Security Awareness Training Platform or Policy Template? 13 NIS2 Training Requirements and Which One Proves Each

Short answer: neither one passes an NIS2 audit on its own, and they don’t compete for the same job. A security awareness training platform proves that training was delivered. A training policy or plan proves that the programme was designed — for your roles, your policies and your suppliers — and that someone reviews it. NIS2 auditors test both halves.

We split the training section of the binding technical rules (Annex point 8 of Commission Implementing Regulation 2024/2690) into 13 separately testable requirements and asked, for each one, what can actually prove it. A platform alone covers 2. Five need platform data plus a decision you document. The remaining 6 can only come from your own documents and decisions — no vendor dashboard produces them. The full map is below, followed by the four gaps buyers most often assume a platform closes.

One disclosure up front: we sell templates, so weigh our view with that in mind. Our own map hands platforms the delivery rows outright, and for most organisations above a few dozen staff we’d recommend buying one.

Does Annex 8 apply to you? Scope first

In plain terms: every NIS2 entity has to train its staff and its management. Only eleven types of digital-sector entity are bound by the detailed Annex 8 wording. Everyone else is judged against their national law, where the Annex is a sensible reference but not the legal test.

The training duty itself comes from two places in the Directive. Article 21(2)(g) lists “basic cyber hygiene practices and cybersecurity training” among the minimum risk-management measures. Article 20(2) requires that members of management bodies “are required to follow training” — and only encourages entities to offer similar training to employees. The detailed technical requirements were then set by implementing regulation under Article 21(5), which names the entity types they cover.

Your organisation	Training obligation	Is Annex 8 the legal test?
DNS service provider, TLD registry, cloud, data centre, CDN, managed service provider, managed security service provider, online marketplace, search engine, social network platform, trust service provider	Article 21(2)(g) + Article 20(2), as transposed	Yes — Annex 8 is binding text for these “relevant entities”
Any other essential or important entity (energy, health, manufacturing, transport and so on)	Article 21(2)(g) + Article 20(2), via your national law	No — national rules apply; Annex 8 is a reasonable benchmark
Not in NIS2 scope, but supplying an entity that is	None directly	No — but your customer’s contract may impose training requirements (see gap 1 below)

A quick way to place yourself:

1. Are you one of the eleven entity types in the first row? Yes → map every one of the 13 requirements below; an auditor can cite each point number. No → go to step 2.
2. Are you an essential or important entity under your country’s transposition? Yes → you must show Article 21(2)(g) training is appropriate and proportionate. The Annex is the most detailed public yardstick, and ENISA says its guidance “may be considered useful” beyond the relevant entities. No → go to step 3.
3. Do NIS2-regulated customers buy from you? Yes → expect training clauses in contracts and supplier questionnaires. No → NIS2 does not reach you directly.

What an auditor is empowered to ask for

In plain terms: supervisors can demand your documented policies, not just your data. That is the structural reason a platform export never closes a file on its own.

For essential entities, Article 32(2) gives competent authorities “regular and targeted security audits carried out by an independent body or a competent authority” and “requests for information necessary to assess the cybersecurity risk-management measures … including documented cybersecurity policies”. Article 33(2) gives the same request power for important entities, but Article 33(1) frames its use as ex post — when the authority is provided with “evidence, indication or information” that the entity allegedly does not comply. Infringing Article 21 carries maximum fines of at least the amounts set in Article 34:

Entity	Maximum fine for an Article 21 infringement (at least)	Provision
Essential	€10,000,000 or 2% of total worldwide annual turnover, whichever is higher	Article 34(4)
Important	€7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher	Article 34(5)

In practice, a training gap on its own is unlikely to draw a maximum fine. The more realistic outcome is an audit finding that names a missing programme element, followed by an instruction to fix it. ENISA’s Technical Implementation Guidance shows what auditors will reach for. Its “examples of evidence” under the training points fall into three kinds: a programme outline “detailing its objectives, content, frequency, syllabus and schedule”; the materials themselves; and “logs, sign-in sheet, certificates of completion or acknowledgements”. A platform produces the third kind well, part of the second, and none of the first. (The guidance is explicitly non-binding — ENISA calls it recommendations — but it is the closest thing to a published audit script.)

For the full control list an assessor works through, see our 22-control NIS2 training audit checklist.

The 13 Annex 8 requirements, and what can prove each one

In plain terms: “Platform” means a vendor dashboard export is the primary proof. “Shared” means the platform supplies the data but you must record a decision around it. “You” means only your own documents, decisions and records can prove it.

The quoted wording is the Annex text, binding on the relevant entities in the first scope row. The verdict column is our analysis, not ENISA’s or a regulator’s — it reflects how off-the-shelf platforms typically work, and an unusually configurable platform can move a row from “You” to “Shared”.

#	Annex point and requirement	What a platform can show	What only you can produce	Proof
1	8.1.1 — employees “are aware of risks … and apply cyber hygiene practices”	Completion, quiz and simulation results	Your judgement that the results show behaviour, not attendance	Shared
2	8.1.2 — programme offered “to all employees, including members of management bodies”	Per-user enrolment and completion logs	A periodic check of the user list against the HR headcount	Platform
3	8.1.2 — offered to “direct suppliers and service providers where appropriate in accordance with point 5.1.4”	Guest seats, if licensed	Which suppliers, why, and the contract clause behind it	You
4	8.1.2(a) — “scheduled over time, so that the activities are repeated and cover new employees”	Campaign schedule, automatic new-joiner enrolment	—	Platform
5	8.1.2(b) — “in line with the network and information security policy, topic-specific policies and relevant procedures”	Nothing — a generic library doesn’t know your policies	A mapping from modules to your own policies	You
6	8.1.2(c) — covers “risk-management measures in place, contact points and resources … as well as cyber hygiene practices”	Generic hygiene modules	Content on your controls, your reporting contacts	Shared
7	8.1.3 — “where appropriate, be tested in terms of effectiveness”	Quiz scores, simulation report rates	The method chosen, and the “where appropriate” reasoning	Shared
8	8.1.3 — “updated and offered at planned intervals taking into account … the current threat landscape”	Vendor content release notes	Your own dated review record	You
9	8.2.1 — “identify employees, whose roles require security relevant skill sets and expertise”	Nothing	A role analysis	You
10	8.2.2 — a programme that “lays down the training needs for certain roles and positions based on criteria”	Role-based assignment rules, once you define them	The criteria and the role-to-need matrix	You
11	8.2.3 — “relevant to the job function” and “its effectiveness shall be assessed”; covers secure configuration of your systems, known threats, behaviour when security events occur	Known-threat briefings, assessments	Instructions for your own systems and your incident-reporting route	Shared
12	8.2.4 — training for “staff members who transfer to new positions or roles”	Completion logs, if it is told about the move	The HR trigger that detects a role change	Shared
13	8.2.5 — programme “updated and run periodically taking into account applicable policies and rules, assigned roles, responsibilities”	Nothing on its own	A dated review of the programme against roles and threats	You

Tally: Platform 2, Shared 5, You 6. Management training under Article 20(2) sits outside Annex 8 but follows the same pattern — a platform can log a director’s course completion, but the record that each named member of the management body was trained, and on what, is yours to keep. Our board training guide covers that file.

What a platform does well — and the click-rate trap

In plain terms: buy a platform for scale, scheduling and clean logs. Don’t buy one expecting its phishing click rate to prove effectiveness.

Rows 2 and 4 are where spreadsheets fail first. Keeping 300 people on a repeating schedule, catching every new joiner and producing timestamped per-user records is tedious by hand and trivial for software. Those are also the records ENISA lists most often as evidence. For an IT or security manager, that alone usually justifies the licence once headcount passes the point where one person can’t track completions manually.

Effectiveness is where the dashboard misleads. Annex 8 treats it differently for the two programmes. Point 8.1.3 says the general awareness programme shall “where appropriate” be tested for effectiveness. Point 8.2.3 says the role-based training’s “effectiveness shall be assessed” — with no hedge. ENISA’s guidance suggests “quizzes or real scenarios” and points to the KPI rules in Annex point 7.2, which require you to decide what is measured, how, when and by whom. That decision is a document, not a dashboard setting.

The evidence base also argues against treating click rate as the answer. A study of 19,500 UC San Diego Health employees over eight months, reported by UC San Diego, found “no significant relationship” between recently completing annual training and falling for phishing. Embedded training cut the likelihood of clicking by only about 2%, in the university’s summary, and 75% of users spent a minute or less on the embedded material. We unpack what that means for budgets in our security awareness ROI analysis. For audit purposes, the lesson is narrower: report rates, quiz results by role and a written note on what you changed because of them are stronger evidence than a falling click-rate line.

Four gaps no platform closes on its own

In plain terms: these are the “You” rows. If your file has no answer for them, an auditor will find the gap however good your completion rate is.

1. Suppliers and service providers

Point 8.1.2 extends the awareness programme to “direct suppliers and service providers where appropriate in accordance with point 5.1.4”. Point 5.1.4(b) is the contract side: supplier contracts must specify, where appropriate, “requirements regarding awareness, skills and training and where appropriate certifications, required from the suppliers’ or service providers’ employees”. Most platforms license seats for your employees only. The evidence an auditor wants is a decision — which suppliers, on what risk basis, trained by whom — and a matching clause. We cover the clause wording in our supplier contract clauses guide. For an SME owner, this is often the cheapest gap to close: one paragraph in the plan and one clause in the next contract renewal.

2. Alignment with your own policies

Points 8.1.2(b) and (c) require a programme “in line with” your security policy and topic-specific policies, covering your “contact points and resources”. A library module on password hygiene does not tell staff that your policy requires a hardware key for admin accounts, or who to call when something looks wrong. The fix is a short mapping in your training plan from each module to the policy it supports, plus at least one piece of internal content: who to contact, how to report, what your controls are.

3. Role analysis and training needs

Points 8.2.1 and 8.2.2 start with a decision: which roles need security skills, and what each one needs “based on criteria”. Administrators, developers and people in high-exposure roles typically need training a general awareness library doesn’t include. ENISA suggests external courses, certifications and its European Cybersecurity Skills Framework, which defines 12 cybersecurity role profiles. For a CISO, the role-to-need matrix is the document that turns training spend into a defensible allocation. Point 8.2.4 then needs a trigger: when HR records a move into one of those roles, the new training is assigned. A platform only sees the move if it is integrated with your HR system — otherwise, someone has to tell it.

4. The review record

Points 8.1.3 and 8.2.5 require the programmes to be updated at planned intervals, taking into account threats, roles and policy changes. Your vendor refreshing its content library is not your review. ENISA’s guidance suggests reviewing both programmes “at least annually” — a recommendation, not a binding interval, since the Annex itself sets none. What a compliance officer needs on file is a dated record: what was reviewed, against what, what changed, and who approved it. The training policy template guide sets out the five fields that record should sit inside.

Which do you need? A decision by situation

In plain terms: everyone needs the document layer. Whether you also need a paid platform depends mostly on headcount and how many roles need tracking.

Situation	Recommended setup	Why
Small important entity, one person runs compliance	Training policy and plan + tracker spreadsheet + free material (ENISA’s AR-in-a-Box has an SME version, a quiz and KPI guidance)	Rows 2 and 4 are manageable by hand at this size; the six “You” rows are needed regardless
Mid-sized entity, a few hundred staff, several security-relevant roles	Plan and role matrix first, then a platform configured to them	Scheduling and logs become impractical by hand; role rules must exist before the platform can apply them
Annex 8 “relevant entity” (MSP, cloud, data centre and so on)	Platform + full document set mapped point-by-point to 8.1.1–8.2.5 + supplier clauses	The auditor can cite each point number; 8.2.3 effectiveness is unhedged
Board or management body	Separate Article 20(2) training record per member	Mandatory for management; keep it apart from the staff log

Price ranges for each route are compared in our NIS2 training cost comparison. If you do buy a platform, ask the vendor these six questions. Each maps to a row above:

1. Can we export per-user completion records with timestamps, including for leavers? (rows 2, 4)
2. Does it sync with our HR system so that new joiners and role changes trigger assignments automatically? (rows 4, 12)
3. Can we upload our own content — policies, reporting contacts — and track it like library modules? (rows 5, 6)
4. Can assignments follow role rules we define, rather than one curriculum for everyone? (rows 10, 11)
5. Can we export quiz and simulation results by role, including report rates rather than only click rates? (rows 7, 11)
6. Can we license guest seats for supplier staff, and at what cost? (row 3)

Treat “NIS2-compliant” on a vendor page as marketing. NIS2 does not certify training products, and compliance belongs to the entity, not the tool.

Frequently asked questions

Is a security awareness training platform required for NIS2?

No. Article 21(2)(g) requires cyber hygiene practices and cybersecurity training, and Annex 8 describes the programme. Neither names a delivery method. ENISA’s guidance lists workshops, webinars, e-learning and internal communications as formats. A platform is a delivery and record-keeping choice, justified by scale.

Will platform completion certificates satisfy an auditor?

They satisfy the attendance part of the evidence — ENISA lists “certificates of completion” as an example. They do not show role analysis, policy alignment, supplier coverage or programme review, which are separate Annex 8 requirements.

How often must the training programme be reviewed?

The Annex says “at planned intervals” (8.1.3) and “periodically” (8.2.5) without fixing a number. ENISA’s guidance recommends at least annually. Whatever interval you choose, write it into your plan and keep a dated record each time you complete a review.

Do directors complete the same training as staff?

They can attend staff awareness training, but Article 20(2) sets a separate requirement: training that lets management “identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”. Keep that record separate from the general staff log. Our NIS2 training requirements guide covers both obligations in depth.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

1. Directive (EU) 2022/2555 (NIS 2 Directive) — EUR-Lex, OJ L 333, 27.12.2022.
2. NIS 2 Directive, Article 20 — Governance (nis-2-directive.com, primary text).
3. NIS 2 Directive, Article 21 — Cybersecurity risk-management measures (nis-2-directive.com, primary text).
4. Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 — EUR-Lex. Annex points 5.1.4, 7.2 and 8.1.1–8.2.5.
5. Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0 — ENISA, June 2025.
6. AR-in-a-Box — ENISA.
7. European Cybersecurity Skills Framework (ECSF) — ENISA.
8. “Cybersecurity Training Programs Don’t Prevent Employees from Falling for Phishing Scams” — UC San Diego Today, reporting a paper presented at the 46th IEEE Symposium on Security and Privacy, 2025.
9. NIS 2 Directive, Articles 32 and 33 — Supervisory and enforcement measures (nis-2-directive.com, primary text).
10. NIS 2 Directive, Article 34 — General conditions for imposing administrative fines (nis-2-directive.com, primary text).