NIS2: mandatory training for management bodies

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union — NIS2 for short — replaced the first NIS Directive and greatly widened the circle of organisations in scope. Member States had to transpose it by 17 October 2024 (Article 41).

It covers entities in the sectors of Annex I (sectors of high criticality, such as energy, transport, banking, health and digital infrastructure) and Annex II (other critical sectors, such as postal services, waste management, chemicals, food, manufacturing of certain goods, digital providers and research). As a rule it applies to medium-sized and large enterprises in these sectors; certain entities are covered regardless of size (Article 2). The directive distinguishes essential and important entities (Article 3), mainly for supervision and fines.

Germany transposed the directive after the deadline; the BSI Act (BSIG) was recast for this purpose and speaks of “particularly important” and “important” entities. Section 38 BSIG sets out management's duties to implement, oversee and train. Whether an organisation is in scope follows from the BSIG's provisions on scope; the Federal Office for Information Security provides guidance.

Article 20(1) requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation and be capable of being held liable for infringements. Cybersecurity thus becomes expressly a board-level matter.

Article 20(2) adds that Member States shall ensure that members of management bodies are required to follow training, and shall encourage entities to offer similar training to their employees on a regular basis. The aim is sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.

The wording is notable: for management, participation is mandatory; for other staff, the directive uses encouragement. But Article 21(2)(g) makes basic cyber hygiene practices and cybersecurity training a minimum risk-management measure — so in practice no entity in scope can avoid training for everyone.

The directive names the goal, not the curriculum. Training for executives and boards need not produce technicians; it must enable them to understand risks, assess measures and own decisions. That distinguishes it from awareness training for all staff.

For other staff the focus is cyber hygiene: recognising phishing, strong passwords and multi-factor sign-in, handling mobile devices and data securely, reporting suspicious events. Short, recurring units work well, complemented by exercises such as simulated phishing emails — whose use should be agreed with data protection and, where one exists, the works council.

Certain roles merit deeper modules: IT administration, development, procurement with a view to the supply chain, and everyone who makes decisions during an incident. Training should be embedded in risk management and its effectiveness assessed regularly, as Article 21(2)(f) provides for all measures.

Under Articles 32 and 33, supervisory authorities can require evidence of implementation — for essential entities even without a specific trigger. A training record for each member of management and an overview of staff training therefore belong in the risk-management documentation.

Article 34 sets the framework for fines: for essential entities a maximum of at least EUR 10 million or 2 percent of worldwide annual turnover, for important entities at least EUR 7 million or 1.4 percent — whichever is higher. National law sets the actual maximums.

For the financial sector, Regulation (EU) 2022/2554 (DORA) takes precedence; under Article 4, NIS2 gives way where sector-specific acts impose equivalent requirements.

This article explains the law in general terms and is not legal advice. For any individual case, the official text in its current version prevails; if in doubt, consult a lawyer, your data protection officer or the competent supervisory authority.