What should cyber security training for the board cover?
Enough to judge risks and decisions, not to configure systems. Good board training covers the main ways companies are attacked (stolen passwords, phishing, unpatched systems, suppliers), what an incident does to the business and which deadlines start running, the board's own duties under laws such as NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies., how to read the security metrics it receives, and what to do in the first hours of an incident. A short tabletop exercise, in which the board walks through a realistic incident, teaches more than slides. Under NIS2, the members of the management bodies of entities in scope must follow training, and national laws set the detail. Keep attendance records: they are part of the evidence. NetSenX does not provide training, but its plain-language alerts make good real examples.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.