What it asks for. Article 20 makes the management bodies of essential and important entities responsible for approving the cybersecurity risk management measures and overseeing their implementation, and allows them to be held liable for infringements. Article 20(2) requires members of management bodies to follow training, and encourages entities to offer similar training to employees regularly.
In practice. The board or executive committee formally approves the security risk management approach, receives regular reporting and records its oversight decisions. Board members complete training that lets them identify risks and assess management practices, and staff receive regular training too. Evidence includes approval minutes, training records for management and periodic reports to the board.
Common gaps. Training for management is often a single generic briefing that does not build the ability to challenge security decisions. Approvals happen once without ongoing oversight.