Delegating Cybersecurity Without Delegating Accountability

Can leaders just hand cybersecurity to the experts?

When an organisation has a security team, its leaders can easily assume cybersecurity is taken care of. The work can be delegated, but responsibility for whether it is done well stays with the leaders. That lasting responsibility is called accountability: being answerable for the results, even when other people carry out the tasks.

The UK's Cyber Governance Code of Practice compares good cyber governance to financial oversight. Directors rarely do the bookkeeping themselves, but they are still expected to understand the accounts and question them.

Law, framework or code: what does each one ask?

In the EU, NIS2 (Directive (EU) 2022/2555) is law. A directive is EU law that each Member State must write into its own national law, with a deadline of 17 October 2024, so duties and penalties for leaders differ by country. The European Commission says NIS2 introduces accountability of top management for non-compliance with cybersecurity risk-management measures, bringing cybersecurity to the boardroom. The Commission has also proposed targeted amendments to make the rules clearer, so some details may change.

The NIST Cybersecurity Framework (CSF) 2.0 is guidance, not law. Version 2.0 added a Govern function, which covers how organisations make and carry out informed decisions on cybersecurity strategy. NIST stresses that cybersecurity is a major source of enterprise risk, and that senior leaders should weigh it alongside other risks such as finance and reputation.

In the UK, the government's Code sets out the governance actions directors should take ownership of. It is built on five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. It was designed for medium and large organisations, and it is not meant for the people who run security day to day.

What does weak oversight look like?

In this hypothetical example, the board of a mid-sized company receives a quarterly slide that simply says "security status: green". Nobody asks what green means, which risks were accepted, or whether the incident plan has ever been tested. When a supplier outage stops operations, the plan turns out to rely on a backup provider that was never contracted. The specialists did what they were asked to do. The gap was that leadership never questioned the plan, approved it properly or funded it.

What does active oversight look like?

Oversight depends less on technical detail and more on asking good questions regularly. The UK National Cyber Security Centre's Cyber Security Toolkit for Boards is organised around the Code. It includes a set of questions, with possible answers, that boards can use to judge how well their organisation is doing. In the example above, useful questions would have included: which cyber risks matter most to the organisation, and who accepted them? When was the incident plan last rehearsed? Do the people doing the work have the resources they need?

A split illustration of two boardroom scenes. On the left, leaders look at a single green status light while the connections to the organisation's systems fade and break. On the right, leaders look at three separate panel elements for a risk, an owner and a tested plan, each firmly linked to the systems below. — A single status colour hides more than it shows. Naming the top risk, who accepted it and when the plan was last tested gives leaders something they can actually question.

Where are the limits?

None of these documents turns a board into a security team. Following a framework does not, on its own, guarantee compliance with NIS2 or with any national law. Whether individual leaders can face personal consequences depends on how each Member State has written the directive into its own law.

Your next step

At the next leadership meeting, consider replacing any single status colour with three named items: the top cyber risk, who accepted it, and the date the incident plan was last tested. Ask for the same three items every time, so leaders can see whether the answers change.