Governance with consequences
Management bodies must approve cybersecurity risk-management measures, oversee their implementation, and undertake relevant training. Failure can result in corporate fines and temporary restrictions under national law.
€10m or 2% of worldwide annual turnover for essential entities
€7m or 1.4% of worldwide annual turnover for important entities
Leadership cannot delegate accountability away
Technology teams implement many controls, but management remains responsible for approval, resources, supervision, and demonstrable governance.
A defensible management cadence
- 01 Approve the risk framework Record decisions, risk appetite, and security objectives.
- 02 Review meaningful measures Track critical risks, incidents, remediation, suppliers, and resilience tests.
- 03 Fund proportionate controls Align investment and ownership with material risk.
- 04 Complete management training Build the competence needed to challenge and govern effectively.