As reported by SecurityAffairs, NIS2 Article 20 is reshaping how EU boards engage with cybersecurity — and access control is emerging as the pressure point where governance meets personal liability.

Key Insight: As reported by SecurityAffairs, NIS2 Article 20 is reshaping how EU boards engage with cybersecurity — and access control is emerging as the pressure point where governance meets personal liability.

For years, boards have treated identity and access management as a technical operational matter, delegated downward and rarely revisited at the director level. NIS2 ends that comfortable separation. Under Article 20, management bodies of essential and important entities must not only approve cybersecurity risk-management measures but also oversee their implementation. Directors who sign off on measures that are never properly implemented — or never verified — face personal liability under national law.

Why Access Control Became the Flashpoint

Article 21 of NIS2 explicitly requires access control policies, asset management, and multi-factor authentication or continuous authentication solutions where appropriate. This is not a vague suggestion. It is a enumerated minimum. Yet across the approximately 160,000 entities in scope, IAM maturity is wildly inconsistent. Boards are now realizing that approving a policy document is not the same as approving a functioning control.

The core tension that SecurityAffairs identifies is one we see repeatedly in our advisory work: the CISO often owns the risk without owning the budget, headcount, or authority to remediate it. When an MFA rollout stalls or privileged access management remains unimplemented, the board approved the measure on paper but never ensured it was funded and executed. Under NIS2, that gap is now a personal liability exposure for directors.

The difficulty comes when the person responsible for a risk does not control the budget, systems, or people needed to address it. NIS2 forces boards to close that gap — not through best-practice encouragement, but through legal accountability.

Greece Sets a Precedent Others May Follow

Greece's transposition goes further than the baseline directive by mandating appointment of a dedicated Information and Communication Systems Security Officer with guaranteed resources and operational independence from the DPO function. This model — embedding a legally accountable security officer with budgetary protections — may become a template that other member states look to as enforcement intensifies. Organizations operating across multiple EU jurisdictions should track these national variations carefully.

The Evidence Problem

Boards are beginning to ask for proof that approved controls actually work. This is a fundamental shift from periodic compliance reporting to continuous assurance. Directors need evidence in terms they can act on: not a list of IAM tooling features, but a clear picture of whether MFA coverage is meeting targets, whether privileged accounts are being reviewed, and whether access-related incidents are being remediated within acceptable timelines.

This means CISOs must translate technical IAM metrics into board-level risk language. A report showing 73% MFA enrollment is not actionable for a director. A report showing that 27% of privileged accounts lack MFA, creating a specific liability exposure under Article 21, is.

Shield53 Recommendations

Shield53 Recommendations
Establish a board-level cybersecurity reporting cadence that includes IAM-specific KPIs: MFA coverage rates, privileged account review status, access certification completion, and time-to-remediate for access-related findings. Quarterly minimum.
Map Article 21 requirements to current controls and identify gaps with assigned owners, budget requirements, and remediation timelines. Present this gap analysis to the board for formal approval.
Ensure CISO budget authority matches risk ownership. If the CISO is accountable for access control risk under the board's approved measures, they need the resources to execute. Document this alignment explicitly.
Implement continuous access certification rather than annual access reviews. Stale access is the most common audit finding and the easiest access control failure for regulators to demonstrate.
Document board cybersecurity training as required by Article 20. This is not optional and failure to maintain training records is a straightforward compliance gap that regulators will check first.
Track national transposition variations across all EU jurisdictions where your organization operates. Greece's ICSSO requirement may appear in other national implementations.

NIS2 is not a reporting exercise — it is a governance accountability framework. Boards that treat it as the latter will find themselves on the right side of enforcement. Those that treat it as the former will find that personal liability is not theoretical.