Security & Cyber Resilience
Cyber risk is now a leadership decision, not an IT report.
What security regulation requires of leadership, and how to evidence it.
Why it's on the leadership agenda
Security is no longer something regulators leave to the IT function. NIS2, DORA, GDPR, the Cyber Resilience Act and sector rules all place duties on the people who run the organisation: to approve how risk is managed, to oversee it, and to be able to show that they did.
NIS2 is a clear example. The management body (in practice, the board) must approve the organisation's cybersecurity risk-management measures and oversee how they are put in place. Its members can be held liable when those measures fall short, and they must complete cybersecurity training themselves. For the EU subsidiary of an international group, that means the directors of the local company. DORA sets similar duties for financial entities, and US-listed groups must also describe to the SEC how their board oversees cyber risk.
Regulators will not ask whether leadership was briefed. They will ask what was decided, by whom, when, and on what evidence.
What the module covers
What security regulation, from NIS2 and DORA to GDPR and sector rules, requires of the board, and when individual directors can be held liable
Approving risk-management measures: what "approval" must look like to withstand inspection
Incident reporting timelines and leadership's role in the first 24 and 72 hours
Supplier and ICT third-party risk, including reliance on a small number of critical providers
Reading cyber metrics: which indicators belong in the boardroom and which do not
A live incident scenario, run with your leadership team against your own structure
What your leadership team will be able to answer
Which security rules apply to us, and what do they require of our leadership?
Can we evidence that the board approved and oversees our cyber risk measures?
Who decides what, and in what order, if we suffer a significant incident tonight?
Which third parties could stop our critical services, and what have we done about it?
Does our training record for directors meet the standard the regulator will expect?
The regulatory frame
Management bodies approve and oversee cyber risk measures, can be held liable, and must follow training (Art. 20). Fines up to EUR 10m or 2% of worldwide turnover for essential entities (Art. 34).
Transposition deadline was 17 Oct 2024
Will transpose NIS2 in Ireland. The Commission referred Ireland to the Court of Justice over the delay, and the NCSC advises entities to prepare now.
Referral 9 Jul 2026; enactment expected end-2026
Management body holds ultimate responsibility for ICT risk in financial entities.
Applied from 17 Jan 2025
Security obligations for products with digital elements, relevant where you make or supply them.
Reporting from 11 Sep 2026; full application 11 Dec 2027
Dates reflect the position as of September 2026. Every engagement begins with a current regulatory review.
What you leave with
A board-approved statement of how cyber risk is governed, owned and reported
A gap assessment against the leadership duties that apply to you, such as NIS2 Article 20, DORA and GDPR
An incident decision map: who decides what, in the first 24 and 72 hours
A record of director training that you can evidence to the regulator
A prioritised action plan the board can track quarter by quarter