questionnaire asks who within management is responsible for cybersecurity

Management is responsible, not the IT department

With this question, the customer wants to know whether management itself bears ultimate responsibility for cybersecurity, or whether this has been delegated to an IT manager or CISO without management involvement. The answer that most organizations provide: a management member is designated as ultimate responsible party, and execution lies with an officer or department below that level. These two things are not the same, and the questionnaire often wants to see both: who is responsible (management level) and who executes (operational level).

Concrete evidence for this is usually a board decision, a job description for the CISO or security officer, or a passage in the information security policy that sets out the division of roles. If that document is missing, then "no" or "to be determined" is the honest answer — not because no one is responsible, but because the assignment has not been documented. This question is often linked to the question of whether there is a policy for risk analysis and the protection of information systems, because that policy usually also states who approved it and who maintains it.

Where this appears in the directive: Article 21(2)

The obligation comes from Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555), which lists ten measures that fall under the responsibility of management, including governance and risk management. The Directive itself regulates management liability separately: management must oversee the execution and can be held accountable for it, even if day-to-day execution lies with a CISO. In the Netherlands, this obligation is reflected in the Cybersecurity Act, which enters into force on 15 August 2026. ISO/IEC 27001 Annex A also requires in the control measures around organizational structure a documented division of roles — if you already have that certificate, you can usually reuse that documentation directly for this question. If the organisation is ISO 27001-certified, then management responsibility is usually already mentioned there in the scope or the policy document.