# What should cyber security training for the board cover?

Enough to judge risks and decisions, not to configure systems. Good board training covers the main ways companies are attacked (stolen passwords, phishing, unpatched systems, suppliers), what an incident does to the business and which deadlines start running, the board's own duties under laws such as NIS2, how to read the security metrics it receives, and what to do in the first hours of an incident. A short tabletop exercise, in which the board walks through a realistic incident, teaches more than slides. Under NIS2, the members of the management bodies of entities in scope must follow training, and national laws set the detail. Keep attendance records: they are part of the evidence. NetSenX does not provide training, but its plain-language alerts make good real examples.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [For the board and finance](https://netsenx.com/en/faq/board) · https://netsenx.com/en/faq/what-should-cyber-security-training-for-the-board-cover

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/blog/2026-10-09_cybersecurity-for-the-board
- https://netsenx.com/en/pricing

## Related questions

- [Who should own cyber security in a small company?](https://netsenx.com/en/faq/who-should-own-cyber-security-in-a-small-company)
- [What should the CEO do in the first hour of a cyber incident?](https://netsenx.com/en/faq/what-should-the-ceo-do-in-the-first-hour-of-a-cyber-incident)
- [Who in the company should decide on a ransom demand?](https://netsenx.com/en/faq/who-should-decide-on-a-ransom-demand)
- [Which payment controls stop invoice fraud and fake CEO requests?](https://netsenx.com/en/faq/which-payment-controls-stop-invoice-and-ceo-fraud)
- [Should cyber risk be in the company risk register?](https://netsenx.com/en/faq/should-cyber-risk-be-in-the-company-risk-register)