The organization must designate a responsible role (e.g., NIS2 Responsible Person or Information Security Officer) to:

  • Coordinate incident response
  • Ensure timely reporting
  • Communicate with authorities

  Management remains ultimately accountable.