How to comply with article 20 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 20 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 20 moves cybersecurity out of the IT corridor and into the boardroom. The trap: believing NIS 2 compliance is a matter for the CISO or an outsourced provider. The text makes the management body personally liable for approving and overseeing the Article 21 measures. During an inspection, the ILR does not merely check that measures exist: it demands formal proof that the board or executive committee approved them, monitored them, and that its members were trained. A security policy signed only by the technical director is not enough and exposes directors to measures including, for essential entities, a temporary suspension of management functions.What the ILR concretely expects from your governanceBoard or executive committee minutes explicitly approving the Article 21 risk-management measures, dated and named.Proof of continuous oversight: periodic risk review on the agenda, security indicators escalated to director level.Evidence of cybersecurity training for directors themselves, not just technical teams.A regular, documented and traceable staff awareness programme.A clear mapping of responsibilities: who approves, who oversees, who can be held liable.Alignment with Luxembourg law on director liability and, for the public sector, the liability of officials and appointed or elected representatives.The recurring mistake is the absence of traceability: measures are taken, but nothing proves the board saw, understood and validated them. In an inspection, absence of proof equals absence of governance.How Luxgap automates this riskOur Luxgap Board Accountability Tracker makes the governance gap that brings down directors impossible: it turns scattered board decisions into a continuous chain of evidence that stands up before the ILR. The tool connects to your governance spaces (M365 SharePoint, Teams, Outlook calendars, Docusign signatures) to automatically reconstruct who approved what, when, and with what level of information, without asking the board secretary to keep a manual register.Automatically detects each deliberation linked to Article 21 in your minutes and agendas, and alerts if no formal approval occurred in the last quarter.Generates a template approval minute for risk-management measures, pre-filled with the ten Article 21 domains, ready for board signature.Tracks the cybersecurity training status of each management body member and automatically reminds them before expiry via Teams or Outlook.Calculates a NIS 2 governance maturity score based on review frequency, training coverage and approval traceability.Produces a time-stamped, cryptographically sealed PDF report demonstrating to the ILR that the management body approved, oversaw and was trained, admissible during an inspection.Available alongside a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real governance, with a free blank audit within 48h to measur...

Governance

They trust us

Before we chat