Must management in Germany attend cyber security training under the BSIG?
Yes, regularly. Section 38(3) of the BSIG requires the management of particularly important and important entities to attend training regularly, in order to gain sufficient knowledge and skills to recognise and assess risks and risk-management practices in information security, and to judge their impact on the services the entity provides. The law sets no number of hours, format or certificate, so choose training that fits your sector and size and repeat it at a sensible interval, for example yearly and after major changes in the threat picture or the law. The duty is personal to the members of management, so delegating it to the IT manager does not satisfy it. Keep certificates of attendance and the agenda: the BSI can include compliance with section 38(3) in audits it orders for particularly important entities under section 61(1), and act on it for important entities under section 62.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.