AlertControl for board members: oversight of digital security
Under the NIS2 rules (in the Netherlands the Cyberbeveiligingswet), the board is ultimately responsible for security measures: it approves them and oversees their implementation. AlertControl for Microsoft 365 shows what happens in the Microsoft 365 environment, with a severity per event and AI advice in plain language. That gives you a factual basis for that oversight. AlertControl helps, but does not make your organisation compliant.
Updated 2 November 2026
What does the law require of the board?
• The board approves the risk-management measures and oversees their implementation.
• The board can be held liable if the duty of care is not met.
• Board members must understand cyber risks, for example through training.
Oversight therefore requires insight into what actually happens, not just policy on paper.
From policy to facts
AlertControl shows whether measures work in practice: do all accounts have MFA, are there administrators without MFA, are there accounts unused for months, and which sign-ins came from abroad? Microsoft's Secure Score and its recommendations give an objective picture of the security settings.
Recognising incidents in time
A significant incident must be reported within 24 hours with an early warning. That only works if you notice it in time. The timeline lists suspicious sign-ins, new inbox rules, role changes and security alerts from the last 24 hours, so your IT lead can quickly judge what happened.
Reporting to the board
The AI advice summarises the security status in plain language: what goes well, what needs attention and which steps take priority. That is a useful basis for discussing cyber risks in the board, without technical jargon.
Frequently asked questions
No. The law requires a combination of measures, policies and responsibilities. AlertControl helps with one part: recognising and following up suspicious events in Microsoft 365 in time.
Yes, with the Security Reader role in Microsoft 365. It lets you see everything in AlertControl without being able to change anything in your environment.
That depends on your sector and size; it usually concerns medium-sized and large organisations in designated sectors. Our page about NIS2 explains more, and the government and the NCSC give a definitive answer.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.