Is cyber security training mandatory for management under NIS2?
Yes for the members of management bodies of entities in scope; how often is left to national law. Article 20(2) requires those members to follow training so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides, and it encourages entities to offer similar training to employees regularly. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. sets no hours or certificates. National laws add detail: Germany's section 38(3) of the BSIG, for example, requires management to attend training regularly. A sensible programme covers threats, the company's risk picture, the board's duties and reporting deadlines, and includes a tabletop exercise. Keep attendance records and materials as evidence. NetSenX does not provide training; its plain-language alerts can serve as realistic examples in a session.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What do board members have to approve under NIS2 Article 20?
- How can a managing director check that cyber measures actually work?
- Does NetSenX cover all NIS2 Article 21 measures?
- Does buying a security tool make us NIS2 compliant or registered?
- Which NIS2 tasks can software help with, and which can it not?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.