customer wants to know who is responsible for cybersecurity at our company

Governance, not a name

The question "who is responsible for information security" does not in practice ask for a name or job title, but for evidence of governance: is there a designated responsibility, and is it secured at management level? Article 21(2) of NIS2 does not mention this separately, but as part of the policy for risk analysis and security of information systems — the first of ten measures. Those receiving this question can usually best refer to the same policy document that also states whether the undertaking has a policy for risk analysis and the security of information systems: the owner of the policy is usually named there, together with the scope and the date of last review.

If the undertaking has no explicitly designated responsible party, then "the management" or "the owner" as an answer is often sufficient for smaller businesses — but that is a factual finding, not something this platform suggests. What the system can do: retrieve the answer from the chain file if it is already there, with the source, so that the client confirms it with yes or no. If that record is missing, the most honest answer is that there is no formally designated responsible party yet, rather than inventing a name that is not in the file. This question is often linked with others: whoever reports an incident, for example, is listed in the procedure for handling security incidents, and that may be the same person or someone else.

Where this follows from Article 21(2)

Article 21(2) of Directive (EU) 2022/2555 requires entities to apply a risk-based approach with ten concrete measures, of which a policy on risk analysis and security of information systems is the first; who is responsible for it is part of that policy, not separate information. In ISO/IEC 27001 this is reflected in Annex A, under the control measures for information security organisation. The Cybersecurity Act transposes this obligation into Dutch law and is expected to enter into force on 15 August 2026; until then, NIS2 itself is the text to fall back on.