Yes, individuals in management positions can be held liable for cybersecurity breaches under the NIS2 Directive.

• Sources indicate that Member States must ensure that the management bodies of essential and important entities approve cybersecurity measures and oversee their implementation.
• Management bodies can be held liable if the entity they manage violates Article 21 of the Directive, which establishes the cybersecurity risk management measures that entities must adopt.
• Member States must also ensure that persons responsible for an essential or important entity, including legal representatives and those with decision-making or control powers, have the authority to ensure compliance with NIS2.
• These individuals may be held liable if they fail to fulfill their duty to ensure compliance with the Directive.
• However, sources also emphasize that for public administration entities, national laws regarding the liability of public officials and elected or appointed officers will continue to apply.

NIS2: Considerations

The Directive introduces provisions to hold individuals in management positions accountable for cybersecurity breaches, with the aim of encouraging a stronger focus on cybersecurity at the highest levels of corporate governance.

Furthermore, the Directive requires that management bodies receive adequate training on cybersecurity risk management. This requirement aims to ensure that executives have the necessary skills to understand and address cyber threats.

Sanctions for non-compliance with NIS2 can include significant fines, operational limitations, and personal liability. For organizations looking to structure a compliance path for the NIS2 Directive, it is useful to start with an assessment of the measures already implemented and the gaps to be filled. Member States must establish effective enforcement measures to ensure that entities comply with cybersecurity requirements.

Another relevant aspect concerns the need for continuous monitoring by management bodies. The Directive provides that the measures adopted must be periodically reviewed and updated to respond to the evolution of cyber threats. This dynamic approach helps maintain high security standards over time.

Finally, NIS2 encourages collaboration between regulated entities and competent authorities in order to improve overall cyber resilience at the European level. This cooperation includes sharing information on threats and best practices for cybersecurity management. To delve deeper into the regulatory framework, it is also useful to consult what the main objective of the NIS2 Directive is.