# NIS2 for the leadership: what the new directive means for administrators and directors

> NIS2 brings security into management. The management approves, oversees and is accountable.

Perhaps the biggest change in mindset brought by NIS2 is that cybersecurity is no longer a matter only for the IT department. It is a governance topic, one that ends up being dealt with in management. The law speaks explicitly about the role and the accountability of the management body.

  
### What the management must actually do

  Three concrete obligations fall on the management. First, to approve the cybersecurity risk management measures. Then, to oversee their implementation, that is to periodically ask for a clear picture of the status, rather than assume it is being handled somewhere further down. And, not least, the members of the management must themselves follow training programs, so that they can understand and assess the risks.

  
### Accountability and consequences

  NIS2 provides for the accountability of the management for failing to meet the obligations. In addition to substantial administrative fines applied to the entity, in serious and unresolved cases, for essential entities, the authority may impose measures that include the temporary suspension of the exercise of certain management functions. It is not an everyday scenario, but the message of the regulatory authority is clear: the responsibility is real and personal.

  
### What healthy involvement of the management looks like

  In practice, directors are not required to become technical experts. They are required to ask the right questions and to request evidence: which NIS2 category are we in, at what level are we classified, where do we stand against it, what are the biggest risks, what plan do we have and with what deadlines. A clear dashboard, reviewed periodically, turns the subject into a business decision.

  
### From obligation to advantage

  Viewed correctly, compliance is not just an extra item or bureaucracy. An organization that knows its risks and manages them transparently inspires trust in clients, partners and investors, and increasingly it is a condition in tenders and in relationships with large organizations, while at the same time ensuring compliance with the applicable legislation in the field of information security. When the management is aware of the organization's current status, NIS2 becomes manageable, sometimes even a commercial argument that brings value in business relationships and that makes the difference.