NIS2 and security awareness: what the law requires and how you prove it

TL;DR

• NIS2 lists basic cyber hygiene and cybersecurity training as required measures (Article 21) and obliges the management body to follow training itself (Article 20).
• The directive sets no format, frequency or vendor. A supervisor or auditor checks whether training is regular, reaches everyone and leaves a trace.
• The trace is a small set of records: a programme on one page, attendance per group, simulation results over time and a reporting route people actually use.
• A company of 50 to 500 people can build that in four quarters without a compliance department.
• An annual e-learning on its own meets the letter badly and the spirit not at all.

If your company falls under NIS2, or supplies one that does, someone will ask you to show what you do about the human side of security. Most companies then dig up a certificate from an e-learning platform and hope that is enough. It usually is not, and this post explains why. We cover what Articles 20 and 21 actually say about training, how Belgium turned that into law, and which five records an auditor or a large customer wants to see. We also give a four-quarter order to build those records if you start from nothing. Sectricity runs the training side of this through its security awareness programme and the technical side through the NIS2 pentest package; this post is about the paperwork in between, so you know what to ask of any provider, including us.

What NIS2 says about security awareness

Article 21(2) of Directive (EU) 2022/2555 lists the minimum risk management measures, and point (g) names basic cyber hygiene practices and cybersecurity training; point (i) adds human resources security. Article 20(2) requires members of the management body to follow training and asks entities to offer similar training to employees on a regular basis. Our NIS2 explainer covers the rest of the directive.

How Belgium and the Netherlands apply it

Belgium transposed NIS2 with the law of 26 April 2024, in force since 18 October 2024, with the Centre for Cybersecurity Belgium (CCB) as the authority and the CyberFundamentals framework as the practical yardstick, which has its own category for awareness and training. In the Netherlands the Cyberbeveiligingswet carries the transposition; check the current status with the NCSC before you rely on a date.

Who has to care

Essential and important entities in the listed sectors have the duty directly. Their suppliers get it indirectly, through contract clauses and questionnaires, which is why a 60 person IT firm or a logistics company outside the scope still ends up answering the same questions.

What "regular training" means in practice

The directive gives no number. In practice supervisors and auditors read it as training at onboarding, a refresh at least yearly, extra sessions for roles with money or admin rights, and a separate record for management.

The evidence an auditor actually looks for

A programme on one page

Who owns awareness, which groups exist (all staff, finance, IT, management, new starters), what each group gets and when. One page beats a 40 slide policy nobody reads.

Attendance and coverage per group

A list per session with date, group and who attended, plus a line on how absentees catch up. The gap auditors find most often is management and new hires.

Results over time

A baseline measurement and at least one later one, usually a phishing simulation with click rate and report rate. Keep training and measurement apart: Swishing trains the moment of decision, a phishing test measures it, and the training guide explains which numbers mean something.

A reporting route people use

Where staff report a suspicious email or a mistake, who picks it up and how fast. A screenshot of the button and three recent tickets say more than a procedure.

Management involvement

A record that the management body followed training and a line in the minutes where they discussed the results. Article 20 makes this personal; a short awareness programme for management covers it in half a day.

A four-quarter plan for 50 to 500 employees

Quarter one: baseline and ownership

Name an owner, write the one page programme, run a first simulation without announcing it as a test.

Quarter two: everyone trained once, management first

Management goes first so the record exists and so the rest of the company sees it. Then all staff, in groups small enough to ask questions.

Quarter three: role-based sessions and a second measurement

Finance, HR and IT get a session on their own cases. Repeat the simulation and compare with the baseline.

Quarter four: review and the evidence file

Put the five records in one folder, review what changed, and plan year two. That folder is what you hand over when the question comes.

Common gaps auditors flag

Management skipped the training. New hires joined after the session and were never caught up. No baseline, so nobody can show change. A vendor certificate presented as proof of behaviour. No link between awareness and the incident process.

Where ISO 27001 and NIS2 overlap

ISO/IEC 27001 asks for awareness, education and training in control A.6.3, and the same five records serve both. If you already hold the certificate, the awareness part of NIS2 is mostly a matter of adding management and the reporting route; the technical side is covered in our NIS2 pentest checklist.

Frequently asked questions about NIS2 and security awareness

Is security awareness training mandatory under NIS2?

Yes, for essential and important entities. Article 21(2)(g) names cybersecurity training and basic cyber hygiene as required measures, and Article 20 obliges the management body to follow training. The directive does not say how, which is why the evidence matters more than the format.

How often does NIS2 require security awareness training?

The directive says "regular" and leaves the number to member states and supervisors. In practice that reads as training at onboarding, a refresh at least once a year, and more often for roles that handle payments or admin rights. Pick a rhythm, write it in the programme and keep to it.

Does the management board need to follow training too?

Yes, and this is the part most companies miss. Article 20(2) requires members of the management body to follow training so they can assess risks and management practices. A half day session for the board, with a signed attendance record, closes that gap; our management session is built for it.

What evidence do I need for NIS2 awareness training?

Five records cover almost every question: the one page programme, attendance per group, a baseline and a later measurement, the reporting route with recent examples, and the management record. Keep them in one folder with a date on each. An auditor spends ten minutes on a tidy folder and an afternoon on a messy one.

Does a phishing simulation count as training?

A simulation is a measurement. It shows how many people click and how many report, which is the number you need for the evidence file. Training is what happens before and after: a session, a game like Swishing, a day in the Security Awareness Escape Truck. You need both, and they should not be confused in the records.

We are not in scope of NIS2. Does this still matter?

If one of your customers is in scope, their supplier questionnaire will ask the same questions, because Article 21 makes supply chain security their duty. Having the five records ready is cheaper than answering each questionnaire from scratch. If you are unsure whether you are in scope, contact us and we will look at it with you.

Related services and resources

Start with what security awareness is if the term is new to you, then read the training guide for the programme itself and the post on a security-aware culture for the long run. Sectricity delivers the training through its security awareness programme, the Swishing phishing game and the Security Awareness Escape Truck, and covers the technical side of the directive in the NIS2 pentest package.