The five things NIS2 asks of the board, not the IT department.

Most NIS2 work is technical, and an IT partner can carry it. Five points are not: the law puts them on the management body itself, with personal liability attached.

This memo sets out all five, approval with a minuted date, the board’s own training duty, personal liability, the temporary-ban sanction for essential entities, and who counts as the management body, plus where CyFun fits as the practical way to show appropriate measures.

Hand it to a client’s board before the meeting where NIS2 first appears on the agenda.