In an SME, management is accountable for cybersecurity, and one named person has to own it. NIS2 makes the management body approve and oversee the security measures. ISO 27001 makes top management assign the roles. Neither requires a CISO. In a company of forty to a hundred and fifty people, ownership is one to two days a month of decisions.
This guide covers what NIS2 and ISO 27001 require, where security lands by default, a five-question test, what the owner does, and when a vCISO fits.
| Who | Responsible for | Where it comes from |
|---|---|---|
| Management body | Approving the security measures, overseeing their implementation, answering for failures, and following training | NIS2 |
| Top management | Assigning and communicating responsibilities and authorities for the information security management system | ISO 27001 clause 5.3 |
| One named security owner | The recurring decisions: risk register, exceptions, suppliers, questionnaires, internal audit, incidents, board reporting | ISO 27001 Annex A control 5.2: roles defined and allocated |
| A CISO | Not required | NIS2 creates no role; ISO 27001 does not use the word |
Why does security need a named owner?
Ask a forty-person company who owns security and you get one of three answers. A name, said quickly, usually the head of IT. A pause, then “well, all of us really”. Or a name said slowly, because the person saying it has just realised that the name is their own.
The third answer is the honest one. The first two are how companies arrive at an audit with a policy set nobody has read and a risk register last touched in the month it was created.
Security work in a small company is not a project with an end date. It is a stream of small decisions arriving weekly. A supplier sends a questionnaire and a deadline. An engineer asks for admin rights for a week, and the week ends. A laptop goes missing in an airport. A penetration test returns eleven findings and four will not be fixed this quarter, so someone has to sign a piece of paper saying that is acceptable. A customer contract requires notification within twenty-four hours of an incident, and nobody has defined what counts as one.
None of these need a full-time specialist. All of them need one person who is accountable for the answer. Without that person, each decision is made by whoever it landed on, differently each time, and none of it is written down.
Does NIS2 or ISO 27001 require a CISO?
No. Both frameworks that reach a European SME demand an owner, and neither demands a hire.
NIS2 puts approval and oversight on the management body. Management has to approve the measures, oversee their implementation, and can be held responsible for failures. More in NIS2 board accountability and governance. Management must also follow training and offer similar training to staff, covered in NIS2 training requirements. The directive creates accountability and leaves the org chart alone.
ISO 27001 requires the roles to be assigned. Clause 5.3 makes top management responsible for assigning and communicating responsibilities and authorities for the information security management system. Annex A control 5.2 requires security roles and responsibilities to be defined and allocated according to the organisation’s needs. The word CISO does not appear. What appears is a specific human, named in a document, responsible for specific things.
That gap between owner and hire is where most SMEs sit, and it is not a loophole. An auditor will ask who owns the risk treatment decisions, and “the management team” does not survive the follow-up question.
Where does security land by default, and what breaks?
Absent a decision, the job lands on whoever is nearest. There are three usual landing spots, and each fails in a predictable way.
The head of IT. The most common, and the one that looks most reasonable. It fails on independence: the person running the infrastructure is now judging whether it is adequately protected, deciding which of their own findings to accept, and reporting on their own backlog. The conflict is structural, not personal. It also fails on scope: decisions about suppliers, contracts, training and physical access are not IT decisions, and an IT lead has no standing to make them.
The quality or compliance manager. Common in manufacturing and in companies that already hold ISO 9001. It produces excellent documentation and very little change. This person can write the policy, run the internal audit and manage the evidence. They cannot judge whether a network segmentation design is sound, or a logging retention period long enough to investigate anything. The management system looks healthy from outside, which is the difference between certified and secure.
The founder or CTO. The most capable of the three and the least available. Decisions are correct when they are made, and they are made late, in batches, usually the week before an audit or the week after an incident. The failure mode is not judgement. It is latency.
How do you tell whether anyone owns security?
Put five questions to the leadership team, separately, and compare the answers.
- Who signs off that a known, unfixed vulnerability is acceptable to carry?
- Who decides when a temporary access exception expires, and who checks that it did?
- Who reads the security documentation a supplier sends before a contract is signed?
- Who gets called at ten in the evening when something looks wrong, and what are they authorised to do?
- Who writes the security section of the board pack, and who challenges it?
If the answers name three or more different people, or any answer is a department rather than a person, nobody owns security. The company has distributed the work and retained none of the accountability, which reads worst in an audit and performs worst in an incident.
What does a security owner actually do?
Stripped of the job title, the work in a company of this size is a short recurring list.
- Maintaining the risk register, and forcing a decision on each item rather than letting it age. The shape that survives scrutiny is in evidence that assembles itself.
- Owning the exception log: who asked, what was granted, when it expires, who checked.
- Reviewing suppliers before signature and at renewal, one of the ten measures NIS2 names.
- Answering customer security questionnaires, and keeping the answers consistent between them.
- Running the internal audit and the management review, the loop in internal audit and management review.
- Deciding what counts as an incident, and rehearsing the notification path before it is needed.
- Reporting to the board in terms the board can act on.
In a company of forty to a hundred and fifty people, that is one to two days a month of decision making. It sits on top of tooling that produces the underlying facts continuously. It is not a full-time job. It is also not nothing, and it does not survive being everyone’s tenth priority.
Should you hire a CISO, assign someone, or use a vCISO?
Three ways to close the gap, and the arithmetic differs sharply.
Hire. A security lead in Luxembourg is a six-figure annual cost once employer charges are included. They take three to five months to find, in a market where every bank competes for the same people, and another three months to be useful. That is most of a year before the first decision improves. A hire is right eventually for most companies that keep growing. It is rarely right as the first move, because a company that has never had the function does not yet know what shape of person it needs.
Assign internally. Cheapest, and workable if two conditions hold: the person has explicit authority, written down rather than implied, and the time is protected in the calendar rather than assumed. Where it goes wrong is never the person. The role was added to a full job with no authority and no hours, and lost every collision with delivery work.
Borrow. A vCISO arrangement buys the decision making without the recruitment cycle, at a few days a month rather than a salary, starting in days rather than quarters. It also buys independence: someone whose judgement on the infrastructure is not a judgement on their own work. The honest limitation: a part-time owner cannot be the person who notices something at ten in the evening. The detection half has to come from tooling rather than attention.
The thing to avoid is the fourth option: deferring the decision and letting the job keep landing on whoever is nearest. That is the arrangement every company already has before it chooses one of the three.
Is a named owner enough?
No. Both frameworks stop at accountability, and an auditor can verify both by reading a page. Neither requires that the named owner can see anything.
A security owner with a signed responsibility statement, no asset inventory, no log retention longer than the default and no alerting owns a document set, not a security posture. They can tell you what the policy says. They cannot tell you whether it held last Tuesday.
The owner needs an inventory that updates itself and logs kept long enough to reconstruct an incident. Findings should arrive ranked against the business, not as an undifferentiated list. The evidence trail should regenerate rather than be assembled the month before the auditor arrives. With those, one owner working two days a month can hold the position. Without them, a full-time CISO would spend most of the week collecting facts a system should have collected on its own.
Ownership is the requirement. Visibility is what makes it mean something. An independent security audit tells you which of the two you are missing, in weeks, and the broader picture of what NIS2 expects is in the NIS2 compliance guide.
Security ownership checklist
- Put the five ownership questions to each member of the leadership team separately, and compare the answers.
- Name one person, not a department, as the owner of security decisions.
- Write that person’s authority down, and protect their time in the calendar.
- Document the security roles and responsibilities, as ISO 27001 clause 5.3 and Annex A control 5.2 require.
- Have management approve the security measures and oversee their implementation.
- Start an exception log: who asked, what was granted, when it expires, who checked.
- Choose to hire, assign or borrow, rather than letting the job land on whoever is nearest.
- Check the owner can see the estate: a self-updating inventory, logs long enough to reconstruct an incident, and ranked findings.
Frequently asked questions
Who is responsible for cybersecurity in a company?
The management body is accountable: under NIS2 it approves the security measures, oversees their implementation and can be held responsible for failures. ISO 27001 clause 5.3 requires top management to assign the security roles, so in practice one named person owns the day-to-day decisions.
Does NIS2 require a company to appoint a CISO?
No. NIS2 creates accountability for the management body but does not create a role, and the word CISO does not appear in ISO 27001 either. Both require a named owner, not a hire.
Should the IT manager be responsible for cybersecurity?
It is the most common arrangement, and it fails on independence: the person running the infrastructure ends up judging whether it is adequately protected and which of their own findings to accept. Decisions about suppliers, contracts, training and physical access are also outside an IT lead's standing.
How much time does security ownership take in a small company?
In a company of forty to a hundred and fifty people, about one to two days a month of decision making, with tooling producing the underlying facts continuously. It is not a full-time job, but it does not survive being everyone's tenth priority.
When does a vCISO make sense for an SME?
When the company needs an independent owner before it knows what shape of security hire it needs. A vCISO works a few days a month rather than on a salary and starts in days rather than quarters. Detection still has to come from tooling, because a part-time owner cannot be the one who notices something at ten in the evening.
