The training requirement, explained.
Of the ten security measures NIS2 demands, training is the one that names people rather than systems. This page sets out exactly who must be trained, what the law means by regular, and what an auditor expects to find in the file.
Two sentences, one in each article.
The training obligation is not buried in an annex. It appears twice in the main text: once as a duty on management, once as a required security measure.
Members of the management bodies of essential and important entities are required to follow training, and entities are encouraged to offer similar training to their employees on a regular basis, so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.
Paraphrased from the directive text. The original is one sentence longer and says the same thing.
The measures every entity must take include basic cyber hygiene practices and cybersecurity training.
Seventh of the ten measures. The only one a supervisor can test by talking to a random employee.
Three groups, three different strengths of duty.
The management body
Board members, the managing director, whoever approves and oversees the security measures. The obligation sits on them personally, and it is the one an authority checks first because it is the easiest to verify: either there is a record for these named people or there is not.
Employees
The directive tells member states to encourage this. Several national laws, Sweden's among them, make it a duty on the employer to offer it. Either way, a company that cannot show a staff programme has a hard conversation ahead when a customer or a supervisor asks.
Suppliers to entities in scope
Not a legal duty on you directly. A contractual one, arriving as a questionnaire from the customer whose own compliance depends on your controls. The question about staff training is always on it.
The law gives no interval. Auditors have a preference anyway.
Neither the directive nor most national laws say how often. What they say is regular, and what supervisors look for is continuity: evidence that training is a process running through the year rather than an event that happened once in it. These four contrasts are where most programmes are judged.
A register with six columns.
Certificates on a wall are decoration. The document that satisfies a supervisor, an insurer or a customer's procurement team is a register: a table that names people, dates and outcomes, produced by whoever delivered the training and verifiable by a third party.
For companies that cannot hold names on staff, a works council or a public-sector rule for example, the register works on employer-assigned identifiers instead. The evidence is the same; the mapping to people stays with the employer.
- 01Name or employer-resolvable identifier, and role
- 02Modules completed, with dates
- 03Score, and whether the pass mark was met
- 04Management body listed separately, with dates
- 05Non-completion: who, and what was done about it
- 06Issuer, date of record, and a way to verify it
The training is already here. The register is being built.
Public training path
Eight blocks, three checkpoint exams, an earned certificate with a verification code. Any employee can complete it today with no account.
Start the pathCompany programme
Twelve monthly practice rounds by private link, role-based tracks, a management module, simulated campaigns and the six-column register above, produced per company. Early clients are taken on by hand.
For teamsExposure check
Before training anyone, see what an attacker already knows: whether your domain can be spoofed, which addresses have leaked, and which look-alike domains exist. One page, two working days.
Order itA certificate from any provider, this one included, is evidence that training took place. Whether it satisfies your supervisor depends on your national law and your classification. Keep the register, not just the certificate.
See what an attacker sees before they use it.
Tell us the domain. You get one page on what is publicly exposed around your company, at a fixed price, within two working days. No call, no demo, no subscription.
Plain-language summary of Directive (EU) 2022/2555, Articles 20 and 21, and of the Swedish transposition. Not legal advice.