European regulation has moved cybersecurity from the IT department to the boardroom. NIS2 places cybersecurity governance directly on management bodies: they must approve the relevant risk-management measures, oversee their implementation, and may face liability and enforcement consequences under national law. DORA does the same for financial entities and reaches deep into their technology suppliers. The hard part is not buying security products; it is governance: knowing what to oversee, what to ask, what to document, and what your supplier contracts must deliver.
Who this is for
Boards and management of companies in NIS2 scope; financial entities and their ICT providers under DORA; technology companies whose customers now pass these obligations down the supply chain.
What we do
- Design board-level cybersecurity governance: roles, reporting lines, oversight routines and the documentation that evidences them.
- Run NIS2 and DORA gap assessments and readiness programmes, proportionate to scope and risk.
- Put security into the supplier chain: contractual security requirements, audit rights, incident duties and fourth-party visibility.
- Build incident-response governance — decision rights, notification duties and communication, rehearsed before they are needed.
- Train boards and management teams: what the obligations actually require of them, in their language.
Why Cabo Advisory
Our partners teach information security and supply-chain security management at university level, chair and serve on the boards of cybersecurity companies, and negotiate the technology contracts that security obligations flow through. We advise on cybersecurity governance from the chairman's seat, not the vendor's.