Approval of the measures taken under Article 21 sits with the management body itself and cannot be delegated away to the security function. The body has to take the decision, then keep oversight of how the measures are actually implemented, and its members can be held liable for the entity's infringements of Article 21. What this asks for in practice is a decision record: the body saw the risk-management measures, understood what they cover and what they leave uncovered, approved them, and receives reporting good enough to tell whether implementation is real. A standing agenda item with substantive papers behind it satisfies this; a single sign-off page at the end of a project does not, because oversight is a continuing duty. Public bodies keep this obligation but the liability rules that attach to their officials remain those of national law.
NIS2 Directive Art.20.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.