[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fX5tDkbI9SuHNsXMbQDKFPh-DFDMVMo0KamJP5r45ASY":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c0036abe-5492-4732-b612-c70a9e3e67bd","NIS2 Makes Board Members Personally Liable for Access Control Decisions","nis2-makes-board-members-personally-liable-for-access-control-decisions-5ead9d","NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work. NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by […]","Under NIS2 Article 20, management bodies of essential and important entities across the EU must approve, implement, and oversee cybersecurity risk-management measures—including access controls—and can face personal liability for infringements. Boards are now demanding evidence that approved controls actually work in practice, shifting from policy summaries to documented proof of implementation, with approximately 160,000 entities falling within NIS2 scope.","NIS2 Article 20 makes board members personally liable for cybersecurity controls they approve.","https:\u002F\u002Fsecurityaffairs.com\u002F202312\u002Flaws-and-regulations\u002Fnis2-makes-board-members-personally-liable-for-access-control-decisions.html","https:\u002F\u002Fsecurityaffairs.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fimage-4.png","2026-11-03T07:21:16+00:00","2026-11-03T08:00:33.933487+00:00",7,[17,20,22,24],{"name":18,"type":19},"Multi-Factor Authentication (MFA)","technology",{"name":21,"type":19},"Access Control Management",{"name":23,"type":19},"Identity and Access Management (IAM)",{"name":25,"type":26},"Passwork","vendor","4fd32ef4-29b8-4ee4-b88f-ecfb77fbf9c1",{"id":27,"icon":29,"name":30,"slug":31},null,"NIS2","nis2",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[25],{"controls":51,"vendors":126},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":53,"product_name":77,"url":78,"description":79},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":81,"name":82,"problem":83,"products":84},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":110,"name":111,"problem":112,"products":113},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[114,120],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":116,"url":118,"description":119},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":121,"product_name":122,"url":124,"description":125},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":139},"nis2-holds-boards-personally-liable-for-access-control-failures","NIS2 Holds Boards Personally Liable for Access Control Failures","NIS2 Article 20 marks a fundamental shift in European cybersecurity governance by making board members personally liable for failures in approving and overseeing cybersecurity risk-management measures, including access controls. This matters because for years, executives could treat cybersecurity as a delegated IT function with little personal accountability, leaving access control decisions under-resourced and under-scrutinised. Now, with approximately 160,000 entities in scope, boards can no longer rely on policy summaries—they must produce documented, verifiable evidence that approved controls are actually implemented and effective. The personal liability dimension transforms access control from a technical checkbox into a boardroom-level governance imperative, incentivising genuine oversight rather than paper compliance.",[132,133,134,135,136,137,138],"NIS2 Article 21(2)(b)","CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 AC-1: Policy and Procedures","GDPR Article 32","CIS Control 6: Access Control Management",{"GDPR Article 32":140,"NIS2 Article 21(2)(b)":141,"CIS Control 5: Account Management":142,"CIS Control 6: Access Control Management":143,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":144,"NIST SP 800-53 AC-1: Policy and Procedures":145,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":146},"GDPR Article 32 already established a precedent for documented, risk-appropriate technical and organisational security measures including access controls, and organisations familiar with GDPR accountability obligations will recognise the parallel governance model NIS2 now extends to boardroom liability.","Article 21(2)(b) explicitly requires essential and important entities to implement access control policies as part of their cybersecurity risk-management measures, making it the direct regulatory obligation at the heart of this incident.","CIS Control 5 requires organisations to use robust processes for managing user accounts and access rights, providing the operational framework boards need to implement and demonstrate the access controls NIS2 demands.","CIS Control 6 provides prescriptive guidance on creating, assigning, managing, and revoking access credentials, giving boards a measurable control set they can mandate, monitor, and use as evidence of effective access control implementation under NIS2.","Clause 7.2 requires that persons performing security-relevant roles, including governance oversight, are competent to do so—directly relevant as NIS2 holds board members personally liable, necessitating genuine cybersecurity competence at the management level.","AC-1 requires documented access control policies and procedures with designated accountability, which maps precisely to NIS2's demand that boards both approve and produce verifiable evidence of implemented access controls.","This function directly addresses the need to manage identities and access permissions in alignment with organisational risk strategy, providing the structured approach boards must oversee to satisfy NIS2 personal liability requirements."]