Which governance responsibilities should boards and managers expect to own under NIS2?

How NIS2 turns the boardroom into an accountability control

NIS2 does not ask boards and managers to become operators, but it does make them accountable for whether governance exists, works, and can be evidenced. That means setting direction for incident readiness, supplier oversight, and response assurance, then ensuring the organisation can show the decisions, approvals, and ownership that supported action during disruption.

At this level, the question is less about who clicks the buttons and more about whether leadership can demonstrate control over the operating model. If a regulator, auditor, or customer asks how the organisation knew a response was triggered, how a supplier risk was accepted, or who approved the chosen containment path, governance evidence becomes part of the control itself.

That is why board responsibility under NIS2 is best understood as oversight of capability, not delegated technical execution. Leaders should be able to explain the operating assumptions behind resilience, the escalation thresholds for incidents, and the evidence that the organisation rehearses those responsibilities before a real event forces the issue.

What boards and managers are actually expected to own

The practical scope is governance over three linked areas: incident readiness, supplier governance, and demonstrable accountability. Incident readiness means the organisation has tested response roles, escalation routes, and decision authority before a crisis. Supplier governance means third-party dependencies are assessed, monitored, and contractually controlled where they affect service continuity or incident response.

Demonstrable accountability is the part many organisations underplay. NIS2 expects management to show that the right people were involved, the right decisions were taken, and the organisation can reconstruct approval and oversight after the fact. That may include board-level risk acceptance, management sign-off on control exceptions, and evidence that incident exercises were meaningful rather than ceremonial.

Boards should also expect to own the quality of reporting they receive. If management reports only high-level assurances without evidence of testing, dependency mapping, or unresolved supplier issues, the board cannot credibly claim oversight. Good governance under NIS2 requires traceable information, not just periodic comfort statements.

How to recognise when governance is strong enough for NIS2

Strong NIS2 governance is visible when the organisation can connect policy, decision-making, and operational proof. That usually means incident playbooks have been exercised, supplier risk is reviewed on a recurring basis, and leadership can produce records showing who approved risk decisions and how exceptions were handled. Guidance from the EU NIS2 Directive makes clear that management accountability is not abstract, it is tied to the organisation’s ability to govern risk and demonstrate due care.

The same standard should be applied to third-party dependencies. If a supplier can affect incident response, service availability, or recovery timing, then supplier governance is not a procurement issue alone. The board and senior managers need evidence that critical dependencies are understood, monitored, and contractually aligned to the organisation’s resilience expectations.

For practitioners, the practical test is simple: if the organisation had to explain its response to an incident six months later, could it show who made which call, on what basis, and with what approval trail? If not, the governance model is still immature even if the technical controls are sound.

Risk and Threat Considerations

When boards and managers treat NIS2 as a reporting exercise, the risk is governance failure rather than just weak paperwork. Poor oversight can leave incident decisions undocumented, supplier exposure unmanaged, and response authority unclear when speed matters most.

Failure mechanism: Leadership delegates operations without retaining evidence of testing, escalation, supplier review, and risk acceptance, so the organisation cannot prove that controls were exercised or that accountability was real during disruption.

Impact: The organisation becomes harder to defend in an incident review, more exposed to regulatory findings, and less able to coordinate response when a supplier, outage, or security event requires fast decisions.

Practitioner Guidance

What to verify: Boards should verify that incident exercises, supplier reviews, and exception approvals leave an auditable trail, not just meeting minutes. If those artefacts do not exist, governance is weaker than the control language suggests.

Decision rule: If a risk or response decision could materially affect service continuity, require a named owner, an approval path, and a retention standard for the evidence of that decision. Treat undocumented discretion as an exception condition, not normal operating practice.

What good looks like: Management can brief the board on current incident readiness, top supplier dependencies, unresolved issues, and who is accountable for each material risk acceptance. The board can then challenge, not merely receive, that information.

Practitioner takeaway: Under NIS2, governance is only credible when oversight is provable. The board’s job is to make sure accountability exists before an incident, and can still be demonstrated after it.

Related resources from NHI Mgmt Group

• Who should own NIS2 readiness when identity, security, and governance responsibilities span multiple teams?
• What makes agentic AI an NHI governance issue?
• What is the difference between attack surface management and NHI governance?
• Why is it important to integrate identity and data governance?