NIS2 training requirements: who must be trained, on what, and how often

NIS2 requires that members of the management body follow cybersecurity training (Article 20(2)). For other staff, Article 20 only asks Member States to encourage regular training, but Article 21(2)(g) makes cybersecurity training one of the minimum risk-management measures. The directive sets no hours, no frequency for managers, no certificate and no approved provider.

This guide covers the management duty, staff training, essential versus important entities, how often, what the law leaves open, where to find training, what Regulation 2024/2690 adds, what to cover, a training plan, a record template and a checklist.

Who	Legal basis	Wording	Status
Management body members	NIS2 Article 20(2)	“are required to follow training”	Mandatory, through national law
Employees	NIS2 Article 20(2)	Member States “shall encourage” similar training “on a regular basis”	Encouraged
All staff, as a measure	NIS2 Article 21(2)(g)	“basic cyber hygiene practices and cybersecurity training”	Minimum measure, proportionate
Digital providers in Article 21(5)	Regulation 2024/2690, Annex section 8	Awareness for all, including management; role-based training	Directly applicable detail

What training does NIS2 require for management bodies?

Article 20(2) requires Member States to ensure that the members of the management bodies of essential and important entities “are required to follow training”, and to “encourage” entities to offer similar training to their employees “on a regular basis”, so that they gain “sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”.

The duty sits alongside Article 20(1). Management bodies approve the Article 21 measures, oversee their implementation, and can be held liable for the entity’s infringements of Article 21. A board that approves measures it cannot assess has signed, not governed.

NIS2 does not define “management body”. National law decides whether it means the board of directors, the executive or supervisory board, or the managing directors of a small company. For essential entities, and through Article 33(5) for important ones, Article 32(6) adds that natural persons who represent the entity, take decisions for it or control it can be held liable for breach of their duties to ensure compliance. The wider picture is in board accountability under NIS2.

Is NIS2 training mandatory for employees?

Two provisions answer this.

1. Article 20(2) only requires Member States to “encourage” entities to offer similar training to employees “on a regular basis”.
2. Article 21(2)(g) lists “basic cyber hygiene practices and cybersecurity training” among the measures every essential and important entity must take as a minimum.

So in practice, yes: you need a staff training measure, with its depth set by the proportionality factors in Article 21(1): exposure to risk, size, and the likelihood and severity of incidents. Recital 89 says entities should “organise training for their staff and raise awareness concerning cyber threats, phishing or social engineering techniques”. Where measure (g) sits among the others is covered in the 10 Article 21 measures.

Are the training rules different for essential and important entities?

No. Article 20 and Article 21(2)(g) apply to both in identical words. What differs is supervision. Essential entities are supervised proactively and can be asked for “evidence of implementation of cybersecurity policies” (Article 32(2)(g)). Important entities are supervised after the fact, on evidence or indication of non-compliance, with the same request available (Article 33(2)(f)). See essential vs important entities.

Penalties differ by provision. Infringing Article 21, including measure (g), falls under the Article 34 ceilings: a maximum of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. Those ceilings do not cover the Article 20 training duty; penalties for it are left to national law (Article 36).

How often must NIS2 training take place?

The directive sets no interval for management body members. The only frequency words, “on a regular basis”, attach to the training Member States encourage for employees. For the providers covered by Regulation 2024/2690, awareness activities must be repeated and offered at planned intervals, and role-based training must be regular. No text sets a number, so the rhythm in the plan below is practice.

What does NIS2 not specify about training?

The directive sets a purpose, not a format. It does not set a number of hours, a syllabus, an exam or pass mark, a certificate, accredited providers, or a delivery format.

National law and authority guidance can add detail. In Germany, for example, the BSI has published guidance on the management training obligation under the BSI Act (dated 17 April 2026). The duty also depends on transposition: on 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures.

Where can you find NIS2 training for your directors?

There is no official catalogue at EU level. An external provider, a vCISO or your own security lead can deliver it. Judge any option on three questions:

1. Does it cover your entity’s services and risks, not generic threat trends?
2. Does it prepare members to assess the measures they approve?
3. Does it produce a record you can show a supervisor?

A one-day conference session fails the first test. So does an annual module directors click through. In a vCISO’s first 90 days, the decision paper to the board is a natural moment for the first session.

What does Implementing Regulation (EU) 2024/2690 add?

For DNS, TLD, cloud, data centre, content delivery, managed and managed security service providers, online marketplaces, search engines, social networks and trust service providers, section 8 of the Annex details Article 21(2)(g). It applies directly.

Awareness (8.1). The provider must ensure that its employees, “including members of management bodies”, and its direct suppliers and service providers are aware of risks and apply cyber hygiene practices. The programme is scheduled so activities are repeated and cover new employees; it covers relevant threats, the measures in place, contact points and hygiene practices. Where appropriate it is tested for effectiveness, and it is updated at planned intervals.

Security training (8.2). Identify employees whose roles require security-relevant skills and train them regularly, under a programme that sets needs by role. Training fits the job, its effectiveness is assessed, and it covers secure configuration and operation including mobile devices, known cyber threats, and behaviour when security-relevant events occur. Staff moving into such roles are trained.

Suppliers (5.1.4(b)). Contracts specify, where appropriate, awareness, skills and training requirements for supplier staff.

For everyone else, section 8 is a detailed official reading of Article 21(2)(g), and a reasonable benchmark.

What should NIS2 management training cover?

Build it from the Article 20(2) purpose. A sensible set of topics:

• The entity’s services, its top risks and what would disrupt them.
• The Article 21 measures they approve, and what proportionate means.
• Incident reporting: early warning within 24 hours, notification within 72 hours, final report within one month, and when the board is told.
• Supervision, personal liability and the fine ceilings.
• How to read the security reports they receive, and which questions to ask.

In practice, a sensible rhythm is a session on appointment, short updates at board meetings and one tabletop exercise a year. The exercise shows more than any quiz.

What should staff training cover?

All staff: phishing and social engineering, passwords and multi-factor authentication, handling data, and how to report a suspected incident. Phishing and stolen credentials are common entry points for the attacks in NIS2 and ransomware, and an early report from a user buys time.

Roles with security duties need more: section 8.2 is a good model for administrators and on-call staff, and developers need secure development and vulnerability handling. If you run ISO 27001, clauses 7.2 (competence) and 7.3 (awareness) and Annex A control 6.3 already cover most of this. Extend the records to the management body.

A NIS2 training plan you can adapt

The rhythm column is practice, not law.

Audience	Content	Format	Suggested rhythm	Evidence
Management body	Risks, measures approved, reporting role, liability	Briefing and tabletop exercise	On appointment, then yearly	Attendance, agenda, minutes
All staff	Phishing, MFA, data handling, reporting	Short modules, simulations	At joining, then yearly	Completion records
IT administrators	Secure configuration, privileged access, backup and restore	Role-based technical training	Yearly and on major change	Records, assessment
Developers	Secure development, vulnerability handling	Role-based	Yearly	Records
Incident responders	Incident procedure, 24h and 72h reporting	Exercise	Yearly	Exercise report
Critical suppliers	Awareness, skills required by contract	Contract clause	Per contract	Contract, attestation

NIS2 training record template

NIS2 TRAINING RECORD
Entity:                              Period:
Basis: NIS2 Art. 20(2) / Art. 21(2)(g); national law ref: ________

SESSION
  ID and date:
  Title:
  Audience: [management body | all staff | role: ____________ ]
  Delivered by: [internal: name | external: organisation]
  Format: [in person | online | e-learning | exercise]
  Duration:
  Topics (link to agenda or materials):
  Risks and policies addressed:

ATTENDANCE
  Name | Role | Mgmt body member (Y/N) | Attended (Y/N) | Date

EFFECTIVENESS
  Method: [quiz | exercise debrief | simulation result | none]
  Result:
  Follow-up actions | Owner | Due date:

REVIEW
  Reviewed by:                         Date:
  Next session due:

What the training requirement leaves open

The law sets a purpose and no test, which moves the burden to your evidence. A certificate from a generic course proves attendance, not that the board can “assess cybersecurity risk-management practices”. Stronger evidence is a board minute showing members questioned the risk register and decided something, and the report from their exercise.

For staff, completion rates are the weakest evidence. The sharper questions: was every joiner trained before getting access, has everyone with administrator rights had role-based training, did anyone report the last phishing wave. The answers sit in the HR system, the identity provider, the training tool and the ticketing system, and they drift apart within weeks.

Checked by hand once a year, the records describe a company that has since changed. Reconciled continuously against the people and privileged accounts that exist, with a person reviewing the exceptions, they answer the question as asked. That is the approach of the CloudSoul platform, an automated platform with human-in-the-loop expertise. The wider programme is on the NIS2 compliance page.

NIS2 training checklist

• Confirm who counts as the management body under your national law.
• Hold a first management session tied to your own risks and measures, and minute it.
• Put cyber hygiene and incident reporting into onboarding for every joiner.
• Identify roles that need security skills and give them role-based training.
• Train staff who move into those roles at the change.
• Keep a record per session: audience, topics, attendance, effectiveness.
• Check your national law and authority guidance for hours or frequency.
• Review the programme yearly against incidents and threat changes.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 6, 20, 21, 23, 32, 33, 34 and 36 and recital 89, EUR-Lex.
• Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, Annex points 5.1.4(b), 8.1 and 8.2, EUR-Lex.
• Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2, 8 July 2026, European Commission.
• BSI, Handreichung für die Empfehlung zur Schulungspflicht für Geschäftsleitungen wichtiger Einrichtungen und besonders wichtiger Einrichtungen nach dem BSI-Gesetz, 17 April 2026, bsi.bund.de.
• ISO/IEC 27001:2022, clauses 7.2 and 7.3 and Annex A control 6.3, ISO.

Frequently asked questions