the work
the board's part
Security decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
the reality
The change is that a director can no longer say security belongs to IT. So most of the work here is making a decision visible afterwards. Picture a director asked by an authority in two years: what did you know, and what did you decide? The minutes are the answer.
Personal exposure depends on where you are. Poland has written it down: a fine of up to 300% of pay for the head of a private entity, available after 3 April 2028. Elsewhere, ask.
basis NIS2 Art. 20(1), 32(6); KSC Art. 8c, 73a(4), 35
what to decide
- Who reports to you on security, in writing, with what budgetboard
- How often security is on the agenda. The texts set no frequency, so write down the one you choseboard
- Which risks you accept, by name, and which you pay to reduceboard
- When directors take their trainingchair
basis NIS2 Art. 20(1), 20(2); DORA Art. 5(2); KSC Art. 8d
what the board holds, and what it hands over
basis NIS2 Art. 20(1), 20(2); DORA Art. 5(2); KSC Art. 8c, 8d, 8e. The split between columns is practice.
what to build
- Three pages for each meeting: top risks with owners, measures proposed with their cost, last period's incidents. Ask for a decision on each measure.
- Minutes that record what was approved, what was declined and why. A reasoned no is better evidence than silence.
- A status check at the next meeting: what happened to last time's decisions.
- Management training, booked, with a record kept. In Poland it is once a calendar year and documented.
- A written delegation naming the person, with their budget.
basis NIS2 Art. 20(1), 20(2); KSC Art. 8e(1), 8e(3). The three pages are practice.
the loop a board needs to run
- 1top risksone page, with owners
- 2options and costwhat each measure takes
- 3a decisionminuted, with reasons, including no
- 4the workthe owner builds it
- 5status backlast time's decisions, checked
next meeting. The texts set no frequency, so write down the one you chose
basis working practice. No legal text sets this.
the evidence it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| minutes with approvals and reasons | company secretary | each meeting |
| the board pack: risks, measures, cost, incidents | named owner | each meeting |
| training record for each director | company secretary | yearly |
| written delegation with name and budget | chief executive | on change |
basis KSC Art. 8e(3); GDPR Art. 24(1). The rest is practice.
what goes wrong
security belongs to IT
The texts say approve and oversee. IT can propose and build, and cannot do this part for you.
a policy nobody decided
A signature on a document nobody discussed is weak evidence that the board oversaw anything.
no record of a no
Declining a measure is allowed when the reasons are recorded. Silence reads as not knowing.
delegating and forgetting
In Poland the head stays responsible after delegating, and if nobody was named, every board member is.
basis NIS2 Art. 20(1); KSC Art. 8c(2), 8c(3)
what the texts leave open
- What held liable means in your country. NIS2 leaves the mechanism to national law, and personal fines as in Poland are one version. Ask a lawyer about yours, and whether directors' insurance responds.
- How much training is enough. NIS2 sets no hours or topics beyond being able to identify risks and assess practices.
- Temporary bans from management functions exist in the directive for essential entities, in the last resort. A national act can differ.
basis NIS2 Art. 20(1), 20(2), 32(5)
check it yourself
what each text says, for whoever checks this page
| text | says |
|---|---|
| NIS2 Art. 20(1) | Management bodies approve the measures, oversee implementation and can be held liable. |
| NIS2 Art. 20(2) | Members of management bodies must follow training. |
| NIS2 Art. 32(5) | For essential entities, in the last resort: a request to temporarily bar a person from managerial functions. |
| NIS2 Art. 32(6) | Those representing an essential entity can be held liable for breach of their duties. |
| DORA Art. 5(2) | The management body defines, approves and oversees the ICT risk framework, bears ultimate responsibility and allocates the budget. |
| GDPR Art. 24(1) | The controller implements measures and must be able to demonstrate compliance. |
| KSC Art. 8c(2), 8c(3) | Poland: the head stays responsible after delegating. If the head is a board with nobody named, all members are. |
| KSC Art. 73a(4) | Poland: a personal fine of up to 300% of pay. |
| KSC Art. 35 | Poland: that fine is available only after two years from entry into force, so after 3 April 2028. |
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Poland: Act of 23 January 2026 amending the national cybersecurity system act, Dz.U. 2026 poz. 252 (Dziennik Ustaw)
fyi Last checked 2 November 2026. This is not legal advice. It is a plain reading of the texts listed on this page, and national law can add to them. Before you rely on it in front of a regulator, an auditor or your board, have a lawyer confirm it for your company. What this means.
your next step
Ask for 20 minutes on the next board agenda and bring the three pages.