NIS2 Introduction Training

What the training consists of

1. 

   1. Who does NIS2 apply to

   1:44

   NIS2 covers essential organisations, such as hospitals and power plants, and important ones, such as recycling companies and research institutions. The first lesson explains both categories, and exceptions such as very small organisations.

2. 

   2. NIS2 minimum requirements

   2:23

   NIS2 sets security measures that every organisation it covers must have, whatever its own risks. The second lesson goes through them, from security policies, checks on suppliers and access control to incident response and a plan to keep the business running.

3. 

   3. NIS2 management obligations

   1:48

   Under NIS2, top management, such as the CEO and board members, is responsible for cyber security, and the last lesson explains what that involves. It also covers reporting incidents to the authorities, and the checks the authorities may make on their own initiative.

Why it matters

Failing to comply with NIS2 can lead to fines for the organisation and personal liability for its top management. The directive aims to strengthen the supply of essential goods and services in the EU against cyber threats, by raising the minimum cyber security standards in the sectors that provide them.

What your colleagues learn

• NIS2 asks slightly different things of essential and important organisations. So it matters to find out which of the two the organisation falls into.
• Each EU country decides who is covered. The official statements of the country where the organisation operates are the place to check whether NIS2 applies to it.
• Compliance starts from the organisation’s own risks. Every organisation faces different IT security risks, so each one identifies its own first and chooses measures that fit them, alongside the ones NIS2 requires of everyone.
• Staff training is one of the required measures. It has to be regular, and employees must also know and follow the organisation’s security rules.
• Top management has to stay involved, not just sign off. That means overseeing whether the measures are in place and working, for example through regular reviews and enough resources, and taking regular cyber security and risk management training.