Board delegation at a cloud infrastructure provider
A French cloud infrastructure provider with 1,200 employees and €310 million turnover hosts payment and health workloads for EU customers. It is an essential entity under the digital infrastructure sector. The board has approved a €9 million cybersecurity budget and a one-page security policy, but delegates all implementation to the CISO, who reports to the CTO. The board reviews a dashboard twice a year. In March, a misconfigured storage bucket exposed 22,000 customer files for 11 days. The CISO had requested MFA for administrative consoles 18 months earlier, but the request was deferred for budget reasons. The board says it relied on the CISO and cannot be liable. The national authority opens supervision and asks for evidence of management-body oversight.
1. Evaluate the board's claim that it relied on the CISO and therefore cannot be liable.
Read the worked answer
The claim is weak under NIS 2 governance rules. The management body must approve the cybersecurity risk-management measures and oversee their implementation. It may delegate operational tasks to a CISO, but it cannot delegate away accountability. Approving a budget and a one-page policy is not the same as approving and monitoring the Art 21 measures. A twice-yearly dashboard may be inadequate for an essential cloud provider hosting payment and health workloads. The deferred MFA request is particularly damaging evidence: the CISO identified a material risk, and the board or its delegated committee did not resolve it. Whether members face personal liability depends on national transposition, but the authority can find a governance failure and impose supervisory measures and fines on the entity.
2. What evidence of management-body oversight should the provider be able to produce?
Read the worked answer
Useful evidence includes board or committee minutes showing approval of the risk-management measures and risk appetite; a risk register with owners and remediation dates; decisions on the MFA request and the reasons for deferral; key risk indicators reviewed at defined intervals; incident reviews and follow-up actions; budget and staffing decisions tied to risks; management-body cybersecurity training records; internal or external audit reports; supply-chain risk approvals; and tracked remediation of the storage misconfiguration. A dashboard alone is weak if it does not show decisions and follow-up. The provider should also document which management-body member or committee is accountable and how escalation from the CISO works.
3. What supervisory consequences and remediation steps are realistic?
Read the worked answer
The authority can request documents, conduct an audit, issue recommendations or binding instructions, and impose fines. For an essential entity, the maximum fine is at least €10 million or 2% of total worldwide annual turnover, whichever is higher, depending on national law. Serious cases may also lead to temporary bans on managerial functions. Remediation should include enforcing MFA on administrative consoles, removing standing privileges, segmenting cloud administration from customer workloads, improving configuration scanning, and reporting the incident where it qualifies as significant. The board should minute corrective decisions, assign owners and deadlines, and review the security policy so that it reflects actual measures rather than a one-page aspiration.