Build a board-ready NIS2 evidence record for approval, oversight, training, and accountability.
This guide helps connect Article 20 duties to Article 21 cybersecurity risk-management measures, ENISA evidence examples, and practical reporting lines for essential and important entities.
Structured answer sets in this page tree.
Cited legal and guidance references.
NIS2 Article 20 makes cybersecurity governance a management-body duty, not only a security-team task. Essential and important entities need a record showing that the approved the Article 21 cybersecurity risk-management measures, oversaw implementation, followed required training, and received enough information to understand risk and service impact.
Article 20 requires Member States to ensure that management bodies of essential and important entities approve the cybersecurity risk-management measures used to comply with Article 21 and oversee their implementation. It also says management bodies can be held liable for infringements by the entities of Article 21, subject to the national liability rules that apply to public institutions, public servants, and elected or appointed officials.
Identify the under the applicable national company, public-sector, or organisational law. It may be a board, executive committee, public-sector body, or another governing body, but the directive does not assign one universal corporate title.
Start with entity classification. Article 20 applies to management bodies of essential and important entities, so the accountability record should point to the entity's NIS2 scope analysis, sector mapping, and Member State implementation position.
The approval record should identify the policy or measure set used to comply with all ten Article 21(2) areas, the covered services and systems, material residual risks, accountable owners, and the oversight information the will receive. Article 20 does not prescribe a particular minute, resolution, or pack format.
The evidence should show that the understood what it approved and had a route to monitor implementation. ENISA's technical guidance treats the policy on the security of network and information systems as the highest-level security policy and says it should include the date of formal approval by the management bodies.
Article 20 requires management-body members to follow training so they can identify risks and assess cybersecurity risk-management practices and service impact, but the Directive does not set one EU-wide curriculum, duration, or recurrence interval. National law or authority guidance may add detail. For provider types covered by Regulation 2024/2690, the separate awareness and training requirements call for repeated awareness activities and role-based security training, including for management-body members where applicable.
For covered entities using the implementing regulation and ENISA guidance, useful evidence includes the approved security policy, topic-specific policies, management review records, training records, briefings to management bodies, direct reporting lines, residual-risk approvals, and documented policy updates after significant incidents or major changes.
The most common mistake is treating Article 20 as a one-time board approval. NIS2 links approval to ongoing oversight, training, and the Article 21 risk-management system. A stale approval record will not explain how management was informed when risks, services, suppliers, or incidents changed.
Another risk is assuming the same evidence works in every Member State. NIS2 is an EU directive implemented through national law, and Article 20 expressly leaves certain public-sector and individual-liability questions to national rules.
Review this checklist before treating Article 20 as implemented. The goal is to make the governance record clear enough for legal review, audit review, security leadership, and a future regulator question.
Keep the checklist near the underlying evidence so the next review can reuse the same record instead of rebuilding the management-body narrative from memory.
Yes. Article 20 requires Member States to ensure that management bodies of essential and important entities approve the cybersecurity risk-management measures used to comply with Article 21 and oversee implementation.
Save management-body training records, workshop or seminar attendance, training materials, dates, and evidence that the training helped members identify risks and assess cybersecurity risk-management practices and their service impact.
No. Security can prepare evidence and run controls, but Article 20 places approval, oversight, and training duties on the . For providers covered by Regulation 2024/2690, the governance record should also show that at least one person reports directly to the management body on network and information system security.
No. Article 20 requires Member States to ensure that management bodies can be held liable for an entity's Article 21 infringements, but the applicable liability rules come through national law. The directive also preserves national liability rules for public institutions, public servants, and elected or appointed officials. Determine the responsible body and any individual consequences under the relevant Member State law.
Sorena can help convert this guidance into approval packs, training records, oversight calendars, risk signoff evidence, and cited-source review notes for NIS2 implementation.
Ask questions tied to cited sources about Article 20, Article 21, management-body evidence, and national implementation dependencies.
Review your approval workflow, training evidence, oversight cadence, and management-body reporting gaps with Sorena.
"oversee its implementation"
"Records of the management review"
"wider scope, clearer rules"
"policy on the security"