Knowledge · NIS2 · Article 20
Management must approve, oversee – and be trained.
The management body approves the cybersecurity risk-management measures, oversees how they are implemented and can be held liable if they are not. Its members must take part in training, and employees should be offered it regularly.
What it requires
In plain words.
- Management approves the risk-management measures under Article 21
- Management oversees their implementation
- Management can be held liable for failures
- Members of the management body follow cybersecurity training
- The organisation offers similar training to employees regularly
Plain-language summary of NIS2 Article 20 (Directive (EU) 2022/2555). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
Approval has to be visible as a decision with a date – not as a slide deck. Training has to be recorded per person, and oversight has to happen more than once.
- ControlsOne Control per duty, with management as owner
- ProcessA yearly approval and oversight cycle with decisions logged
- TrainingManagement training with a knowledge test and certificate
- EvidenceSigned approvals and completed training, kept with the Control
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See NIS2 article 20
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.