NIS2 Directive
NIS2 Chapter IV: Governance (Article 20)

NIS2 Directive Art.20.1: Management body approves the cybersecurity risk-management measures and oversees their implementation

Approval of the measures taken under Article 21 sits with the management body itself and cannot be delegated away to the security function. The body has to take the decision, then keep oversight of how the measures are actually implemented, and its members can be held liable for the entity's infringements of Article 21. What this asks for in practice is a decision record: the body saw the risk-management measures, understood what they cover and what they leave uncovered, approved them, and receives reporting good enough to tell whether implementation is real. A standing agenda item with substantive papers behind it satisfies this; a single sign-off page at the end of a project does not, because oversight is a continuing duty. Public bodies keep this obligation but the liability rules that attach to their officials remain those of national law.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 38 controls across 15 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
  • NIST-CSF-GV.RR-03 Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies

SOC 2 · 4 controls

  • SOC2-CC1.2 CC1.2 Board independence and oversight of internal control (COSO principle 2)
  • SOC2-CC1.3 CC1.3 Structures, reporting lines, authorities and responsibilities (COSO principle 3)
  • SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

APRA CPS 234 · 3 controls

  • CPS234-13 Board Responsibility for Information Security
  • CPS234-14 Definition of Information Security Roles and Responsibilities
  • CPS234-28 Escalation of Unremediated Testing Deficiencies

C5 (Germany) · 3 controls

  • C5-BCM-01 Top management responsibility
  • C5-COM-04 Information on information security performance and management assessment of the ISMS
  • C5-OIS-02 Information Security Policy

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

FedRAMP High · 3 controls

  • CA-6 Authorization
  • PL-2 System Security and Privacy Plans
  • SA-2 Allocation of Resources

FedRAMP Moderate · 3 controls

  • CA-6 Authorization
  • PL-2 System Security and Privacy Plans
  • SA-2 Allocation of Resources

NIST SP 800-53 Rev 5 · 3 controls

PCI DSS 4.0 · 3 controls

  • 12.1.4 12.1.4 Executive ownership of information security formally assigned
  • 12.4.1 12.4.1 Executive responsibility for a PCI DSS compliance program
  • 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures

ISO 27001:2022 · 2 controls

  • 5.1 Policies for information security
  • 5.4 Management responsibilities

ISO 27002:2022 · 2 controls

  • 5.1 Policies for information security
  • 5.4 Management responsibilities

DORA · 1 control

EU AI Act · 1 control

GDPR · 1 control

NIST SP 800-171 Rev 3 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in NIS2 Chapter IV: Governance (Article 20)

You are reading one control. How much of NIS2 Directive have you already done?

NIS2 Directive Art.20.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.

If you hold DORA60.7% covered · 11 gapsIf you hold C5 (Germany)53.6% covered · 13 gapsIf you hold NIST Cybersecurity Framework 2.050% covered · 14 gapsIf you hold ISO 27001:202242.9% covered · 16 gapsIf you hold ISO 27002:202242.9% covered · 16 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.139.3% covered · 17 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 38 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIS2 Directive controls