Training for Employees

NIS2 is the second version of the EU’s Network and Information Security directive. It’s a law that sets rules for how organisations in key sectors must protect their digital systems and data. It aims to improve cybersecurity across the EU by making sure ‘essential’ and ‘important’ services – like energy, transport, healthcare, banking, and digital services – take clear steps to prevent cyber incidents, detect them quickly, and recover from them effectively.

NIS2 applies to medium and large companies in ‘essential’ and ‘important’ sectors, basically what is characterized as critical infrastructure.

It also applies to some smaller organisations if they provide critical services or are part of the supply chain for the previously mentioned sectors. If your organisation is in energy, healthcare, digital infrastructure, water, banking, or many more similar sectors, you’re likely in scope.

Find all the sectors covered by the NIS2 in this article.

The minimum requirements of the NIS2 are the following:

• Policies on risk analysis and information system security.
• Incident handling procedures.
• Business continuity planning, including:
  • Backup management
  • Disaster recovery
  • Crisis management
• Supply chain security, covering relationships with direct suppliers and service providers.
• Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure.
• Policies and procedures to assess the effectiveness of cybersecurity risk management.
• Basic cyber hygiene practices and regular cybersecurity training
• Policies and procedures for the use of cryptography and  encryption.
• Human resources security, access control policies, and asset management.
• Use of secure authentication and communication tools, whenever it is appropriate, such as:
  • Multi-factor or continuous authentication.
  • Secured voice, video, and text communication.
  • Secured emergency communication systems.

Risk Management Measures

All organisations must take a structured approach to cybersecurity risk. This includes identifying possible threats, protecting systems, detecting problems early, and being ready to respond and recover. These measures must include the minimum requirements just mentioned above, and cover technical and organisation security measures.

Leadership Accountability

Top management is held directly responsible for cybersecurity, and are made accountable by authorities for serious failures. They must approve security strategies, make sure the right measures are in place, and stay informed through regular training.

Incident Reporting

Organisations must report significant security incidents to the national cybersecurity authority (CSIRT).

NIS2 requires that all relevant staff, including leadership, receive regular and basic cybersecurity training (also called “cyber hygiene”).

For leadership, training is mandatory. Members of the management body must complete relevant courses on managing cybersecurity risks and are expected to promote training across the organisation.

There are no strict format or content rules, but training must match the leadership’s role in assessing risks and overseeing cybersecurity measures. The management team, as a whole, must have the skills to handle cybersecurity responsibilities under NIS2.

Relevant training can include general cybersecurity courses, management workshops, certifications in recognised standards, or internal training made for leadership.

All training activities must be documented, for example with a certificate or written proof of participation.

NIS2 requires that staff receive cybersecurity training that fits their role and responsibilities. All organisations must have a clear policy to ensure employees gain the right knowledge and skills to protect systems and handle digital threats.

Leadership plays a central role in this. They must actively encourage that staff are offered training similar to what management takes. This reinforces that building staff awareness and secure habits is a leadership responsibility.

Training should be practical and easy to apply, and it should cover topics like spotting phishing, handling data securely, using passwords correctly, and knowing what to do in case of an incident. It can be delivered through e-learning, workshops, or internal sessions.

The focus should be on creating a culture where learning and awareness are ongoing. All training activities should be planned, recorded, and followed up on to ensure they are effective.

Because even with strong technology, human error is still one of the biggest risks. Training helps staff spot threats early and act responsibly. For leadership, it’s about accountability. Training shows regulators that the company is serious about security and is taking real steps to reduce risks.

• Identify if the organisation is in scope.
• Appoint a person or team responsible for cybersecurity.
• Review current policies and procedures.
• Fill in any security gaps.
• Set up or improve incident reporting and response plans.
• Start regular cybersecurity training.
• Document everything to show compliance.
• Check with your national cybersecurity authority for local guidance.

NIS2 and GDPR are different EU laws, but they overlap, which means your work on one can support the other. Both require strong security for personal data and systems, and both demand a risk-based approach.

For example, in your GDPR compliance you have mapped personal data flows and the assets used for processing the data, which you can reuse to map the digital assets and processes for NIS2.

Similarly, your risk assessments for personal data protection also feed into cybersecurity risk assessments for delivery of critical services, and your incident response plan under GDPR can form the basis for the NIS2 requirement to detect, report, and respond to security incidents.

It is almost impossible to have GDPR compliance without staff being trained on data protection and information security, and therefore, it already covers security basics like access control and phishing awareness training. This can be expanded to meet NIS2 requirements with little extra effort. Policies around access controls, encryption, and secure communication channels also support both laws.

Your GDPR and NIS2 compliance efforts should definitely be aligned to avoid duplication and reduce cost.