Does NIS2 Require a CISO? What Article 20 Actually Demands

The short answer is no. NIS2 does not require you to appoint a Chief Information Security Officer, and no amount of searching the directive will produce the job title. What it does instead is more demanding and less convenient: it makes the management body personally accountable for cybersecurity risk management, and it makes their training mandatory rather than optional.

That distinction matters for industrial operators because it moves the obligation somewhere a hire cannot satisfy. You can appoint a CISO and still be non-compliant with Article 20 if your board cannot demonstrate it approved the measures, oversaw implementation and was trained to understand what it was approving. Our NIS2 compliance playbook for OT and ICS covers the wider obligation set.

What Article 20 says

Two paragraphs do the work. Article 20(1) requires management bodies to approve the cybersecurity risk management measures taken by the entity and to oversee their implementation. It also makes them liable for the entity's infringement of Article 21. Article 20(2) requires members of management bodies to follow training, so they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk management practices.

Read 20(2) carefully, because the asymmetry is the point. Management body members are required to follow training. Entities are separately encouraged to offer similar training to employees on a regular basis. Board training is mandatory. Staff awareness training is not, under this article. Most organizations have it exactly backwards: an annual all-staff e-learning module and nothing for the directors.

The question an auditor will actually ask Not "do you have a CISO." They will ask to see the minutes where the management body approved the risk management measures, the records of what training the directors completed, and the evidence of ongoing oversight. If your security program is excellent but your board papers do not show approval and oversight, you have an Article 20 gap regardless of how good your controls are.

 

Who counts as the management body

The directive leaves this to national law, which is another place the transposition patchwork bites. In practice it means the board of directors or the equivalent governing body, and in some implementations senior executives with delegated authority. For a North American parent with a European subsidiary, the question of whether the obligation attaches to the local management or the group board is a national law question worth getting answered rather than assumed.

What the training has to cover

The directive sets a purpose rather than a curriculum: enough knowledge to identify risks and assess risk management practices. For an industrial operator, generic cyber awareness training fails that test, because a director who cannot distinguish an IT outage from a loss of view on a control system cannot assess your OT risk decisions. What works:

• How a cyber event becomes a safety or production event in your specific plants.
• What the Article 21 measures are, and which ones your organization has partially implemented.
• How to read the risk register and challenge a risk acceptance.
• What the reporting clock requires of the board during an incident.
• The real constraints: why you cannot patch a running turbine on Tuesday.

That last point is where most board training fails. Directors who do not understand OT patching constraints approve remediation timelines that are impossible, then treat the overrun as a management failure. Our guidance on OT patch management is useful preparation reading for a board session.

Fines, and why Article 20 raises the stakes

Entity category	Fine floor member states must enable
Essential entities	At least 10 million euro or 2 percent of total worldwide annual turnover, whichever is higher
Important entities	At least 7 million euro or 1.4 percent of total worldwide annual turnover, whichever is higher

 

Those are floors, not ceilings. National law may set them higher. And because Article 20(1) attaches liability to the management body for Article 21 infringements, several national implementations make personal sanctions on managers available, including temporary bans from management functions for essential entities. That is the provision that gets a board's attention when nothing else does.

Why Choose Arista Cyber

We brief industrial boards on OT risk using their own plants as the material rather than generic threat slides, which is what Article 20(2) actually requires. Our consultants work to IEC 62443 and hold functional safety credentials, so a board session with us covers how a security decision lands on a safety case. Our case studies show the engagements behind that.

Next Steps

Two things, in order. Check that your board minutes evidence approval of the risk management measures and ongoing oversight, because that is the cheapest gap to close. Then run a board session that is specific to your assets rather than a generic awareness module, and keep the attendance record.

Common Questions

Does NIS2 require us to appoint a CISO?

No. The directive does not name the role. It requires the management body to approve and oversee cybersecurity risk management measures and to be trained. A CISO can support that, but cannot discharge it.

Is board training actually mandatory, or just recommended?

Article 20(2) requires management body members to follow training. Extending similar training to employees is encouraged rather than required by that article, though staff training appears separately among the Article 21 measures as cyber hygiene.

Can directors be personally fined?

Article 20(1) establishes management body liability for Article 21 infringements. How that translates into personal sanctions depends on national law, and several implementations allow temporary bans from management functions for essential entities.

How often does the training need to happen?

The directive does not set a frequency for management bodies. Annual is the defensible norm, with an additional session whenever your risk profile or regulatory position changes materially.

Does an ISO 27001 certified program satisfy Article 20?

It helps on the Article 21 measures but does not by itself evidence management body approval, oversight and training. Those need their own records.

Can your board evidence approval, oversight and training? Arista Cyber runs NIS2 Article 20 readiness reviews and OT risk briefings for industrial boards, built on your own assets and your own risk register rather than generic threat material. Arrange a board briefing