Insights

Cybersecurity has long since ceased to be an exclusively IT-related topic. Cyber incidents can lead to operational downtime, financial losses, reputational damage and disruption across the entire value chain. That is why the NIS2 Directive places responsibility firmly on directors and management.

For many organisations, the likelihood of this happening seems low. Yet daily news reports show that ransomware attacks, data theft, and disruptions of critical IT systems are no longer rare exceptions. Financial damage can run into millions of euros, while reputational harm and loss of customer trust often have even greater consequences.

The EBA Guidelines on the management of Environmental, Social and Governance (ESG) risks have been in effect for all Significant Institutions since 11 January 2026.