NIS2 for CFOs: fine caps, management liability and provisions

What should a CFO confirm first: can we be fined under NIS2, or is the exposure only contractual?

The type of exposure depends on your status:

Status depends on sector, size and the transposing law of the Member State concerned; a legal opinion on jurisdiction and applicability should come from a lawyer familiar with that law.

How is the NIS2 fine cap calculated? Is turnover the subsidiary's or the group's?

Under Article 34:

• Essential entities infringing Article 21 or 23: a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher (paragraph 4).
• Important entities: a maximum of at least EUR 7 million or 1.4%, whichever is higher (paragraph 5).
• Turnover base: the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs; recital 130 says an undertaking is understood in the sense of Articles 101 and 102 TFEU. Whether a Taiwanese parent's consolidated revenue counts is for legal counsel to judge case by case.
• "At least": Member States can set higher caps, so check the local transposing law.
• Fines come on top of supervisory measures (Article 34(2)); where a GDPR supervisory authority has already fined the same conduct, no Article 34 fine is imposed (Article 35(2)).

Should NIS2 fine risk be recognised as a provision or disclosed as a contingent liability?

Taiwanese public companies prepare financial reports under IFRS as endorsed by the Financial Supervisory Commission. The IAS 37 framework:

• Is there a present obligation as a result of a past event (paragraph 14(a); where unclear, whether it is more likely than not to exist at the end of the reporting period, paragraph 15)
• Is an outflow of resources probable, meaning more likely than not (paragraphs 14(b) and 23)
• Can the amount be reliably estimated (paragraph 14(c); except in extremely rare cases a range can be determined, paragraph 25)

If all three are met, recognise a provision at the best estimate (paragraph 36) and review it each period (paragraph 59); if an outflow is not probable it is a contingent liability, disclosed in the notes unless remote. Future costs of building NIS2 compliance are not a provision (paragraph 18). The conclusion is for the statutory auditor and legal counsel case by case.

What are the board's and senior managers' responsibilities under NIS2, and how should a CFO report to the board?

• Article 20: management bodies approve the Article 21 cybersecurity risk-management measures, oversee their implementation and can be held liable for the entity's infringements; members must follow training.
• Article 32: for an essential entity, after other enforcement measures fail, a temporary prohibition on a natural person discharging managerial responsibilities can be requested (paragraph 5(b); recital 133 says only as a last resort); Member States must also be able to hold natural persons who represent or control the entity liable (paragraph 6, applied to important entities by Article 33(5)).
• What to report: status determination, fine caps translated into figures, Article 21 gaps and remediation budget, reporting drill records. Article 20, item 6 of the annual report regulations requires analysis of the impact of important legal changes on finances and operations (the annual report regulations and the internal control regulations apply to public companies; companies that are not public are not covered by them and can use them voluntarily).
• Whether D&O insurance responds depends on policy terms and local law; confirm with your broker and lawyer.

How should a CFO build the NIS2 budget, and which costs are expensed straight away?

Article 21(1) asks for "appropriate and proportionate" measures, taking into account the state of the art and the cost of implementation: the budget can follow risk priority rather than doing everything at once. The budget can follow the five steps listed on the service page:

• Applicability assessment and gap analysis
• Policies and documentation: cybersecurity risk-management policy, 72-hour incident reporting SOP, supplier security assessment procedure, management responsibility matrix
• Technical controls
• Audit readiness and ongoing maintenance
• Training for management body members (Article 20(2))

Under IAS 38 paragraph 69, training expenditure is expensed when incurred; classification of other costs is for the statutory auditor. Timeline (as listed on the service page): usually 4–6 months, 2–3 months with an existing ISO 27001 system.

EU customers want us to sign NIS2 security clauses: which contractual liabilities and insurance should a CFO review?

Customers manage supply-chain security under Article 21(2)(d), and Article 21(3) requires them to take into account the vulnerabilities specific to each direct supplier and service provider, so the clauses land on you. A CFO review framework:

The legal effect of clauses is for legal counsel; cover is for your insurance broker to confirm.

How does Winners Consulting help a CFO with NIS2?

• Status determination: by sector, size and the Member State's transposing law, decide whether you are an essential or important entity or only need to answer customer supply-chain requirements, so you know whether exposure sits in fines or contracts
• Gap analysis: map each of the ten Article 21 measures and produce a prioritised remediation list, so the budget follows risk
• Reporting: build the 24-hour, 72-hour and one-month reporting procedure and confirm with tabletop exercises that it can be repeated
• Management responsibility: a senior management cybersecurity responsibility matrix and approval records
• Supply chain security: a supplier risk assessment procedure and contractual security clauses
• Integration with ISO 27001: add the NIS2 differences to the existing system, so one set of evidence answers NIS2 and customers
• Who leads: VP- and director-level consultants throughout, never outsourced

More: NIS2 consulting, How to choose an NIS2 consultant in Taiwan, CFO role page. Request a free mechanism diagnosis