Management must be involved in data protection and infosec. Here’s what the regulations say.

But what do the actual regulations say? In this article, we explore the key frameworks – ISO 27001, NIS2 and the GDPR – and what they require from management.

{{factbox-dark}}

ISO 27001‍

To understand management’s role under ISO 27001, look to Clause 5.

Here, management is given three core responsibilities. They must:

• Demonstrate leadership commitment and be actively involved in setting up and supporting the ISMS – including allocating sufficient resources.
  
  
• Ensure there is an information security policy in place that is communicated and followed up on.
  
  
• Establish clear roles and responsibilities within the organisation.

NIS2‍

The NIS2 Directive makes it crystal clear: information security is the responsibility of top management.

According to the directive, leaders are required to:

• Approve the cybersecurity risk-management measures taken,
• Oversee it’s implementation,
• Follow cybersecurity training, and
• Encourage similar training for staff across the organisation.
  
  

Members of the governing body can even be held personally liable for failing to meet these obligations.

Read the full directive here:

{{factbox-light}}

GDPR‍

The GDPR doesn’t explicitly state that management is responsible. But the regulation imposes a wide range of obligations on organisations, and it is naturally the leadership that carries the overarching accountability.