S.L. 460.41 Art. 18Governance.

(1) The CIP Department, or where designated the competent authority, shall ensure that management bodies of such essential and important entities approve the cybersecurity risk-management measures in accordance with article 19 and oversee their implementation. The natural persons composing the management bodies may be held liable for infringements by the aforesaid entities of the said article in accordance with articles 31(10)(b) and 33.

(2) The application of sub-article (1) and this sub-article shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.

(3) Members of the management bodies of essential and important entities are required to follow training in order to carry out their tasks.

(4) Essential and important entities shall offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.