Does NIS2 Mandate Board Training? Articles 20 and 21 of NIS2 Explained

NIS2 doesn't treat board cyber competence as good governance advice. It's a personal, individual obligation on every management body member, not a policy the board simply signs off. Article 20 writes a direct training duty into law, on top of a separate approval-and-liability obligation that makes untrained approval a governance failure in its own right. In this article, we explore exactly what the text requires in terms of Board Cyber Crisis Training.