Loading...
We deliver mandatory NIS2 training across your workforce and management body — Article 20 governance, Article 21 risk-management measures, incident reporting, and supply-chain obligations. Managed rollout, audit-ready evidence. Live for your team in under a week.
Tell us your team size — receive a tailored proposal within 1 business day.
Trusted by Compliance Teams at Leading Organizations
Staff training is your first line of defence — and the first piece of evidence regulators ask for.
NIS2 Article 20(2) explicitly requires essential and important entities to ensure that members of their management body and their employees follow regular cybersecurity training. Article 20(1) makes the management body personally liable for non-compliance. Article 21 mandates a documented set of risk-management measures including awareness training, incident handling, and supply-chain security — all of which require workforce training to operate. Supervisory authorities across EU member states have begun audits and the first fines have already landed.
Article 20(2) — workforce + management body training is a direct legal requirement, not best practice
Article 20(1) — management bodies are personally liable for cybersecurity governance failures, including training gaps
Article 21 — risk-management measures (incident handling, supply chain, encryption, access control) all depend on trained staff
Article 23 — incident reporting within 24 hours; staff must know how to escalate or you miss the window
Curated from our full library and tailored to whether you're an essential or important entity, your sector (Annex I or II), and your headcount — you don't pick modules from a menu, we propose the right curriculum.
NIS2 scope: essential vs. important entities, Annex I vs. Annex II sectors
Article 20 governance: management-body responsibilities and personal liability
Article 21 risk-management measures (the 10 minimum requirements)
Incident handling, classification, and escalation workflows
Article 23 incident reporting — 24-hour, 72-hour, and final report cadence
Supply-chain security & ICT third-party risk
Business continuity, backup, and crisis management
Vulnerability handling, patching, and disclosure
Cryptography, access control, and asset management
Workforce cybersecurity awareness as a NIS2 control
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Dated certificates per learner, exportable completion logs, and management-body training records that meet supervisory authority documentation expectations.
Track completion across teams, departments, and entities. Export evidence packages for supervisory authorities and customer security questionnaires.
SAML 2.0, OIDC, and SCIM provisioning. New joiners enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Multi-year licensing rolls learners forward each year with content updates as member-state transposition guidance evolves.
Your logo on certificates, co-branded learner emails, and the option to attach your incident response plan or vendor risk policy to any module.
We don't sell self-checkout seats to enterprises. We propose a curated curriculum based on your entity classification and sector, manage the rollout, and hand you an evidence package your supervisory authority will accept on the first review.
“NIS2 made annual security training a board-level obligation. The managed rollout meant we hit the deadline without burning internal capacity, and the management-body briefing got our directors aligned in 45 minutes — exactly what Article 20(2) asks for.”
“We operate across multiple member states. The training program handled the rollout per entity, gave us per-entity completion reports, and the supply-chain module slotted straight into our vendor onboarding. Our supervisor accepted the evidence on first review.”