Under NIS2, cybersecurity is no longer something a board can hand to IT and forget. The people who sign off the budget now have to approve the security measures, oversee them, and take training themselves, and they can be held liable if the measures fall short.
This article explains what Article 20 of the NIS2 Directive requires of management bodies, what good board training looks like in practice, how often to run it, and how to document it so it stands up to a supervisor’s review.
This is general guidance, not legal advice.
What Article 20 actually says
Article 20 of Directive (EU) 2022/2555 has two parts.
Article 20(1): approve, oversee, be accountable
Member states must ensure that the management bodies of essential and important entities:
- approve the cybersecurity risk-management measures the entity takes under Article 21;
- oversee their implementation; and
- can be held liable for infringements of Article 21 by the entity.
National rules on the liability of public institutions and public officials still apply alongside this.
Article 20(2): training
Members of management bodies are required to follow training. Member states must also encourage entities to offer similar training to their employees on a regular basis. The stated purpose is for people to gain enough knowledge and skills to identify risks and to assess cybersecurity risk-management practices and their impact on the services the entity provides.
Two points stand out. First, board training is mandatory, while staff training is encouraged under Article 20(2), though basic cyber hygiene and cybersecurity training for staff is separately one of the minimum measures in Article 21(2)(g). Second, the goal is judgement, not technical skill. Directors need to be able to challenge what they are told, not configure a firewall.
Who counts as the “management body”?
The directive does not define it in detail, so national law and company structure decide. In Italy, ACN’s FAQs say entities must list the members of their management bodies: all members of the board of directors where there is one, the sole director where there is not, and always the legal representative. Managers, the point of contact or the CISO are not listed unless they also sit on that body.
Liability: why boards should take this seriously
| Provision | What it means for management | Applies to |
|---|---|---|
| Art. 20(1) | Management bodies can be held liable for the entity’s infringements of Article 21 | Essential and important entities |
| Art. 32(6) | Natural persons responsible for, or legally representing, the entity must have the power to ensure compliance and can be held liable for breaching their duties | Essential entities |
| Art. 32(5)(b) | As a last resort, authorities can request a temporary ban on a person at chief executive or legal representative level from exercising managerial functions | Essential entities |
| Art. 34(4)–(5) | Entity fines of at least EUR 10m or 2% of worldwide turnover (essential) and at least EUR 7m or 1.4% (important), whichever is higher | The entity |
Training does not shield a director from liability. But a board that has been trained, has asked the right questions and has recorded its decisions is in a far better position than one that cannot show it engaged at all. Training is how directors make their oversight credible. For the wider legal picture, see NIS2 Directive explained.
Italy: duties that cannot be delegated
Italy transposed Article 20 in Article 23 of Legislative Decree 138/2024. ACN’s FAQs on management bodies (most recently updated in July 2026) make two practical points:
- The training and approval duties are strategic-direction obligations and cannot be delegated, either to individual members or to other bodies. Operational implementation can be delegated, but oversight and approval stay with the board.
- Management bodies must promote a periodic training offer for employees consistent with the training they follow themselves, and the training plan required under ACN’s basic measures must be approved by the management bodies.
What good board training covers
The directive does not prescribe a syllabus. A useful test is the purpose stated in Article 20(2): after the session, can each director identify the main cyber risks to the business and judge whether management’s response is adequate? Build the content around that.
| Module | Key content | What directors should be able to do afterwards |
|---|---|---|
| 1. The legal frame | NIS2 scope, essential vs important status, Articles 20, 21 and 23, national law, supervision and fines; overlaps with DORA and GDPR | Explain the entity’s obligations and their own personal accountability |
| 2. Threats to your business | The threats most relevant to your sector, such as ransomware, phishing and social engineering, supplier compromise and outages | Name the scenarios that would hurt the business most |
| 3. Risk and risk appetite | How the risk assessment is built, how to read the risk register, setting risk appetite, accepting residual risk | Approve or challenge risk treatment decisions |
| 4. The Article 21 measures | The ten minimum measures (a)–(j) at oversight level: what “good” looks like and how it is evidenced | Ask whether each measure is in place and how management knows |
| 5. Incidents and crisis | The 24-hour early warning, 72-hour notification and one-month final report; the board’s role in a crisis; communications | Make decisions quickly under pressure; know who notifies the authority |
| 6. Supply chain | Dependence on cloud providers, MSPs and software vendors; contract terms; concentration risk | Challenge supplier risk decisions |
| 7. Metrics and questions | A short set of board-level KPIs and the questions to ask at each meeting | Run effective oversight between incidents |
Make it practical
Directors learn most from scenarios. A two-hour tabletop where the board works through a ransomware attack, decides whether to notify the authority within 24 hours, and agrees what to tell customers will teach more than a slide deck. Our upcoming cyber tabletop exercise guide explains how to run one.
Keep the language plain and the material specific to your organisation. Generic awareness videos built for staff do not meet the purpose of Article 20(2) for directors, because they do not equip them to assess risk-management practices.
Questions every director should be able to ask
- What are our five biggest cyber risks, and who owns each one?
- When did we last test restoring our critical systems from backup, and did it work?
- If we were hit tonight, who decides whether to send the 24-hour early warning?
- Which suppliers could stop our service if they were compromised?
- Where do we not use multi-factor authentication, and why?
- What did the last audit or penetration test find, and what is still open?
How often should boards train?
Article 20(2) requires management bodies to follow training but does not set a frequency for them. For employees it refers to training “on a regular basis”. Italy’s ACN FAQs likewise do not fix a frequency. That means you set it, and you should be able to justify it.
A defensible pattern, which is our recommendation rather than a legal requirement, looks like this:
| Trigger | Format | Typical length |
|---|---|---|
| New director joins | Onboarding briefing covering all seven modules | 2–3 hours |
| Annually | Refresher with updated threats, regulatory changes and a scenario exercise | 2–3 hours |
| Each board meeting | Short security report with KPIs and decisions needed | 15–30 minutes |
| After a major incident, regulatory change or new business line | Targeted update | As needed |
How to document board training
If a supervisor asks how you comply with Article 20(2), you need a paper trail. Keep:
| Record | What it should show |
|---|---|
| Training plan | Who is trained, on what, how often, by whom; approved by the management body (in Italy, explicitly required) |
| Attendance records | Name, role, date, duration and format for each director; catch-up sessions for absences |
| Content and materials | Agenda, slides or handouts, scenario used; version-dated so you can show what was covered when |
| Learning check | A short quiz, discussion record or exercise output showing understanding |
| Trainer details | Internal or external provider and their qualifications |
| Board minutes | Approval of the Article 21 measures, security reports received, questions asked and decisions taken |
| Follow-up actions | Actions arising from training or exercises, with owners and closure dates |
Store these with your other NIS2 evidence. Our NIS2 compliance checklist covers the full evidence pack.
Extending training to staff
Article 20(2) encourages similar regular training for employees, and Article 21(2)(g) lists basic cyber hygiene and cybersecurity training among the minimum measures. Board training and staff training should be designed together, so the board understands the programme it approves. A good staff programme combines short, regular modules with realistic phishing simulations and role-based training for IT, finance and anyone with privileged access. See our security awareness program guide and our guide to protecting against social engineering.
If your board has not yet had NIS2 training, or last year’s session was a generic slide deck, AceFortis can help. We run practical sessions for boards and management teams built around your sector and your real risks, with a scenario exercise and documentation you can file as evidence. Get in touch to plan a session.
FAQ
Does every board member have to be trained, or just one?
Article 20(2) refers to the members of the management bodies, so plan to train all of them. In Italy, ACN’s FAQs state that the training duty cannot be transferred to specific members.
Can the CISO take the training on the board’s behalf?
No. The requirement is for members of the management body to follow training themselves. The CISO can help design or deliver it, but cannot replace it.
Does a certificate from an online course satisfy Article 20(2)?
The directive does not require a specific certificate. What matters is whether the training gives directors enough knowledge to identify risks and assess risk-management practices in your organisation. Generic courses can help, but tailored content and a scenario exercise make a much stronger case.
Does training protect directors from liability?
Not by itself. Liability attaches to infringements of Article 21. Training helps directors carry out effective oversight and shows they took their duties seriously, which is the best protection available.
