NIS2 puts boards on the hook for access control and asks for proof it works
POLICYEuropean Commissionredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
EU cyber rules now make company boards responsible for approving and overseeing security measures, including who can access important systems. Boards are increasingly asking for evidence that these controls work in practice, not just a copy of the policy.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Ask for evidence of how access controls work in practice, not only what the policy requires.
- Review exceptions such as old active accounts, excessive privileges, unreviewed MFA exemptions and supplier access beyond contract end dates.
- Confirm who owns access-control risk and whether that owner has the authority and budget to fix problems.
- Make sure board members receive cybersecurity training, as Article 20 requires.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Security Affairs
Who and what is in it
Government agencies