What training does NIS2 require of management bodies and staff?

NIS2 contains two training obligations: a personal training requirement for members of management bodies in Article 20(2), and an organizational requirement in Article 21(2)(g) to implement basic cyber hygiene practices and cybersecurity training. As at September 2026, both apply through national transposing laws across the EU.

Article 20(2) of Directive (EU) 2022/2555 reads: "Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity."

Article 21(2) then lists ten minimum cybersecurity risk management measures. Point (g) is "basic cyber hygiene practices and cybersecurity training". Point (i), human resources security, access control policies and asset management, also shapes who needs what training. Recital 89 gives examples of cyber hygiene, including user awareness and training on cyber threats, phishing and social engineering. These measures sit inside a wider compliance training program rather than replacing it.

Because NIS2 is a directive, organizations must comply with their national law, not with the directive text directly. An EU regulation, such as DORA or the GDPR, is binding in its entirety and directly applicable in every Member State from its application date. A directive sets results that each Member State must achieve through its own legislation, a process called transposition, and national laws can add detail or go further.

Article 41 of NIS2 required Member States to adopt and publish transposing measures by October 17, 2024 and to apply them from October 18, 2024. For readers outside the EU, the practical effect is that a group operating in several Member States may face slightly different training, registration, and reporting rules in each one, all traceable back to the same Article 20 and Article 21.

Many Member States missed the deadline. The European Commission's NIS2 transposition page records that on May 7, 2025 it sent reasoned opinions to 19 Member States, including Portugal, for failing to notify full transposition, and the Commission has since referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union.

Portugal transposed NIS2 through Decree-Law 125/2025, published on December 4, 2025, which approves the new Regime Jurídico da Cibersegurança (Cybersecurity Legal Regime). Under Article 11 of the decree-law it entered into force 120 days after publication, on April 3, 2026, and Article 9 revokes the earlier framework under Law 46/2018. The national cybersecurity authority is the Centro Nacional de Cibersegurança (CNCS).

Article 25 of the regime requires the management, direction, and administration bodies of essential and important entities to approve the cybersecurity risk management measures, supervise their implementation, and ensure that cybersecurity training is carried out at regular intervals to promote an internal culture of cyber risk management. Office holders can answer for acts or omissions committed with intent or gross negligence (Article 25(2)), and fines for an essential entity that is a legal person can reach 10 million euros or 2% of worldwide annual turnover, whichever is higher.

The list of cybersecurity measures in Article 27(1), which includes basic cyber hygiene and cybersecurity training for top management and workers, only takes effect 24 months after the CNCS publishes the implementing regulations (Article 10(2) of the decree-law).

The Portuguese regime covers 17 sectors (Annexes I and II) and a significant part of public administration, and covered entities must identify themselves on an electronic platform provided by the CNCS (Article 8). For financial entities, Article 15 designates the Banco de Portugal, the Comissão do Mercado de Valores Mobiliários, and the Autoridade de Supervisão de Seguros e Fundos de Pensões as special national cybersecurity authorities for digital operational resilience matters.

Management bodies must approve the Article 21 cybersecurity risk management measures, oversee their implementation, and can be held liable for the entity's infringements of Article 21 (Article 20(1)). Training is the mechanism that makes this accountability credible: a board cannot oversee measures it does not understand.

Enforcement is set by national law within minimums in NIS2. Article 34 requires maximum fines of at least 10 million euros or 2% of total worldwide annual turnover for essential entities, and at least 7 million euros or 1.4% for important entities, whichever is higher. For essential entities, Article 32(5) allows authorities, as a last resort, to request a temporary prohibition on a natural person at chief executive officer or legal representative level from exercising managerial functions.

Yes, for certain digital sectors. Commission Implementing Regulation (EU) 2024/2690 sets detailed Article 21 requirements for DNS service providers, TLD name registries, cloud computing, data center, content delivery network, managed service and managed security service providers, online marketplaces, search engines, social networking platforms, and trust service providers. Section 8 of its annex covers cyber hygiene and security training, and is a useful benchmark for other sectors.

• Point 8.1.2: an awareness raising program for employees, including members of management bodies, and for direct suppliers and service providers where appropriate, scheduled so activities are repeated and cover new employees.
• Point 8.1.3: the awareness program is tested for effectiveness where appropriate and updated at planned intervals as threats change.
• Point 8.2.1: identify employees whose roles require security relevant skills and ensure they receive regular training.
• Point 8.2.3: role training must be relevant to the job function and its effectiveness must be assessed; it covers secure configuration and operation, known cyber threats, and behavior when security relevant events occur.
• Point 8.2.4: staff moving into roles that need security skills are trained on transfer.

Supervisors look for proof that directors actually gained the knowledge Article 20(2) describes and that staff training matches roles and risks, not only attendance lists. The table below is an illustrative mapping from each obligation to a learning outcome and the evidence that would support it.

A training matrix that links each role to its required modules and refresh cycle makes this evidence easy to produce. The guides on reporting training compliance to the board and preparing training records for an audit cover the mechanics.

No change to Article 20 or Article 21(2)(g) has been adopted as at September 2026. On January 20, 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), which it describes as simplifying jurisdictional rules, streamlining ransomware data collection, and facilitating supervision of cross-border entities, complementing a single entry point for incident reporting proposed in the Digital Omnibus. These are proposals and still need agreement by the European Parliament and the Council.

Knowledge Foundry models the NIS2 obligations, the national transposing provisions, and role competencies as linked objects with defined assessment points. Board training, staff awareness, and role based security training then trace back to Article 20 and Article 21, and the same concepts can be mapped to DORA or ISO/IEC 27001 where an entity is subject to both.