Board cyber oversight programme: a step-by-step guide

Turn the management body duties in NIS2 Article 20, the Dutch Cbw and DORA Article 5 into a routine: an annual calendar, indicators, a reporting pack, board training and minutes that serve as evidence.

This guide is for company secretaries, CISOs, risk officers and directors who need to turn the management body duties in NIS2 and DORA into a routine the board can sustain. At the end you will have an oversight structure, a yearly calendar of decisions, a set of indicators, a reporting template, a training plan and an evidence trail that shows a supervisor how the board exercised its role.

Before you start

You need a sponsor on the board (often the chair of the audit or risk committee), a CISO or security lead who will prepare the material, and the company secretary to own the calendar and minutes. Have the current risk register, the latest gap analysis against NIS2 Article 21 or your national measures, and any open audit findings to hand. If you are not yet sure whether you are in scope, settle that first.

Step 1: Pin down the legal duties and who carries them

NIS2 Article 20(1) requires management bodies of essential and important entities to approve the Article 21 measures and oversee their implementation, and makes them liable for infringements, without prejudice to national liability rules for public bodies and officials. Article 20(2) requires members of management bodies to follow training, and encourages entities to offer similar training to employees regularly^[1]. For essential entities, supervisors can, as a last resort, seek a temporary prohibition on a person exercising managerial functions.

National law shapes the detail. The CCB explains that in Belgium the management body is liable if the entity breaches its risk management obligations, and that responsible persons must have the power to ensure compliance^[3]. In the Netherlands, Cbw article 24 adds a demonstrable knowledge requirement with a certificate (see Step 7). For financial entities, DORA Article 5(2) makes the management body define, approve, oversee and be responsible for the whole ICT risk management framework and bear final responsibility for ICT risk^[2].

• Identify which body is the “management body” in your governance model: the executive board, the board of directors, or both in a one-tier structure.
• List the duties per law that applies to you, and note where they differ.
• Brief the board on personal exposure in plain terms, with counsel present.

Step 2: Set the oversight structure

Decide where cyber is discussed and decided. Most organisations keep formal approval with the full board and delegate detailed review to a committee (audit, risk, or a dedicated technology committee). Whatever you choose, write it down.

• Update the committee terms of reference to include cybersecurity and, where relevant, ICT third-party risk.
• Give the CISO a direct line to the board or committee, at least for the quarterly report and for escalations.
• Define escalation triggers between meetings: a significant incident, a breached risk tolerance, a supervisor request.
• DORA entities: assign the role that monitors ICT third-party arrangements, or a senior manager responsible for that risk, as Article 5(3) requires for non-microenterprises.

Step 3: Approve the measures and the risk appetite

Approval is the first visible act of oversight. Present the board with the risk-management measures (or the gap analysis and remediation plan), the risk methodology, the acceptance criteria and the residual risks that need acceptance. Under DORA, the board also sets the digital operational resilience strategy with the ICT risk tolerance, and approves the ICT business continuity policy, the response and recovery plans, the ICT internal audit plans and the policy on ICT third-party services^[2].

• Ask for a decision, not a noting: “approve the measures and remediation plan”, “accept these residual risks”.
• Express appetite in measurable terms (for example, maximum tolerable downtime for critical services).
• Approve the budget for the plan, since DORA Article 5(2)(g) expressly expects an allocated and reviewed budget.

Step 4: Build the annual board cyber calendar

A calendar turns obligations into a routine. A typical cycle looks like this:

Quarter	Board or committee item	Decision or output
Q1	Annual risk assessment and risk appetite; training plan for the year	Approve appetite and residual risks; approve training plan
Q2	Incident response and continuity: exercise results; supplier risk review	Note lessons learned; approve plan changes
Q3	Internal audit and supervisory findings; policy reviews	Approve remediation and policy updates
Q4	Programme effectiveness review; budget and plan for next year	Approve budget and annual plan
Every quarter	Standard KPI/KRI dashboard, significant incidents, regulatory changes	Note, challenge, escalate

Step 5: Choose a short set of KPIs and KRIs

Boards need a few indicators that show direction, not a wall of technical metrics. Use key performance indicators (KPIs) for whether the programme delivers, and key risk indicators (KRIs) for whether exposure is moving outside appetite. Set a target and a tolerance for each, and keep definitions stable so trends mean something.

• KPIs: remediation plan items closed on time; share of staff who completed required training; share of critical suppliers assessed in the last 12 months; backup restore tests passed.
• KRIs: critical vulnerabilities on internet-facing systems older than the patch target; privileged accounts without MFA; significant incidents in the period; critical services above tolerable downtime in tests; overdue high-risk audit findings.
• Limit the board view to 8 to 12 indicators, with red, amber and green against the tolerances the board set.

Step 6: Design the reporting pack

A consistent pack makes oversight comparable across quarters. Keep it to a few pages and put decisions first.

• Page 1: decisions requested and the CISO’s overall assessment in three sentences.
• Page 2: KPI/KRI dashboard with trend and commentary on red items.
• Page 3: top risks, changes since last quarter and risks awaiting acceptance.
• Page 4: significant incidents and near misses, reporting status to the CSIRT or supervisor, and lessons learned.
• Annex: remediation plan status, supplier issues, regulatory and audit updates.

The companion template includes a reporting pack outline, the annual calendar and a training log ready to adapt.

Step 7: Train the board, and keep the training log

Training is a personal duty of each member. The NIS2 aim is that members can identify risks and assess risk-management practices and their effect on the entity’s services. In the Netherlands, Cbb articles 20 and 21 set the content (risk identification and the risk management measures of the law), and article 22 requires a certificate naming the board member, date or dates, topics and provider, in Dutch or English^[4]. Serving board members must meet the requirement by 15 August 2028, and new members within two years of appointment^[5]. DORA Article 5(4) expects members to keep their knowledge up to date, including through regular, specific training proportionate to the ICT risk.

• Plan an induction for new members and a yearly refresher for all, tailored to your sector and recent incidents.
• Add a tabletop exercise in which board members play their crisis roles.
• Keep a training log per member with dates, topics, provider and certificate.

Step 8: Minute decisions as evidence

Minutes are the main record a supervisor will see of how the board exercised its role. They do not need to be long, but they should show what was presented, what was asked, what was decided and what follow-up was agreed.

• Record the decision wording exactly, including any conditions.
• Record substantive questions and challenge, briefly.
• Keep an action log with owners and dates, and review it at the next meeting.

Step 9: Review the programme every year

Once a year, assess whether oversight works: were decisions taken on time, did indicators trigger action, were all members trained, did escalations reach the board? Ask internal audit or an external party to review the programme every few years. In Secrato, board approvals, training records and indicator values can sit next to the controls they relate to, so the same evidence serves NIS2, the national law and DORA.

How this connects to other frameworks

NIS2 Article 20 and DORA Article 5 overlap heavily: one calendar and one pack can serve both, with DORA adding approvals for the resilience strategy, continuity, audit plans and third-party policy. ISO/IEC 27001 clause 5 (leadership) and clause 9.3 (management review) map naturally onto Steps 3, 4 and 9. In CyFun, governance controls on roles, policies and risk management are fed by the same board decisions.

Frequently asked questions

Does the whole board need training, or just one member?

Article 20(2) refers to members of the management body, so each member. The Dutch Cbw makes this explicit with a certificate per member.

Can the board delegate oversight to the CISO?

The board can delegate preparation and day-to-day execution, but approval and oversight remain board duties. Delegation should be documented, and the board should receive regular reports.

How often should the board discuss cyber?

The laws do not set a frequency. A quarterly standard report plus an annual deep dive is a common, defensible rhythm, with escalation between meetings for significant incidents.

We are a DORA entity. Does NIS2 Article 20 still matter?

DORA is the sector-specific law for ICT risk management in finance, so its Article 5 governs. Group entities outside DORA’s scope may still fall under NIS2.