YTYK You think you know

Card 9 of 18 Governance — who signs ●○○ Foundational

The training duty reaches the board

Members of the management body are required to follow training in order to identify risks and assess cybersecurity practices, and entities are required to offer similar training to their employees on a regular basis.

Why it is like this

A board cannot meaningfully approve measures it does not understand. The training duty is what makes the approval duty more than a signature.

Not to be confused with

An awareness campaign. The obligation on the board is specifically to be able to *identify risks and assess management practices* — judgement, not phishing drills.

In practice

A half-day session for the management committee on the entity's own risk picture, minuted, is the common first deliverable of a NIS2 programme — and it is usually the cheapest line in it.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 20(2). Read on .

Odd one out Check yourself

Which of these is *not* something Article 20(2) requires?

  1. Management body members follow cybersecurity training
  2. Employees are offered similar training on a regular basis
  3. Training enables managers to identify risks and assess practices
  4. Training is certified by the national competent authority
Show the answer

Training is certified by the national competent authority

There is no certification requirement for the training. The article requires that it happen, regularly, and that it be adequate to identify and assess risk.