NIS2 Article 20 makes management bodies answerable for the access controls they approve, and boards are starting to ask for proof that those controls work.

NIS2 board accountability gives directors a more direct role in cybersecurity. Under Article 20, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by the directive, oversee their implementation, and can be held liable for infringements, subject to national law.

That obligation is live across most of the EU, with four member states going to the Court of Justice in July for failing to notify full transposition.

Access control is one of the required measures. Directors are not expected to decide who gets administrator rights or review individual user accounts. They do, however, need to know that access is being controlled, that someone has responsibility for managing the risk, and that problems are being addressed.

An estimated 160,000 entities fall within the scope of NIS2 across the EU.

Approval is only part of the job

Article 20 requires management bodies to both approve cybersecurity risk-management measures and oversee their implementation. It also requires the members of those bodies to undergo cybersecurity training, and to offer comparable training to employees on a regular basis.

The measures themselves are set out in Article 21. They include access control policies and asset management, along with the use of multi-factor authentication or continuous authentication solutions where appropriate.

Many organizations have traditionally left these decisions to security and IT teams. Under NIS2, the board still needs to know whether the measures it approved are being implemented.

Day-to-day responsibility can remain with the CISO and IT teams. The difficulty comes when the person responsible for a risk does not control the budget, systems, or people needed to address it. 

Greece’s implementation goes further in defining who carries that responsibility. Its NIS2 law requires essential and important entities to appoint a suitably qualified member of their organization as an Information and Communication Systems Security Officer. The officer coordinates compliance, must have the resources needed to do the job, and operates independently of the company’s data protection officer. 

Access problems also need to reach the board in terms that it can act on. If an MFA rollout has failed or administrators have more access than they need, the board needs to understand the risk of leaving it unresolved. The CISO may be responsible for the risk without controlling the budget or teams needed to fix it.

The board needs evidence

Board reports often show what the access control policy requires, rather than whether it is being followed.

For example, a company policy will likely require MFA and the removal of accounts when employees leave.

However, the board also needs to know about the exceptions, including old accounts that remain active, excessive privileges, MFA exemptions that have never been reviewed, and suppliers whose access has outlasted their contracts.

The board needs information about how the controls are working in practice.

In a NIS2 access management report from European password and secrets manager Passwork, regulators from two national cybersecurity authorities and independent security leaders describe boards that have absorbed the liability change and now ask for proof that controls work, where they once accepted a summary of the policy.

Organizations should be able to show who can access critical systems, why that access was granted, who approved it, how long it is valid, and when it was changed or revoked. The board needs to know whether that evidence exists and what it says about material access risk.

Personal liability raises the stakes

Implementation is still catching up in parts of Europe. In July 2026, the European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union for failing to notify full transposition of NIS2 into national law. The Commission also asked the Court to impose financial sanctions.

For organizations in countries where NIS2 has been transposed, regulators have significant enforcement powers.

For essential entities, member states must set a maximum fine of at least €10,000,000 or 2% of the global annual turnover, whichever is higher. Important entities are subject to a lower maximum threshold, of at least €7,000,000 or 1.4% of their global annual turnover, in a similar capacity.

Article 32 also allows competent authorities, in specific circumstances, to seek the temporary prohibition of someone at CEO or legal representative level from exercising managerial functions in an essential entity. This can happen where enforcement action has failed to produce the required response. It is not an automatic consequence of a cyber incident.

Article 20 separately requires member states to ensure that management bodies can be held liable for infringements of Article 21, subject to the applicable rules under national law.

Approving the policy is not the end of the board’s involvement. It also needs information on whether the policy is being followed and what is happening with known problems.

Verizon’s 2026 Data Breach Investigations Report found credential abuse somewhere in the chain of 39% of breaches, more than any other vector. Stolen credentials also circulate at scale, as the exposed database of 24 billion credential records reported in June showed. Directors should expect an answer on which accounts and credentials reach critical systems, who is responsible for them, and whether that access is being controlled.

Give access risk an owner with authority

CISOs briefing their boards should be able to say who owns access-control risk and whether that person has the authority to address it. The board also needs evidence of what is happening.

When an access problem is identified, someone needs to be responsible for getting it fixed. That might mean removing unnecessary privileges or dealing with an MFA exception that has remained in place. If the fix depends on another team’s budget or resources, the board needs to know.

Board reporting should show whether the controls it approved are working, flag significant exceptions that remain unresolved, and who is accountable for closing them.

Author the author:

Kirsten Doyle has spent 27 years writing about technology and has covered the industry through some of its most significant shifts. Her focus areas include cybersecurity, cloud, channel, enterprise IT, and data centre operations. She works across many formats: news, features, white papers, eBooks, and thought leadership. Kirsten has many years of experience in journalism and editing for both print and digital media, and has supported plenty of go-to-market and PR programmes with technically grounded writing that holds up to scrutiny. She is also a regular writer at Bora. 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, NIS2)

A New Mexico judge ordered Meta to pay $25 billion for misleading users about privacy, setting a record penalty. Meta plans to appeal.

This week a New Mexico judge ordered Meta to pay the state $25 billion. The order follows a jury finding that the company deceived Facebook users about their privacy, and it’s the biggest fine ever imposed on Meta. State District Court Judge Francis J. Mathew wrote that Facebook’s deception was intentional and that executives consistently misled users about how the platform worked.

“Facebook promised users that they (the users) controlled their data. This was false,” he said, as reported by the Associated Press.

This is a case about promises, not about a breach. Jurors found in September that Meta committed over 43 million violations of New Mexico consumer protection laws by making misleading public statements about how it handled users’ personal data. The case grew out of the Cambridge Analytica scandal, in which a political consulting firm harvested Facebook data to build targeted political ads for the 2016 election.

New Mexico had asked the court to fine Meta between $35 billion and $40 billion, arguing that only a large penalty would push the company to change its behavior. Meta’s lawyers said the fine should not exceed $3.4 billion and argued that any higher amount would be unconstitutional. The jury found more than 43 million violations, including 2.1 million under specific claims. Each violation can carry a fine of up to $5,000.

New Mexico Attorney General Raúl Torrez said the ruling sends a clear warning to technology companies that they must follow the law. Under the state’s constitution, fines for consumer protection violations go toward education. However, the money may remain tied up while Meta appeals the decision.

Meta plans to appeal the $25 billion ruling. The company argues that the decision and the way New Mexico is enforcing consumer protection laws make it almost impossible to operate in the state. Meta’s chief legal officer, C.J. Mahoney, says the case is an attempt to restrict free speech and impose new rules on what people can say online. The company says it is confident it will win the appeal. Meta’s lawyers also argued that the state failed to prove that residents had actually seen the misleading statements or suffered harm as a result.

Meta is worth $1.8 trillion and brought in more than $200 billion in revenue last year, and its shares rose 2% after the announcement, with earnings due that day. A nonprofit director called $25 billion a drop in the bucket for Meta, though he said it shows people want accountability. Both can be true: the company says doing business in New Mexico is all but impossible, and Wall Street shrugged.

The history explains why the number is so large. Cambridge Analytica got data through a personality quiz app that around 300,000 people took, and the app also pulled data on their friends, building a dataset of 87 million profiles. Meta banned the app in 2015 and asked Cambridge Analytica to delete the data, and the firm shut down in May 2018. The company later agreed to pay $725 million in December 2022 to settle a class action over sharing with Cambridge Analytica, and the FTC fined it $5 billion in 2019, a fifth of today’s award.

New Mexico was not part of the $18 billion settlement Meta reached in August with almost all other US states and territories. The deal includes stronger child-safety measures and $459 million related to the Cambridge Analytica scandal. This is Meta’s second legal defeat in New Mexico in six months. In March, a jury ordered the company to pay $375 million for misleading users about children’s safety.

Meta’s appeal could reduce the $25 billion fine if a court lowers the number of violations. The case also sends a warning to companies: privacy promises have legal consequences. As the judge stated, Facebook told users they controlled their data, but this was not true.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Cambridge Analytica Scandal)

Ireland’s DPC fined Google €403 million over GDPR violations involving location data, transparency, retention and user control.

Ireland’s Data Protection Commission (DPC) just fined Google €403 million, and the case behind it goes back six years, to a set of complaints that never really went away.

The DPC launched the investigation in February 2020 after receiving complaints from several European consumer groups, including BEUC, about how Google handled location data. The investigation covered the period from 25 May 2018, when the GDPR came into force, to 4 February 2020.

“The scope of the Inquiry concerned Google’s processing of location data in three specific features – “Web & App Activity”, “Location History” and “Location Accuracy” between the date of application of the GDPR, 25 May 2018 to 4 February 2020.” reads the DPC’s press release.

Three specific features sat at the center of it: Web & App Activity, Location History, and Location Accuracy. Web & App Activity tracks what a signed-in user does across Google’s own services, sites and apps included, and location data is part of that mix. Location History goes further, following a device’s movements over time and building a private Timeline map of everywhere that phone has been, even when the person isn’t actively using any Google service.

Location Accuracy works differently from the other two. It’s a feature baked into Android itself, sharpening location beyond what raw GPS alone provides, and it applies to anyone running the OS regardless of whether they’ve ever signed into a Google account. That last point matters, because it means the reach of this feature extends past Google’s own user base entirely.

The Commissioners, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, found several problems with how Google handled location data. They said the processing behind Web & App Activity and Location History did not meet the GDPR requirements for lawfulness and fairness. They also found that Google could not show that its Location Accuracy feature complied with the rules on lawfulness, fairness and transparency. Transparency was a problem across all three features, and the company also kept location data for longer than allowed.

That’s four separate violations stacked on the same underlying data. Not one narrow technical slip, but a pattern spanning collection, retention and disclosure all at once.

“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred.”said Deputy Commissioner Graham Doyle. “Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.”

Knowing where someone is makes plenty of ordinary services genuinely more useful, better maps, better local search, faster delivery estimates. But the same data point, tracked continuously, tells you where someone works, who they see, what they believe, and what they might be hiding. There’s no version of location tracking that’s neutral by default.

The GDPR provides strong protection for personal data across the EEA and requires companies to process this data in a lawful, fair and transparent way.

According to the DPC, Google’s failures meant that users may not have known their location data was being used to target them with ads or build profiles about their interests. This could have reduced their control over their own data. The fact that Google kept location data for longer than necessary made the problem worse.

That’s the practical harm regulators actually care about. Not abstract privacy philosophy, but a real information gap: people not knowing their movements were being converted into ad targeting or interest profiles they never agreed to. If you don’t know it’s happening, you can’t opt out, correct it, or challenge it. The consent mechanism only works if the person on the other end actually understands what they’re consenting to.

Ireland’s Data Protection Commission (DPC) gave Google six months to bring its data processing practices in line with the GDPR. This is not Google’s first dispute with the Irish regulator, and the company is likely to face further scrutiny as location and behavioral data remain important to its advertising business. The investigation also took six years from the initial complaint to the final decision, showing how long GDPR enforcement cases can take.

The €403 million penalty ranks as the fourth-largest EU privacy fine issued by Ireland’s data protection regulator. The DPC has previously imposed even larger penalties on companies including TikTok and Meta, with Meta receiving a record €1.3 billion fine over the transfer of European users’ data to the US.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, GDPR)