NIS2 for leadership teams: five questions your board should be able to answer
NIS2 puts cybersecurity on the board's agenda by law. Here are the five questions I would expect any leadership team to answer, with Greek law 5160/2024 as the worked example.
Most NIS2 conversations I have start in the wrong place. Someone asks which tool they need to buy. The better question is who in the company signs off on the risk, because that is where the directive puts the obligation.
Article 20 of NIS2 says the management bodies of covered companies must approve the cybersecurity risk-management measures, oversee how they are implemented, and can be held liable when the company falls short. Board members also have to follow training. In Greece, law 5160/2024 copies this almost word for word in its article 14 and adds annual training for staff. It also sets a separate fine of up to €200,000 for a management body that has not approved the measures at all.
So NIS2 is not an IT project with a legal annex. It is a governance duty with a technical side. Here are the five questions I would expect any leadership team to be able to answer, whether the company sits in Athens, Frankfurt or Lisbon.
Where NIS2 stands at the end of 2026
Member states had to turn the directive into national law by 17 October 2024. Most did. In July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for not completing transposition. In January 2026 the Commission also proposed targeted amendments to make compliance clearer and simpler, especially for smaller companies. That proposal is a reason to watch the details. It is not a reason to wait. In most of the EU, including Greece, the national law already applies.
1. Are we in scope, and are we registered?
NIS2 covers, as a rule, medium and large companies in 18 critical sectors, from energy, health and transport to digital infrastructure, manufacturing and managed IT services. Covered companies are either essential or important entities, and the label changes the supervision and the size of the fines.
In Greece, covered entities had to register with the National Cybersecurity Authority. The extended deadline closed on 30 September 2025, and the registration has to name the company's information and communication systems security officer, the ΥΑΣΠΕ. Any change in the registered details must be reported within two weeks. If your company belongs on that register and is not on it, that is the first thing to fix.
If you are not in scope, do not stop reading. Your clients may be. Supply-chain security is one of the measures the directive requires, so covered companies are now asking their suppliers for the same discipline. NIS2 reaches many smaller firms through a contract, not a regulator.
2. Who owns cybersecurity at board level, and what exactly have we approved?
"IT handles it" is no longer an answer. Someone on the leadership team should own the topic, and the board should be able to point to what it approved and when.
Greece makes this concrete. Ministerial decision 1689/2025 requires a written information security policy approved by top management, plus specific policies on access control, incident management, supply-chain security, backups, encryption and more. The ΥΑΣΠΕ coordinates the work, but the decision is clear that the top management body approves the programme, provides the resources and oversees it. The officer supports the board. The officer does not replace it.
3. If we were hit tonight, what happens in the first 24 hours?
The reporting clock is tight. For a significant incident, the directive and the Greek law ask for an early warning within 24 hours of becoming aware of it, a fuller notification within 72 hours, and a final report within one month.
Those deadlines only work if a few decisions are made in advance. Who decides that an incident is significant? Who contacts the national CSIRT? Who speaks to clients, and who speaks to the press? Who can approve shutting down a system that makes money? I would want these names written down and tested once a year in a short exercise with the leadership team in the room. An exercise that takes an afternoon is cheap. Improvising on the night is not.
4. Which suppliers could stop us, and what do we know about them?
Every company depends on a handful of providers it cannot run without: cloud, email, ERP, payroll, connectivity, and often an IT partner with privileged access to everything. NIS2 expects you to know who they are, what access they hold, and what they owe you if something goes wrong.
I say this as someone who runs a managed IT provider. Companies like ours are in scope ourselves, and we should be the first to answer these questions for our clients. Ask your providers how they protect their own access to your systems, how fast they will tell you about an incident, and what you can audit.
5. Can we prove any of this?
A policy no one can find does not exist. When the authority checks, it looks at evidence: approved policies, board minutes, training records, risk assessments, test results and contracts. The Greek decision lists these documents explicitly.
Backups are a good test, because everyone says they have them. I use the 3-2-1-1-0 rule: three copies of the data, on two different types of media, one copy off-site, one copy offline or immutable, and zero errors when you test the restore. The last part is the one most companies skip. A backup you have never restored is a hope, not a control.
The fines are real. They go up to €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important ones, whichever is higher. In my experience, though, the bigger cost is a week of downtime and the clients who leave after it.
What I would do this quarter
Put the five questions on the agenda of one leadership meeting. Give each one an owner and a one-page answer. Book a two-hour incident exercise before the end of the year. That is not full compliance, but it turns NIS2 from a vague worry into a short list of decisions, which is what a board is there to make.
Frequently asked questions
Does NIS2 apply to small businesses?
Mostly not directly. As a rule it covers medium and large companies in the listed sectors, with some exceptions regardless of size, such as certain digital infrastructure providers. Small companies usually feel it through their clients, who now include security requirements in supplier contracts.
Can directors be held personally responsible under NIS2?
The directive makes management bodies accountable for approving and overseeing cybersecurity measures, and leaves the details of liability to national law. In Greece, article 14 of law 5160/2024 makes the management bodies responsible for breaches of these duties, with specific fines for not approving the measures and for not ensuring training.
What are the NIS2 incident reporting deadlines?
For a significant incident: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours, and a final report within one month of that notification. In Greece, reports go to the CSIRT of the National Cybersecurity Authority.
The Greek registration deadline has passed. What now?
The extended deadline was 30 September 2025, but the obligation to register remains. If your company is in scope and not registered, register now through the authority's platform, name your ΥΑΣΠΕ, and keep the details up to date within two weeks of any change.
If you want a second opinion on where your company stands, or a sparring partner before your next board meeting, write to me at info@kppx.gr.
Sources
Directive (EU) 2022/2555 (NIS2), EUR-Lex
European Commission: NIS2 Directive overview and the January 2026 amendment proposal
Law 5160/2024, article 14 (governance)
Law 5160/2024, article 16 (incident reporting)
Law 5160/2024, article 26 (fines)
National Cybersecurity Authority: registration deadline extended to 30 September 2025
Ministerial decision 1689/2025, Government Gazette B' 2186/06.05.2025