Management and board accountability under NIS2, DORA, SOX and CMMC

Under NIS2, the management body of an essential or important entity must approve the cybersecurity risk-management measures and oversee how they are implemented (Article 20(1), NIS2 Article 20). This is a duty of approval and oversight, so the board needs a dated record showing it reviewed and approved the measures, not only a security report it received. The Directive sets no minimum duration or frequency for management body training, so the training cadence is a board decision that should be justified against the entity's risk profile and national law. Confirm with your national competent authority what evidence of approval and oversight it expects.

DORA goes further on the content of the board's decisions. Under Article 5(2), the management body bears ultimate responsibility for managing ICT risk (DORA Article 5). It must approve the digital operational resilience strategy and the ICT risk tolerance, approve and periodically review the ICT business continuity policy, the ICT response and recovery plans and the ICT internal audit plans, and allocate budget for resilience, awareness programmes and training. Each item should become a board paper with a named owner and a review date. DORA has applied since 17 January 2025 (Article 64) and needs no national transposition, so a financial entity in scope cannot wait for local law before setting these approvals.

Two points shape the plan. First, NIS2 reaches your organization through national transposition laws, so obligations and supervisory powers can differ by member state, and Article 5 allows member states to keep or adopt higher cybersecurity rules. Second, the Commission's proposal on NIS2 amendments, COM(2026) 13, made on 20 January 2026, would add a new small mid-cap category. It remains a proposal that the European Parliament and the Council must approve, and Commission pages updated through July 2026 still describe it that way. Build the board calendar around the text in force today, and record which entities fall into each category so a future change does not force a full re-mapping of who approves what.

The first driver is the regime that applies at all. Under NIS2, an in-scope entity is classified as essential or important, and both classes face the same risk-management and reporting obligations, but essential entities face ex ante supervision while important entities face ex post supervision (Articles 32 and 33). For the management body, that difference changes how often regulators look at the approvals it has signed and how quickly it may be asked to show them. Under DORA, the scope is set by the type of financial entity listed in Article 2(1), and supervision runs through the national competent authority for that type, with the ECB for significant credit institutions. Confirm with counsel which Article 2 category and which supervisor apply before assigning the accountability duties in Article 5(2) to named individuals.

The second driver is whether the company is an SEC filer and how its internal control over financial reporting is scoped. Section 302 certifications by the CEO and CFO apply to every periodic report, while Section 404 management assessment applies to filers subject to it. The SEC's guidance (Release 33-8810) says that only the IT general controls necessary for the proper and consistent operation of controls addressing financial reporting risks need to be evaluated, and that operational-efficiency controls can be left out. The scope therefore depends on the company's own facts, so the first task is to map which systems feed the financial statements. Whether an issuer is exempt from the Section 404(b) auditor attestation also changes cost. The SEC estimated in 2020 that a newly exempt issuer would save about $210,000 per year on average (Release 34-88365), roughly $110,000 in audit fees and $100,000 in other costs. Ask your auditor which filer category applies and what attestation work remains.

The third driver is the CMMC level set by your contracts. Level 2 certification assessments are performed by C3PAOs, and Level 3 by DCMA DIBCAC, and under 32 CFR 170.16 and 170.17 a new Level 2 assessment is required every three years. The senior Affirming Official must affirm continuing compliance in SPRS after each assessment and annually after that, and the assessment lapses if the annual affirmation is missed (32 CFR 170.22). Confirm the required level in each solicitation, and decide who holds the Affirming Official role, because one missed annual affirmation can affect every contract that depends on it. Finally, consider whether one officer holds several duties. A CFO who is also the SOX certifying officer and the CMMC Affirming Official, or an executive who is both the NIS2 approver and the DORA ultimate owner, carries more personal exposure and more calendar pressure. Splitting those roles, or documenting a clear deputy, reduces single points of failure.

Organize oversight around one governance calendar with three named owners: a single board owner for the NIS2 and DORA approvals, a finance-led owner for the SOX Section 302 and 906 sub-certifications, and a named senior Affirming Official for CMMC. The board owner should hold the approval items that both regimes share: the cybersecurity risk-management measures under NIS2 Article 20(1) and the digital operational resilience strategy, ICT risk tolerance and business continuity policy that DORA Article 5(2) places with the management body. For SOX, the finance owner should collect the sub-certification inputs that the CEO and CFO rely on, since the officers certify the periodic reports and do not run the IT controls themselves. For CMMC, the senior Affirming Official must be a person who can answer for continuing compliance in SPRS, so confirm that role and its authority in writing before the first assessment cycle begins.

Much of the evidence can serve several regimes if it is produced once and labeled for each. Risk approval minutes, budget decisions for resilience and training, and records of who completed security awareness training can each be filed against the NIS2 and DORA obligations and, where IT general controls matter to financial reporting, against the SOX evidence set. Keep the link to each requirement explicit, because a single approval rarely answers every clause. Mappings help with this work but do not settle it. NIST and ISO informative mappings are published for reference only, and ENISA states that its mapping for NIS2 is not a measure of equivalence and does not assess whether a standard fully covers the regulation. Ask your regulator, your external auditor and your assessor which mapping, if any, they will accept before you rely on one.

Before the first board cycle, confirm three things with counsel and your assessors: which entity in the group is in scope for each regime, which officer signs each certification, and how often the Affirming Official must affirm compliance. Then write the calendar so that each approval, certification and affirmation has a date, an owner and a named evidence file. Illustrative example: a board approves the ICT risk tolerance in one meeting, the finance owner records the budget line that funds it, and the training records for that budget are filed as evidence for both DORA and the SOX review.