D&O Liability and the New Cyber Laws

DORA and NIS2 have established a principle with far-reaching consequences for directors and managing directors: responsibility for cybersecurity lies personally with the management body. It cannot be fully delegated to the IT department, an external service provider, or a CISO.

What the laws require #

Personal responsibility of management is concretely established in several laws:

Art. 5(2a) DORA: The management body bears ultimate responsibility for ICT risk management.
Art. 50(5) DORA: The competent authority can impose administrative sanctions on members of the management body.
Art. 20(1) NIS2: Management bodies must approve risk management measures and oversee their implementation. They can be held personally liable.
Art. 32(5)(b) NIS2: Authorities can temporarily prohibit natural persons from exercising management functions — a temporary ban as an escalation measure.
Art. 32(6) NIS2: Natural persons can be held liable for breaches of their obligations.
§ 38(1-2) NIS2UmsuCG (German law): Management is obliged to implement and oversee risk management measures. They are personally liable for culpably caused damages.
Art. 5(2) GDPR: The controller must be able to demonstrate compliance with the principles ("accountability"). GDPR fines under Art. 83 are paid by the company. Whether the company then seeks recourse from management is a separate question. It is regularly raised where the measures under Art. 32 cannot be evidenced. Anyone who has documented their diligence as they went can answer it with paperwork.

The training obligation #

Both laws require members of management bodies to undergo training:

Art. 5(4) DORA: The management body must actively keep sufficient knowledge and skills up to date.
Art. 20(2) NIS2: Members of management bodies must participate in training to be able to assess risks and evaluate measures.
§ 38(3) NIS2UmsuCG: Management must regularly participate in training.

This is not a recommendation. It is a legal obligation.

Where D&O insurance stops #

Many directors rely on their D&O insurance. Its core exclusion, however, is the knowing breach of duty: whoever deliberately fails to meet a duty they know about loses cover. And that is exactly where the new cyber laws lead. They anchor named management duties — approve, oversee, keep training — and in doing so also document that management knew about them. The more explicitly a duty is written into the law, the harder it becomes to claim later that you were unaware of it.

On top of that: damages, fines, and recourse are three different things. Fines against the company are in many policies not covered at all, or only to a limited extent.

What follows for you: do not rely on the "D&O" label. Have it checked which cyber risks your contract actually covers — and make sure that, if it comes to it, you can evidence that you met your duties. That evidence is the part no policy handles for you.

What a director must do #

The laws establish a clear duty profile:

Approve risk management measures and actively oversee their implementation
Regularly participate in training and demonstrate knowledge
Know the software supply chain — including open source dependencies
Make documented decisions when risks are identified
Maintain evidence that can be presented to an auditor or authority

What OTTRIA can take over #

OTTRIA cannot replace a director's personal responsibility — nobody can. What OTTRIA delivers is the operational foundation and documentation on which informed decisions can be made:

Risk analysis and assessment of all open source components in your supply chain
Remediation protocols with documented outcomes per vulnerability
Decision briefs that transparently present options and risks
Audit-ready evidence demonstrating that action is being taken systematically

You make the decisions. OTTRIA ensures you have a solid foundation for them — and that this foundation is documented.