Personal accountability
Under NIS2 Art. 20, the management body approves the cybersecurity measures, oversees them and can be held liable. Under DORA Art. 5 it bears the ultimate responsibility for ICT risk.
Roles · Management & board
You are accountable. Now you can see it.
NIS2 and DORA make the management body responsible for approving and overseeing risk measures, and for being trained. Paragraf gives you one current picture of what has been approved, what is in place and what is missing, with evidence behind every line.
NIS2 Art. 20DORA Art. 5TrainingBoard reporting
Board pack · NIS2 status
- Measures approvedLogged 12 March
- Controls in place38 of 41
- Gaps3, all with owners
- Management training7 of 7 completed
The pressure
The law now names you.
Board packs built by hand
82% of directors rate the information linking AI outcomes, risks and performance as fair, poor or not provided (PwC Annual Corporate Directors Survey, 2026). Most reports rest on self-assessment.
Cyber is now a business risk
31% of CEOs see cyber risk as a major threat, up from 24% a year earlier (PwC Global CEO Survey, 2026).
How it works
Example: the quarterly board meeting.
Step 1 of 4
The status builds itself.
The board pack is drawn from the work: controls, evidence, incidents and training. Nobody compiles it by hand.
Board pack · Q3
- RegulationsNIS2, GDPR
- UpdatedLive
- Prepared byHead of Risk
Step 2 of 4
From summary to evidence in two clicks.
Every line in the summary opens the evidence behind it, so questions get answers in the meeting.
Gap · Supplier security
- StatusIn progress
- OwnerCISO
- Due30 November
Step 3 of 4
The approval is logged.
Management approves the measures in the system. Date, decision and who took part are recorded, as NIS2 Art. 20 requires.
Decision
- MeasuresApproved
- Date12 March
- LoggedYes
Step 4 of 4
Decisions become tasks.
Every action the board asks for gets an owner and a date, and shows up in the next board pack.
Follow-up
- Actions from meeting3
- With owners3 of 3
- Shown inNext board pack
Works with or without Luis. Everything works without Luis. With Luis, you can ask for the status in plain language and get an answer with its source.
Check yourself
Five questions. Two minutes.
Answer honestly. You get one recommended place to start. Nothing is saved or sent.
Where most teams like yours start
See where you stand
Most management teams start with one live view: what has been approved, what is in place and what is missing.
Before you decide
Make it a safe decision.
- A two-minute readThis page is written to be read before the meeting.
- Start with one regulationA limited first scope with acceptance criteria agreed up front.
- Hosted in the EUOr on your own servers, with local AI.
- No AI requiredEvery step works by hand. AI only makes it faster.
Isn't this the CISO's job?
The work is. The responsibility is not. NIS2 Art. 20 puts approval and oversight on the management body. Paragraf lets the CISO do the work and lets you see it.
We already get reports.
Most reports are written for the meeting. These are drawn from the work, so every line has evidence behind it and they are current between meetings too.
How much of our time does this take?
Very little. You read the status, approve measures and see the follow-up. The work stays with the people who own it.
What does it cost to wait?
Under NIS2, essential entities can face fines of up to €10 million or 2% of worldwide turnover, and management can be held responsible. The cost of a clear status is small in comparison.
For the buying group
What you can tell the others.
You rarely decide alone. One foundation means each colleague gets their own part, and everyone sees the same truth.
- To the CISOWe approve the measures. Give us the live status, not a slide deck.
- To ComplianceEvery requirement with an owner and evidence, ready for the board.
- To LegalContract risk and obligations visible without a separate report.
- To the CFOOne foundation instead of a new tool for every regulation.
- To the boardDecisions logged and followed up until they are done.
Send a short summary to a colleague.
Next step
Lead with evidence.
Book a walkthrough for your management team. We show you the status, the evidence and the follow-up, on your own requirements, in under an hour.