NIS2 training

NIS2 cybersecurity training: management responsibility and employee awareness

Article 20 of the NIS2 Directive requires Member States to ensure that management bodies of essential and important entities follow training, and to encourage those entities to offer similar training to employees regularly. The exact national obligations depend on the Member State’s transposition.

Quick answers

Does NIS2 require management training?

Yes. Article 20(2) requires Member States to ensure that members of management bodies of essential and important entities follow training so they can identify risks and assess cybersecurity risk-management practices and their impact.

Does NIS2 also address employees?

Yes. The Directive says Member States shall encourage essential and important entities to offer similar training to employees on a regular basis.

Does NIS2 prescribe a Bestehia test?

No. NIS2 does not prescribe a particular vendor or knowledge-check format. A reviewed knowledge check can complement a wider cybersecurity training programme.

How to proceed

  1. 1. Check whether the entity is in scope

    Confirm the national classification as an essential or important entity and any sector-specific rules.

  2. 2. Define training content

    Use approved cyber-risk, incident, access-control and internal-policy material suited to the roles being trained.

  3. 3. Review generated questions

    Cybersecurity owners or trainers approve questions before participants see them.

  4. 4. Use results as an additional signal

    Results can reveal knowledge gaps, but they do not replace the training duty or national compliance documentation.

What Article 20 actually says

  • Management bodies have governance responsibility for cybersecurity risk-management measures.
  • Members of management bodies must follow training under national implementation.
  • Regular employee training is expressly encouraged by the Directive.

National law still matters

NIS2 is a directive. The concrete legal obligation, scope, timing and evidence requirements must be checked in the implementing law of the relevant Member State.

Bestehia can support training and instruction with a reviewed knowledge check and documented results. It does not replace legally required training, practical instruction, attendance or identity verification, certification, or legal advice.

Frequently asked questions

Does NIS2 apply to every SME?

No. Scope depends on sector, size and specific inclusion rules. Some entities can also be covered irrespective of ordinary size thresholds.

Is annual training mandatory everywhere?

The Directive itself does not create one universal annual timetable for all entities. National law and the organisation’s risk-based programme must be checked.

Can a score be used as the only proof?

It should not be treated as the sole legal proof unless the applicable national rules and the organisation’s compliance process support that conclusion.

Author: Jürgen Schuster · Updated: 23 September 2026

Sources