ISO 27001 requires that responsibilities for information security are assigned and communicated clearly. NIS2 obliges management to own and oversee risk management measures. In both cases, a named person for information security is the usual way to meet that requirement with evidence, and auditors and customers ask for it. Whether an appointment is mandatory in your case is something we clarify with you.