Cybersecurity Is a Management Responsibility at the Organizational Level

The consequences of a cybersecurity incident can extend far beyond the operation of IT systems. Production downtime, loss of business data, service disruptions, or breaches of contractual obligations can directly affect an organization's business operations and financial stability.

The NIS2 Directive and Hungary's Act LXIX of 2024 on Cybersecurity, which establishes the corresponding national requirements, therefore treat cybersecurity not merely as a technical matter but as an organizational responsibility.

Section 6 of the Act sets out the responsibilities of organizational leaders in detail, including the operation of the risk management framework, the designation of security roles, the implementation of necessary protective measures, and their regular assessment.

Management responsibility therefore goes beyond appointing an information security officer or approving the necessary policies. Maintaining compliance requires active management involvement, adequate resources, and regular decision-making. This also means that NIS2 compliance cannot be regarded as a project completed with the first successful cybersecurity audit. Cybersecurity requirements must become an integral part of the organization's day-to-day operations.

Business Leaders May Face Personal Fines for Failing to Meet NIS2 Obligations

One of the most important messages of Hungarian cybersecurity legislation for business leaders is that failure to fulfil statutory obligations does not necessarily result in consequences for the organization alone.

Under Section 30(3) of Act LXIX of 2024, the national cybersecurity authority may impose a fine on the head of an organization if they fail to fulfil their statutory obligations. In the event of repeated violations, the imposition of a fine is mandatory.

Neglecting cybersecurity responsibilities, failing to implement necessary management measures, or disregarding legal requirements may therefore have direct consequences for the individual leader.

Management accountability is not merely a theoretical concept: the authority may hold business leaders personally accountable for fulfilling their statutory obligations.

It is therefore particularly important to understand which cybersecurity responsibilities fall directly within management's remit and what measures are needed to ensure their proper fulfilment.

What Specific Obligations Does the Law Establish for Business Leaders?

Hungarian cybersecurity legislation identifies several responsibilities for which the head of an organization is accountable. Although IT professionals and the information security officer may play a key role in practical implementation, management decisions and approvals cannot simply be replaced by delegating tasks.

1. Establishing and Operating a Risk Management Framework

Under Section 6(2) of Act LXIX of 2024, the head of an organization is responsible for establishing and operating the risk management framework, taking into account the scope and exceptions specified by law. This goes beyond conducting a one-time assessment of cybersecurity risks. Risk management must continuously support organizational operations and management decision-making.

Management responsibilities include, among others:

• ensuring the assessment of electronic information systems and related supporting systems;
• evaluating business impacts and cybersecurity risks associated with these systems;
• determining security measures proportionate to the identified risks;
• ensuring that identified deficiencies are addressed and necessary measures are implemented;
• making well-founded management decisions concerning residual risks.

Management involvement is particularly important when eliminating an identified risk requires substantial investment or organizational change. In such cases, a technical recommendation from the IT department alone is insufficient. Management must consider the potential business consequences of the risk and decide how it should be appropriately addressed.

2. Security Classification of Electronic Information Systems

Identifying the electronic information systems used by an organization and assigning them to the appropriate security classes is a fundamental requirement of cybersecurity compliance.

Under Section 10(1)–(2) of the Cybersecurity Act, relevant systems must be classified into basic, significant, or high security classes based on the risk criteria established by law. The head of the organization is responsible for deciding on the security classification and ensuring that it reflects the applicable legal requirements and identified risks.

Such decisions must be based on an appropriate impact analysis and risk assessment, as the assigned security class directly determines the protective requirements applicable to the system.

Security classifications must also be reviewed at least every two years, or earlier when changes specified by law occur.

An inappropriate classification may not only result in inadequate security measures but also raise questions about the justification of management decisions.

3. Appointing and Supporting an Information Security Officer

Under Section 11(1) of the Cybersecurity Act, the head of an organization must ensure the appointment of a person responsible for the security of electronic information systems, or otherwise ensure the lawful performance of these responsibilities. Subject to the applicable conditions, this may also be achieved by engaging an external expert.

The CISO supports the organization's cybersecurity operations, contributes to the operation of the risk management framework, and performs incident reporting and regulatory liaison responsibilities.

However, management obligations do not end with the appointment.

Under Section 11(6) of the Act, management must ensure that the CISO can participate in preparing decisions affecting the protection of electronic information systems, has the necessary authorizations, information, and resources, and can access the systems and data required to perform their duties.

Importantly, engaging an external CISO does not, in itself, release management from statutory accountability. If the organization fails to provide adequate resources, disregards identified risks, or neglects decisions falling within management's authority, the leader may also be held accountable for these failures.

4. Information Security Governance and Regular Assessment

Under Section 6(3), points 7–11 of the Cybersecurity Act, the head of an organization is responsible for issuing the information security policy, ensuring the implementation of necessary protective measures, evaluating their effectiveness, and addressing identified deficiencies.

The information security policy must be reviewed at least every two years and whenever required by law. Management must also regularly verify that the organization's security measures provide an appropriate level of protection.

Section 6(4) of the Act establishes a review frequency of at least once every two years for the prescribed periodic assessment, which is consistent with the expected renewal cycle of cybersecurity audits.

Maintaining compliance therefore cannot be limited to preparing documentation. Management must also monitor whether the defined measures have been implemented, whether they operate effectively in practice, and whether identified deficiencies have been addressed.

5. Providing the Necessary Financial and Human Resources

Meeting cybersecurity requirements requires adequate resources, and ensuring their availability is also a management responsibility.

In practice, this may involve approving investments to protect critical systems, improving backup and recovery capabilities, addressing vulnerabilities, or securing the necessary expert capacity.

For certain categories of organizations, the law also establishes specific financial requirements.

Under Section 6(5)(i), organizations falling within Section 1(1)(a)–(c) of the Act must allocate an amount equivalent to at least 5% of their annual IT development expenditure to cybersecurity development.

Although this requirement does not apply universally to all organizations subject to NIS2 obligations, it demonstrates that maintaining cybersecurity also requires financial planning and deliberate management allocation of resources.

Incident Management: Leadership Accountability Also Applies in Critical Situations

During a significant cybersecurity incident, rapid response and coordinated decision-making play a crucial role in minimizing damage. However, effective incident management is not solely the responsibility of IT professionals and the CISO; it is also a management responsibility.

Under Section 6(5)(e) of the Cybersecurity Act, leaders of the organizations concerned are responsible for ensuring a rapid and effective response to cybersecurity threats and incidents, making the necessary notifications, managing incidents, and ensuring recovery.

Accordingly, management must ensure that the organization has an appropriate incident management process, clearly defined responsibilities and reporting procedures, and the resources required for rapid response and recovery.

In more serious incidents, management must also participate directly in decisions affecting business continuity, the prioritization of recovery activities, and the allocation of necessary resources. Following the resolution of an incident, management must ensure that lessons learned are evaluated and the necessary preventive measures are implemented.

Once a significant incident occurs, it is already too late to establish the processes and responsibilities required for an effective response. Ensuring adequate preparedness and an operational incident management capability is a management responsibility. Failure to do so may not only increase the resulting damage but also lead to legal consequences.

Mandatory Cybersecurity Training for Organizational Leaders

The importance of management accountability is further emphasized by the fact that Hungarian legislation establishes specific cybersecurity training obligations for organizational leaders.

Under Section 4(1) of EM Decree 17/2025 (VII. 24.), leaders of the organizations concerned must:

• complete at least 8 hours of organized cybersecurity training within one year of their appointment to a leadership position;
• subsequently complete at least 4 hours of refresher training annually.

Furthermore, leaders appointed or entrusted with their positions before 31 December 2025 must complete their initial training of at least 8 hours by 31 December 2026.

The purpose of these training requirements is to ensure that business leaders have adequate knowledge of cybersecurity risks, organizational strategies, statutory obligations, and responsibilities related to incident management.

Section 5 of the Decree also establishes specific requirements for organizing and documenting training. Training must be provided by an appropriately qualified and registered adult education provider, and completion must be documented by a certificate issued in accordance with the legislation governing adult education.

Failure to complete mandatory management training is not merely an administrative deficiency; it constitutes a failure to fulfil a statutory obligation. Demonstrating completion of the required training is therefore an important element of NIS2 compliance, particularly as the 31 December 2026 deadline approaches.

What Are the Legal Consequences of Failing to Fulfil Management Obligations?

One of the significant developments introduced by NIS2 is that violations of cybersecurity requirements may have consequences beyond the organizational level.

Section 30 of Act LXIX of 2024 governs the regulatory measures and sanctions that may be applied in the event of non-compliance with statutory requirements.

Among other measures, the authority may instruct the organization to remedy deficiencies, require the implementation of corrective actions, or impose fines where the statutory conditions are met.

Section 30(3) of the Act specifically addresses failures by organizational leaders. If a leader fails to fulfil their statutory obligations, the national cybersecurity authority may impose a fine after considering the circumstances of the case. In the event of repeated violations, the imposition of a fine is mandatory.

More serious cases may result in further consequences. Under Section 30(6) of the Act, if an essential entity that is not a public administrative body fails to comply with an order within the deadline set by the authority, the authority may initiate the temporary suspension of the authorization or certification of the service affected by the violation, as well as the temporary prohibition of the organization's leader from exercising executive responsibilities within that organization.

Such a prohibition is therefore not an automatic consequence but a measure that may be initiated when the conditions specified by law are met.

Management accountability is not limited to organizational or business responsibility: in certain cases, the law attaches direct personal legal consequences to failures by business leaders.

The Business Consequences of Cybersecurity Failures

Beyond regulatory sanctions, inadequately managed cybersecurity risks can also result in significant operational, financial, and reputational damage. A serious incident may cause an organization to lose customer trust, breach contractual obligations, or experience prolonged disruption of business-critical processes. Disregarding cybersecurity risks is therefore not merely a compliance failure but also a business risk decision.

How Can Management Commitment Be Put into Practice?

Management commitment cannot be demonstrated solely through a declaration or the approval of the necessary policies. Maintaining regulatory compliance requires operational practices that consistently incorporate cybersecurity considerations into management decision-making.

The following practices are particularly important:

Regular management reporting: Management should receive clear and comprehensive information about the organization's cybersecurity posture, identified risks, deficiencies, and ongoing corrective measures.

Documented decision-making: Decisions concerning significant risks, necessary resources, and the prioritization of security measures should be traceable and properly documented.

Continuous cooperation with the CISO: The information security officer's professional findings and recommendations should be incorporated into management decisions.

Provision of necessary resources: Adequate budgets, expertise, and capacity should be available to implement cybersecurity responsibilities.

Promoting a security-aware organizational culture: Management should lead by example in supporting compliance with internal policies, participation in training, and timely reporting of security events.

These practices not only support the demonstration of regulatory compliance but also contribute to strengthening the organization's operational resilience and business stability.

Properly documented management decisions may also serve as important evidence during a cybersecurity audit or regulatory inspection.

Successful NIS2 Compliance Starts with Active Management Involvement

Meeting NIS2 requirements is a complex task requiring the coordination of technical, organizational, legal, and business considerations.

Although IT departments and information security officers play a key role in practical implementation, active management involvement is essential for directing and maintaining effective cybersecurity operations.

Well-established management oversight not only supports preparation for cybersecurity audits but also helps ensure that cybersecurity risk management becomes an integral part of the organization's long-term operations.

NIS2 compliance is not solely the responsibility of IT or the CISO. Effective cybersecurity begins with management decisions, and failure to implement the necessary measures may also have personal consequences for business leaders.