NIS2 Article 20 makes board members liable for access control oversight as the Commission refers four states to the CJEU
NIS2 Article 20 requires the management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee their implementation, and complete cybersecurity training. Members can be held liable for infringements, subject to national law. Access control is one of the required measures, and boards are increasingly asking for evidence that controls work rather than a summary of the policy. In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition of the directive. Roughly 160,000 entities fall within NIS2 scope.
Detalhes técnicos
- Article 21 measures include access control policies, asset management, and MFA or continuous authentication where appropriate.
- Boards need visibility into exceptions: stale accounts, excessive privileges, unreviewed MFA exemptions, and supplier access that outlives contracts.
- Organizations should be able to show who can access critical systems, why, who approved it, how long it is valid, and when it was changed or revoked.
- Maximum fines are at least €10M or 2% of global turnover for essential entities, and at least €7M or 1.4% for important entities.
- Article 32 allows a temporary ban on a CEO or legal representative from exercising managerial functions in an essential entity in specific cases. It is not automatic after an incident.
- Greece's NIS2 law requires an Information and Communication Systems Security Officer, independent of the DPO.
- The article cites Verizon's 2026 DBIR, which found credential abuse in 39% of breaches, and a reported exposure of 24 billion credential records in June.
Remediação
- Assign an owner for access-control risk who has the authority and budget to fix problems.
- Report to the board on actual control performance and unresolved exceptions, not just on what the policy requires.
- Keep evidence of access grants, approvals, validity and revocation.
Linha do tempo
-
NIS2 Article 20 makes board members liable for access control oversight as the Commission refers four states to the CJEU
ler a análise desta fonte ocultar
NIS2 Article 20 requires the management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee their implementation, and complete cybersecurity training. Members can be held liable for infringements, subject to national law. Access control is one of the required measures, and boards are increasingly asking for evidence that controls work rather than a summary of the policy. In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify full transposition of the directive. Roughly 160,000 entities fall within NIS2 scope.
Technical Details
- Article 21 measures include access control policies, asset management, and MFA or continuous authentication where appropriate.
- Boards need visibility into exceptions: stale accounts, excessive privileges, unreviewed MFA exemptions, and supplier access that outlives contracts.
- Organizations should be able to show who can access critical systems, why, who approved it, how long it is valid, and when it was changed or revoked.
- Maximum fines are at least €10M or 2% of global turnover for essential entities, and at least €7M or 1.4% for important entities.
- Article 32 allows a temporary ban on a CEO or legal representative from exercising managerial functions in an essential entity in specific cases. It is not automatic after an incident.
- Greece's NIS2 law requires an Information and Communication Systems Security Officer, independent of the DPO.
- The article cites Verizon's 2026 DBIR, which found credential abuse in 39% of breaches, and a reported exposure of 24 billion credential records in June.
Remediation
- Assign an owner for access-control risk who has the authority and budget to fix problems.
- Report to the board on actual control performance and unresolved exceptions, not just on what the policy requires.
- Keep evidence of access grants, approvals, validity and revocation.