Cybersecurity Oversight Belongs to the Board
On July 7, Ireland's National Cyber Security Centre (NCSC) published guidance telling boards and senior executives what cybersecurity accountability looks like in practice.
It did so before Ireland's own NIS2 legislation had cleared parliament. The timing was deliberate. Supervisory expectations for boards are being set now, and they point to a shift that reaches well beyond Ireland.
Receiving an occasional security briefing will not cut it. Boards need defined accountability structures, regular reporting lines, and documented decisions showing they approved the organization's risk measures and are actively supervising how those measures work. That standard should apply whether or not your organization falls under NIS2.
What NIS2 Gets Right About Board Accountability
For most of its history, EU cybersecurity legislation told technical teams what to do. NIS2 moved the responsibility upward.
The directive requires management bodies to personally approve their organization's cybersecurity risk management measures and to oversee implementation. Boards can be held liable for infringements. For the most critical organizations, penalties can include temporary bans on executives holding management roles. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.
The NCSC guidance is useful here because it translates the obligation into questions any director can engage with, regardless of technical background:
- What are our assets, vulnerabilities, and risks (exposure)?
- Are our controls working, including across the supply chain (defense)?
- If something goes wrong, can we respond, recover, and keep operating (consequence)?
The guidance grounds these in a real example: the 2021 Conti ransomware attack on Ireland's Health Service Executive, which disrupted national health services and cost tens of millions of euros to remediate.
Boards outside Ireland should not dismiss this as a local development. NIS2 applies across all EU member states, and the accountability structures the NCSC describes reflect how supervisory authorities elsewhere are likely to assess compliance.
As Ireland's Minister for Justice Jim O'Callaghan said at the launch: "Cybersecurity has evolved far beyond a technical challenge handled in server rooms; it is now a fundamental boardroom priority."
The clock is running even before implementation in every member state. Ireland issued this guidance before its statute passed, and NIS2 places the risk of waiting on management bodies themselves. Boards that can demonstrate active, documented oversight will be in a far stronger position when supervision begins.
Vulnerability Disclosure Is a Governance Priority for Any Board
One area of the NIS2 framework deserves attention beyond the EU. The directive requires organizations to maintain formal processes for discovering, receiving, and responding to vulnerability reports, including a structured way to take in reports from external researchers and coordinate disclosure. Many organizations treat this as a purely technical function. Under NIS2, it is a board-level responsibility.
Organizations outside the EU can apply the same logic. Building a structured, board-visible process for receiving and acting on vulnerability reports is sound governance regardless of jurisdiction, and increasingly, it's what regulators, insurers, and enterprise customers expect to see.
Directors should confirm that vulnerability disclosure sits inside the overall compliance and governance program, not only with the security team. The NCSC's three questions around exposure, defense, and consequence give any board a starting point for that conversation.
Build the Process Boards Can Oversee
Putting that governance structure in place starts with having a formal process for receiving and acting on vulnerability reports. A vulnerability disclosure program (VDP) is designed to give organizations the coordinated disclosure infrastructure that satisfies regulatory requirements and gives boards the oversight visibility they need.
H1 Response helps organizations establish structured vulnerability disclosure programs that align with NIS2 requirements and generate continuous security signal.
This post does not constitute legal advice.
About the Author
