NIS2 and cybersecurity training: how to build a programme that works

NIS2 requires training for members of management bodies of essential and important entities. A useful corporate programme should also include practical exercises for employees.

Cybersecurity training should not be a one-off presentation followed by an attendance sheet. An effective programme combines management knowledge, everyday employee habits and practical exercises that test organisational resilience.

What does NIS2 say about training?

Article 20(2) of NIS2 requires members of the management bodies of essential and important entities to undergo training. Member States must also encourage those entities to offer similar training to employees on a regular basis so that they can identify risks and assess cybersecurity risk-management practices.

Different content for management and end users

Management should understand the effect of an incident on business continuity, organisational responsibilities, investment priorities and crisis decision-making. Employees need practical behaviours: identifying phishing, secure authentication, data protection and rapid reporting of suspicious activity.

A continuous programme instead of one annual session

short refresher modules,
phishing simulations,
scenario exercises for management,
reviews of real incidents and common mistakes,
measurement of trends and areas requiring improvement.

The goal is not to “complete training”. The programme should reduce the time between noticing suspicious activity and taking the right action, and reduce mistakes that allow incidents to escalate.

Legal basis: Article 20(2) of Directive (EU) 2022/2555 (NIS2), EUR-Lex.

Want to apply this to your own environment?

We can start with a short conversation and identify the areas worth checking first.

Book a call