NIS2: what your management is personally responsible for

NIS2 is unusual among European security instruments in where it places the duty. Article 21(2) sets out the measures. Article 20 makes the management body directly responsible for approving those cybersecurity risk-management measures and for overseeing their implementation, and provides that members of that body can be held liable.

That is not a formality that can be delegated to whoever administers Microsoft 365. It is a personal obligation on named individuals, and it has a shape that matters: approving something means having understood it.

The ten controls you will be asked to evidence

The catalogue below is the control set the platform checks. It is deliberately short and high-signal, because auditors care about traceability rather than breadth: ten controls each with a defensible evidence trail is worth more at an audit than sixty with none.

Each control carries an evidence query that runs against tables the platform already holds. There is no separate compliance data-entry exercise, and that is the design intention: evidence assembled by hand for an audit is evidence that describes the week of the audit rather than the year of operation. Each control also has a minimum-rows threshold, and produces a result with a status, an evidence count and a checked-at timestamp. The default report window is 30 days.

compliant

The evidence query returned at least the minimum number of rows. This is a statement about the presence of evidence, not a judgement that the control is adequate for your risk profile — that judgement belongs to your auditor and to your management body.

partial

Evidence exists but falls below the control's minimum-rows threshold. Read this as "started, not finished", and expect an auditor to ask what the remainder looks like.

missing

No evidence rows were returned, or the query could not run at all. Both cases are reported as missing rather than being silently skipped, because a control that cannot be evaluated must never present itself as a passing one.

The reporting clock

When a significant incident occurs, NIS2 imposes a sequence with fixed deadlines. The deadlines are short enough that they cannot be met by a process invented on the day.

1. 1

   Within 24 hours — early warning

   A notification to your competent authority indicating that a significant incident has occurred, including whether you suspect unlawful or malicious action and whether there is possible cross-border impact. It is an early warning, not a full analysis; the point is speed, and waiting for certainty is how organisations miss this deadline.

2. 2

   Within 72 hours — incident notification

   An assessment of the incident: severity, impact, and the indicators of compromise where they are available. This is the deadline that depends most heavily on the record your responders kept while working — which is why the eighth step of What to do when an alert arrives is to write it down as you go rather than afterwards from memory.

3. 3

   Within one month — final report

   A detailed description of the incident, its severity and consequences, the type of threat and root cause, and the mitigation measures applied. This is where a hash-chained audit trail earns its cost: the sequence of what was detected, decided and done exists as a verifiable record rather than a reconstruction.

Rehearse this once, before you need it. The single most common failure is not a technical one — it is that nobody knew who was authorised to send the 24-hour notification, and the deadline passed while the question was being escalated. Decide now which named individual sends it and which named individual deputises for them.

Penalties, stated plainly

Article 34 requires Member States to provide maximum administrative fines reaching at least the thresholds below for infringements of Articles 21 or 23. These are minimum thresholds for the maximum fines available to authorities, not mandatory minimum penalties for an individual infringement. The applicable national law and the circumstances of the case determine the penalty.

Alongside the financial exposure, Article 20 permits liability to attach to members of the management body, and supervisory authorities have powers that include requiring the publication of infringements and, for essential entities, temporarily suspending management functions. Determining which classification applies to your organisation is a legal question about your sector and size that this platform does not answer for you; it is worth answering early, because the obligations differ.

What the management body actually has to do

1. 1

   Read the posture report yourself, at least once, in full

   Not a summary of it. The report names your actual administrators, applications and devices, and the point of reading it directly is that you cannot approve risk-management measures for an estate you have never looked at. Reading your posture report explains the structure.

2. 2

   Approve or accept each significant finding, and record which you did

   Approval and acceptance are both legitimate. "We accept this risk because the remediation would break the production line, and we will revisit it in six months" is a defensible governance decision. Leaving the finding unread is not, and it is visibly not, because the absence of a decision is itself recorded.

3. 3

   Review the control conformity report on a fixed schedule

   Monthly matches the default 30-day window. What you are looking for is a control moving from compliant to partial or missing, which usually means something operational stopped happening rather than something dramatic occurring.

4. 4

   Name the people who handle the reporting clock, and rehearse it

   One named person for the 24-hour early warning, one deputy, and a channel that does not require your Microsoft 365 tenant to be working — because in a material incident it may not be.

5. 5

   Keep the evidence you issue

   Generate a stamped evidence bundle for each review period and retain it. A stamped bundle is a point-in-time record whose integrity can be demonstrated later; a live query is not. See The evidence bundle.

6. 6

   Ensure your own training is real

   Article 20 also expects management to undergo training sufficient to identify and assess risk. The honest test is whether you could explain, unaided, what your organisation's three largest security risks currently are. If you cannot, the training has not happened yet, whatever the register says.

Why an accepted finding still appears in the bundle

Every posture finding, and the decision taken about it, appears in the evidence bundle whether it was fixed or accepted. Organisations occasionally ask for accepted findings to be excluded, on the reasoning that an auditor will read them as failures.

The opposite is true, and it follows directly from Article 20. An auditor examining whether a management body has exercised its duty is looking for evidence of decisions. A register of risks that were seen, weighed and consciously accepted, with dates and reasons, is the strongest available demonstration that approval was substantive rather than ceremonial. A bundle showing no accepted risks whatsoever describes either a perfect organisation or an inattentive one, and auditors know which is more common.

What to read next

1. The evidence bundle: what an auditor gets — how to produce and stamp the artefact.
2. How findings map to DORA and ISO 27001 — the same controls, expressed in the vocabularies a customer questionnaire uses.