entities regardless of size (DNS, TLD registries, trust services, public e-comms) | Art. 20, 32, 33, 34 and the national transposition law |
| DORA Regulation (EU) 2022/2554 | Management body of the financial entity | Banks, investment firms, insurers, payment and e-money institutions, crypto-asset service providers and other listed financial entities | Art. 5 (governance and organisation) |
| SEC cybersecurity disclosure rules | Board of directors (or the supervisory board of a two-tier foreign private issuer) and management | Companies filing with the SEC: Form 10-K and 8-K for domestic registrants, Forms 20-F and 6-K for foreign private issuers | Regulation S-K Item 106; Form 8-K Item 1.05 |
| NYDFS 23 NYCRR Part 500 | "Senior governing body": the board, a board committee or equivalent, or the senior officers responsible if there is no board | Covered entities licensed by the New York Department of Financial Services | Sections 500.4, 500.17(b), 500.20 |
- Group structures: NIS2 applies per legal entity, so a subsidiary board may carry its own Article 20 duties even when the security function sits at group level. DORA applies to each in-scope financial entity.
- Non-executive directors: none of these texts excludes them. NYDFS 500.4(d) and NIS2 Article 20 apply to the body as a whole, so independent directors need the same training and information as executives.
- Outsourced CISOs: NYDFS 500.4(a) allows a CISO employed by an affiliate or third party, but the covered entity stays responsible and must designate senior staff to oversee that provider.
Key obligations
The duties overlap more than the regimes' different styles suggest. The table sets out what a director must actually do under each.
| Duty | NIS2 | DORA | SEC | NYDFS Part 500 |
|---|---|---|---|---|
| Approve the programme | Approve the Article 21 risk-management measures (Art. 20(1)) | Set and approve the digital operational resilience strategy and ICT risk tolerance (Art. 5(2)(d)) | No approval duty; disclose how the board oversees cyber risk (Item 106(c)(1)) | Require executive management to develop, implement and maintain the programme (500.4(d)) |
| Oversee implementation | Oversee implementation (Art. 20(1)) | Approve, oversee and review continuity and response plans, ICT audit plans and the ICT third-party policy (Art. 5(2)(e), (f), (h)) | Disclose how the board or a committee is informed (Item 106(c)(1)) | Exercise oversight and regularly receive and review management reports (500.4(d)) |
| Knowledge and training | Members "are required to follow training" (Art. 20(2)) | Keep knowledge and skills up to date to understand ICT risk (Art. 5(4)) | Disclose management expertise "in such detail as necessary"; no board expertise duty | Have sufficient understanding of cyber matters, which may include advisors (500.4(d)) |
| Resources | Implied by proportionate measures (Art. 21(1)) | Allocate and review a budget, including training (Art. 5(2)(g)) | None | Confirm management has allocated sufficient resources (500.4(d)) |
| Reporting to the board | Not prescribed; needed to evidence oversight | Reporting channels on third-party arrangements and major ICT incidents (Art. 5(2)(i)) | Disclose whether management reports to the board (Item 106(c)(2)(iii)) | CISO reports in writing at least annually and promptly on material issues (500.4(b), (c)) |
| Personal sign-off | None in the Directive | None in Article 5 | Officer certifications on periodic reports apply generally | Highest-ranking executive and CISO sign the annual certification or acknowledgment (500.17(b)) |
Incident disclosure duties that land on the board
- NIS2: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month (Art. 23(4)). Germany's BSIG section 32 repeats these stages.
- SEC: Form 8-K Item 1.05 is due four business days after the company determines an incident is material. Delay is possible only if the US Attorney General finds a substantial risk to national security or public safety.
- NYDFS: the CISO must promptly inform the senior governing body of material cybersecurity issues such as significant events (500.4(c)).
Boards rarely file these reports, but they own the materiality and escalation process that decides whether the clocks are met. See the Cyber Incident Reporting Requirements Map and the SEC Cybersecurity Disclosure Rules Guide.
Timeline and current status
| Date | Event |
|---|---|
| 1 March 2017 | NYDFS Part 500 first promulgated |
| 26 July 2023 | SEC adopts cybersecurity disclosure rules |
| 1 November 2023 | NYDFS second amendment effective, adding the expanded 500.4 governance duties |
| 15 and 18 December 2023 | SEC Item 106 applies to fiscal years ending on or after 15 December 2023; Item 1.05 applies from 18 December 2023 for most registrants (smaller reporting companies 180 days later) |
| 17 October 2024 | NIS2 transposition deadline; national laws apply from 18 October 2024 where adopted |
| 1 November 2024 | NYDFS 500.4 board oversight duties apply |
| 17 January 2025 | DORA applies |
| 6 December 2025 | Germany's revised BSIG with section 38 manager duties in force |
| 8 July 2026 | Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice over NIS2 transposition |
| 15 April each year | NYDFS annual certification or acknowledgment for the previous calendar year |
The Commission proposed targeted NIS2 amendments on 20 January 2026, as reported by law firm commentary (for example Covington's Inside Privacy). They are a proposal, not law; plan against the current text and check the NIS2 Transposition Tracker for your countries.
Enforcement and penalties
| Regime | Against the entity | Against individuals |
|---|---|---|
| NIS2 | Maximum fines of at least EUR 10 million or 2% of worldwide turnover (essential) and EUR 7 million or 1.4% (important), whichever is higher (Art. 34) | For essential entities, as a last resort, a temporary prohibition on a person exercising managerial functions at CEO or legal representative level (Art. 32(5)); liability of individuals otherwise depends on national law |
| Germany (BSIG) | Up to EUR 10 million or 2% (besonders wichtige Einrichtungen) and EUR 7 million or 1.4% (wichtige Einrichtungen) for failures on section 30 measures and section 32 reports (section 65) | Managers who breach section 38(1) are liable to their entity for culpably caused damage under company law (section 38(2)) |
| DORA | Administrative penalties and remedial measures set by Member States and applied by financial supervisors | Depends on national implementation and the supervisor's fit and proper regime; check your national law |
| SEC | Enforcement under the securities laws for misleading disclosure or weak disclosure controls | Officers can be charged; the SolarWinds action against the CISO was dismissed with prejudice in November 2025, but it shows the theory the SEC used |
| NYDFS | A single act or failure is a violation, including material non-compliance with any section for any 24-hour period (500.20) | Penalty factors include the extent to which the senior governing body was involved and whether false or misleading information was provided (500.20) |
- Where the case law points: the clearest personal outcomes so far come from concealment and misleading statements. In the Uber Breach 2016, Uber paid attackers 100,000 dollars for non-disclosure agreements and hid the incident for about a year; its former CSO was convicted in October 2022 of obstruction and misprision of a felony. See the Uber Breach 2016.
- Disclosure gaps: the SEC's SolarWinds complaint relied on contrasts between public security statements and internal reports. The SolarWinds Supply Chain Compromise page covers the attack itself.
- Insurance and indemnity: fines and penalties are often not insurable or indemnifiable; check D&O wording and your articles before relying on either. See the Cyber Insurance Guide.
What it means for AI agents and non-human identities
None of these regimes names AI agents or service accounts, but each reaches them through the measures the board approves. Machine credentials are where boards most often approve a policy that reality does not match.
- Access control and MFA: NIS2 Article 21(2)(i) and (j) cover access control and multi-factor authentication. Implementing Regulation (EU) 2024/2690 section 11.5 asks for unique identities with an owner and deactivation of unneeded identities, which long-lived shared service accounts and API keys usually fail. See the Service Account Security Guide.
- Third parties and integrations: DORA Article 5(2)(h) makes the board approve the ICT third-party policy. SaaS connectors and OAuth grants used by agents are third-party access paths and belong in the register.
- Statements about AI: if the 10-K or a trust page describes controls over AI agents, the board should see evidence that those controls exist. A gap between the description and the agent estate is the SolarWinds pattern applied to AI.
- Board metrics: ask for counts of non-human identities without an owner, secrets older than the rotation policy and agents with standing privileged access. See the Board Briefing: NHI Risk and the Agent Identity and Access Guide.
Compliance steps
- Map the regimes to legal entities (month 1): list each entity, the regimes that apply, its accountable body and the named executives who sign. Record NIS2 tier and Member State per entity.
- Write the board's cyber mandate (month 1 to 2): amend the board or committee terms of reference so approval of the risk-management measures, the DORA strategy and the NYDFS programme are reserved matters, with a named committee. See the Security Governance Committee Charter Template.
- Train the board (month 2, then yearly): run training built on your own services and incidents, keep attendance per director and record topics. BSIG section 38(3) requires regular participation; NIS2 Article 20(2) requires training without setting a frequency.
- Set the reporting cadence (month 2): at least quarterly reporting to the board or committee, plus the NYDFS annual written CISO report and an escalation rule for material events between meetings. See the Board Cyber Risk Reporting Guide.
- Build the certification file (by 15 April): for NYDFS, collect data and documentation for each Part 500 section, decide between certification and acknowledgment, and record the remediation timeline for any gap. Keep it five years.
- Align public statements (each filing): have the CISO and general counsel review Item 106 text, trust pages and questionnaires against the current risk register before each 10-K.
- Test the escalation path (twice yearly): run a tabletop that includes the board, times the 24-hour NIS2 warning and the four-business-day SEC decision, and records who decided materiality.
- Review and roll forward (yearly): review the measures, training and minutes against any changes in national law; where a transposition law is amended, update the mandate before the next approval cycle.
Decision guidance
- One programme or several: a group in scope of NIS2, DORA and NYDFS should run one board cyber calendar with regime overlays, because the core duties match. Keep separate evidence packs per regulator.
- Full board or committee: a risk or audit committee can do the detailed oversight, but NIS2 and DORA place the duty on the management body, so the full board still approves and minutes the strategy.
- Smaller entities: an important entity under NIS2 or a small NYDFS licensee can meet the duties with a single annual approval, a short quarterly report and one training session, as long as each is recorded.
Measuring board oversight
- Training coverage: percentage of directors with documented cyber training in the last 12 months (target 100%).
- Reporting cadence: cyber reports received per year by the board or committee, and the gap between a material event and board notification.
- Challenge recorded: board actions or questions minuted per cyber report; zero over a year suggests oversight is passive.
- Open high risks past due: accepted or untreated high risks past their review date.
- Statement drift: public security statements reviewed against the risk register before each filing.
Framework mapping
| Board duty | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 |
|---|---|---|---|
| Accountability and roles | GV.RR-01, GV.RR-02 | PM-2, PM-29 | Clause 5.1, 5.3 |
| Strategy and risk appetite | GV.RM-01 | PM-9 | Clause 6.1 |
| Policy approval | GV.PO-01 | PM-1 | Clause 5.2 |
| Oversight and review | GV.OV-01 | PM-9 | Clause 9.3 (management review) |
| Supply chain | GV.SC-01 | SR-3 | Annex A 5.19 to 5.22 |
| Incident escalation | RS.CO-02 | IR-6 | Annex A 5.24, 5.26 |
Common failure patterns
- Approval without minutes: the board discussed security but no minute records approval of the measures, so Article 20 cannot be evidenced.
- Training as a slide in the strategy day: no attendance, no content record and nothing specific to the entity's services.
- Certification without a file: the CEO signs the NYDFS certification on the CISO's word, with no data behind each section.
- Two versions of the truth: internal reports describe high risk while the 10-K or customer trust page describes mature controls.
- Escalation by personality: nobody owns the materiality decision, so incidents reach the board late or through the press. Colonial Pipeline shows how quickly an incident becomes a board matter; see the Colonial Pipeline Ransomware Attack 2021.
Practitioner checklist
- List every legal entity with its NIS2, DORA, SEC and NYDFS status and accountable body.
- Reserve approval of cyber risk measures and strategy to the board, with dated minutes.
- Deliver and record director training at least yearly, built on your own services.
- Set quarterly board reporting and an out-of-cycle escalation rule for material events.
- Produce the NYDFS annual CISO report and the 15 April certification file with evidence per section.
- Review public security statements against the risk register before each filing.
- Run a board-level incident tabletop that times the NIS2, SEC and NYDFS decisions.
- Confirm D&O cover and indemnity terms for directors and the CISO in writing.
- Include non-human identity and AI agent metrics in the board report.
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- Bundesministerium der Justiz: BSIG section 38, duties of management
- eCFR: 17 CFR 229.106 (Regulation S-K Item 106)
- SEC: Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure rules
- NYDFS: 23 NYCRR Part 500
- European Commission: NIS2 referrals to the Court of Justice
Related NHI Mgmt Group resources: CISO Personal Liability Guide · UK Cyber Governance Code of Practice Guide · NIS2 Directive Guide · DORA Guide · NYDFS Part 500 Guide. This guide summarises management body and director cyber duties under NIS2, DORA, the SEC rules and NYDFS Part 500 and is not legal advice.