Management must approve the cybersecurity risk measures, oversee their implementation and take part in training. This is one of the biggest shifts in NIS2. Responsibility cannot be delegated away to an IT manager or an external provider, even if the work itself is.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Put cybersecurity on the board agenda at least quarterly
- Minute the approval of policies and the risk assessment
- Book management training and keep the attendance record
Making it stick
A short, regular report with risks, incidents and progress on measures is usually enough to show active oversight. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.