NIS2 management accountability: the risk of delegating without checking

In many organisations, NIS2 compliance looks the same: management appoints a security officer, hands over the task and is told, every now and then, that “everything is fine”. Then it signs the annual self-assessment on trust. Romania’s GEO 155/2024 does not leave accountability where the work ends up. Management bodies approve the measures, oversee their implementation and are accountable for breaches (art. 14(1)), whoever does the actual work.

Key points

• Accountability for cybersecurity measures stays with the management bodies, even when the work is delegated to an employee, a team or a supplier (art. 14(1) of GEO 155/2024).
• The annual maturity self-assessment and the remediation plan are endorsed by management (art. 12(4) and (5)). A signature given without checking does not shift accountability.
• A security officer may neglect their tasks for predictable reasons: pay that does not match the role, too many tasks, insufficient skills, settling in or preparing to leave, or passing the work down to a subordinate.
• Most of these causes come down to management decisions: resources, authority, time, training.
• Oversight does not require technical knowledge. It requires evidence instead of statements, regular reporting, a designated deputy and an independent check.

What does the law say about management accountability?

Four provisions of GEO 155/2024 set out the role of management:

• art. 14(1): the management bodies of essential and important entities approve the risk management measures, oversee their implementation and are accountable for breaches;
• art. 14(2): members of management bodies attend accredited training, and entities provide regular training to all staff;
• art. 14(3): management allocates the necessary resources and appoints the person responsible for network and information system security within 30 days of receiving the DNSC registration decision;
• art. 12(3): when management bodies find that the measures are not being met, they apply the necessary corrective measures without undue delay.

In essential entities (with exceptions for public administration, micro and small enterprises), the security officer must meet five cumulative conditions, including reporting directly to management, independence from IT and OT functions, adequate resources and an accredited course recognised by DNSC within 12 months of appointment (art. 14(4)). The role is explained in our article on the NIS officer in Romania: duties, appointment and training.

The NIS2 Directive goes further. Article 20(1) says management bodies “can be held liable” for the entity’s infringements. Article 32(6) requires Member States to ensure that natural persons who represent or control an essential entity can be held liable for breaching their duty to ensure compliance. As a last resort, article 32(5)(b) allows a request for a temporary ban on exercising managerial functions for the person acting as chief executive or legal representative of an essential entity.

Separately from NIS2, company directors in Romania are liable to the company for how they exercise their mandate, under Company Law no. 31/1990 (art. 72). Negligence that leads to a costly incident can also become a dispute between shareholders and directors.

You delegate the work, not the accountability

The law does not ask management to configure servers or write procedures. It asks management to decide, allocate resources and check. Delegation is normal and necessary: no director can do security work alone, and no security officer can single-handedly cover all 218 controls in DNSC Order 1/2026.

The problem starts when delegation replaces oversight. If management’s only source of information is the person doing the work, management is not overseeing, only listening. And the self-assessment sent to DNSC, endorsed by management, ends up reflecting what the officer believes rather than what actually exists.

Why a security officer ends up neglecting the tasks

Negligence is rarely bad faith. Most of the time it is the result of conditions the organisation created or tolerated. They are worth understanding, because each has different signs and a different fix.

Pay does not reflect the responsibility

The NIS officer role is often added to an existing job without a pay adjustment. The person takes on a responsibility with legal stakes, but is still paid for the previous job. The conclusion they reach, often without saying it, is simple: “for this money I do the minimum”. Documents are ticked off formally, problems are not raised, nothing is done on their own initiative.

Too many tasks for one person

In small and medium-sized companies, the same person runs the network, fixes user problems, buys equipment and, overnight, becomes responsible for NIS2 as well. Daily emergencies always win over a procedure to review or a supplier to assess. Remediation plan deadlines slip month after month, and the answer is always “I’m on it”.

The skills are not the ones required

NIS2 requires risk analysis, governance, supplier management, incident reporting and continuity. An excellent system administrator does not automatically master these areas. When people do not know, not everyone admits it. The result is documents copied from templates that do not describe the organisation, and vague answers to concrete questions.

New to the organisation

A newly appointed officer does not yet know the systems, the suppliers or the incident history. They inherit documents they did not write and do not fully understand, and in the first months avoid asking awkward questions. Settling in is normal, but it becomes a risk when it coincides with a legal deadline or an incident.

About to leave

An employee who has found another job, is waiting to retire or is unhappy loses interest in deadlines that fall after their departure. Documentation stops being updated and knowledge about the systems stays in one person’s head. The biggest risk comes after they leave: active accounts, passwords only they knew, procedures no one else has ever followed.

The role was assigned “by default”

When an officer is appointed without being asked, without real authority and without knowing exactly what is expected, they do not take ownership of the role. Everything security-related is passed on to “IT” or “the supplier”, and the appointment decision remains a document with no practical effect.

Passing the work down to a subordinate

This is the hardest situation to spot, because on paper everything is in order: there is an appointed officer, with a name and a decision. But the work is done by someone else, one level down, who has neither the mandate, nor access to management, nor always the training.

The consequences are concrete. In essential entities, direct reporting to management and the accredited course are conditions the appointed person must meet (art. 14(4)), not the person actually doing the work. Information reaches the director filtered twice. The officer relies on the subordinate, the subordinate does not see it as their job to raise problems, and at the first incident each points to the other.

Delegation in itself is not a problem. It becomes one when it is undeclared, unwritten and unchecked. The causes also add up: the person delegating is often overloaded or about to leave, and the person receiving the task is often new.

Fear of reporting problems

If every reported problem is treated as personal blame, the officer quickly learns to report only good news. Reports are always “green”, there are no internal incidents and no delayed measures. To management, the calm looks like a good sign. Most of the time it means information is no longer reaching the top.

What the organisation risks when tasks are neglected

What is neglected	Possible consequence
Registration notification to DNSC	A fine; the first fine imposed by DNSC under GEO 155/2024 was RON 50,000, for failure to notify
Incident detection and reporting	The 24-hour, 72-hour and one-month deadlines are missed; the incident gets worse
Backups and their testing	A ransomware attack stops operations for days or weeks
Supplier assessment	A compromised supplier becomes the entry point to the network
Annual self-assessment	Management endorses before DNSC a document that does not reflect reality
Remediation plan	Known gaps stay open from one year to the next
Revoking access when employees leave	Active accounts belonging to people who no longer work there

In terms of penalties, GEO 155/2024 provides fines of up to EUR 10 million or 2% of worldwide turnover for essential entities and up to EUR 7 million or 1.4% for important entities, for first-tier breaches (art. 60). For other obligations, including registration, fines range from RON 1,500 to 500,000 and from RON 1,000 to 300,000 respectively. DNSC can carry out inspections, issue binding instructions with remediation deadlines and order an ad hoc audit (art. 26, art. 57).

The fine is usually not the biggest cost. Downtime, rebuilding systems, lost customers and lost contracts with entities that require evidence of compliance quickly exceed any penalty. And an optimistic self-assessment endorsed by management becomes, after an incident, a document that is hard to explain.

Warning signs any director can spot

No technical background is needed to notice that something is wrong:

• the officer cannot answer simple questions without “checking with someone”;
• documents are signed by one person but written by another;
• not a single internal incident has been reported in a whole year;
• every deadline in the remediation plan has been postponed at least once;
• policies still carry their original approval date and have never been reviewed;
• when asked for concrete evidence (a test report, a log, a configuration export), the answer is a description, not the document;
• the officer avoids the audit or tries to postpone it;
• one person holds all administrator passwords and there is no deputy.

A single sign does not mean negligence. Several signs at once mean oversight needs to be strengthened.

How to oversee without doing the technical work

Ask for evidence, not statements

The basic rule: a measure is closed when the evidence exists, not when someone says it is closed. Evidence can be an approved procedure, a configuration export, a backup test report, a training record or a log. The remediation plan should state, for each measure, what evidence closes it.

Provide resources, not just an appointment

Art. 14(3) requires management to allocate the necessary resources. That means time explicitly allocated in the job description, pay or an allowance that reflects the responsibility, and a budget for tools and training. An officer without resources is a formal appointment, not a security measure.

Put delegation in writing

If the officer works with other people, who does what must be written down: tasks, access, reporting. The appointed officer remains accountable to management and is the one who attends reporting meetings. Management should ask them directly, not through intermediaries.

Appoint a deputy

For every critical role, including the officer, there must be someone who can take over. Administrator passwords belong in a password vault with controlled access, not in one person’s memory. When any employee with privileged access leaves, the handover follows a checklist and access is revoked on the day they leave.

Separate doing from checking

Whoever implements cannot check their own work. The officer’s self-assessment should be tested regularly against an independent evaluation: an internal audit, an external consultant or the security audit required by art. 11(5). The NIS auditor is in turn subject to legal incompatibilities, explained in our NIS auditor guide.

Get trained as a board member

Accredited training for management bodies (art. 14(2)) is not a formality. A director who understands what an isolated backup or a 24-hour notification means asks better questions and recognises an evasive answer sooner. The DNSC training standard for management is still in draft; see our article on the DNSC draft training standard for management bodies.

Make it safe to report problems

The officer must be able to say “we are not compliant here” without fearing for their job. A problem reported early can be fixed. A hidden problem surfaces during an incident or an inspection.

Monitoring: what management tracks and how often

A simple dashboard, presented monthly and discussed quarterly, is enough for most organisations.

Indicator	What it shows	Frequency	Evidence
Remediation measures closed / overdue	The real pace of implementation	Monthly	Updated plan with evidence attached
Incidents detected and reported	Whether detection works	Monthly	Incident register, notifications to DNSC
Last backup restore test	Whether the organisation can recover from an attack	Quarterly	Test report
Privileged accounts and accounts of former staff	Access control	Quarterly	Account list export
Critical suppliers assessed	Supply chain security	Every six months	Supplier register
Staff trained	The training required by art. 14(2)	Every six months	Training records
Policies reviewed	Whether documentation is alive	Yearly	Date and approval of the last review

The CysNIS platform keeps control assessment, risks and the remediation plan in one place, so management sees the real situation without relying only on verbal reports.

Seven questions for the monthly meeting with the security officer

1. Which measures in the plan were closed this month, and where is the evidence for each?
2. Which measures are late and why? What resources do you need?
3. What incidents or suspicious events occurred and how were they handled?
4. When was a restore from backup last tested, and with what result?
5. Who could replace you tomorrow if you were away for a month?
6. Which tasks have you delegated, and to whom?
7. Which risks do you think we have not addressed well enough, and what would we need to address them?

The last question matters most. An officer who can answer it openly works in an organisation where information reaches management.

What management does when it finds negligence

Art. 12(3) requires corrective measures without undue delay. In practice:

1. Establish the facts. What was not done, since when, with what effect. Ask for documents, not just explanations.
2. Identify the cause. A lack of resources, skills or time is fixed differently from a lack of interest.
3. Close urgent risks first. Backups, unauthorised accounts, overdue notifications.
4. Fix the conditions. Allocated time, training, adjusting the role, a deputy, external support.
5. Document the decision. What was found, what was decided, who is responsible, by when. This is the proof that oversight worked.
6. If the role cannot be sustained internally, consider outsourcing it or bringing in temporary external support until the organisation has the capacity it needs.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors. For management teams that want to know where they really stand, we offer:

• an independent assessment of compliance, compared with the internal self-assessment: our NIS2 audit starts at EUR 5,000 per engagement, subject to the incompatibility rules between consulting and auditing for the same entity;
• an outsourced NIS2 officer, from EUR 1,200 per month (12-month contract), when the role cannot be sustained internally or to support the existing officer, reporting directly to management;
• NIS2 compliance consulting, from EUR 10,000 per project, for the remediation plan, the dashboard and oversight procedures;
• training for management and staff, built around the questions a director asks rather than technical detail.

ProDefence is not VAT-registered, so displayed prices are final. The comparison between in-house implementation, consulting and outsourcing is covered in our article on the three routes to NIS2 implementation, and the interactive outsourced NIS2 officer guide helps you decide whether the role can be sustained in-house.

Frequently asked questions

Sources

• GEO no. 155/2024, art. 12, 14, 26, 57 and 60, Romanian Legislative Portal
• Directive (EU) 2022/2555 (NIS2), art. 20 and art. 32(5) and (6), EUR-Lex
• DNSC Director’s Order no. 1/2026, Official Gazette no. 712 of 27 August 2026
• Law no. 124/2025 approving GEO 155/2024, Official Gazette no. 638 of 7 July 2025
• Company Law no. 31/1990, art. 72

Alexandru Angheluș, ProDefence. Cybersecurity and NIS2 compliance specialist at ProDefence, whose team includes DNSC-attested NIS auditors.