Does NIS2 Require Phishing Simulations? ‘Simulation’ Appears 0 Times in the CIR — 8.1.3 Effectiveness Testing and the GDPR and Works-Council Limits

No provision of NIS2 requires a phishing simulation. We searched the official EUR-Lex texts of the Directive and of Implementing Regulation (EU) 2024/2690, and the word “simulation” appears zero times in either. The actual requirement is narrower. Point 8.1.3 of the regulation’s Annex says the awareness programme “shall, where appropriate, be tested in terms of effectiveness.” A simulated phishing campaign is one way to run that test, and the one with the most legal exposure. Recording who clicked what is processing of employee data under the GDPR. In Germany, Austria and the Netherlands it can also be a monitoring system that needs the works council’s agreement before launch.

Who Is Bound by What: The Short Answer

In plain terms: Whether testing staff is a hard rule or a risk-based choice depends on what kind of organisation you are. Data protection and labour law apply either way.

Who you are	What applies to testing awareness	Status
DNS, TLD, cloud, data centre, CDN, MSP, MSSP, online marketplace, search engine, social network or trust service provider	Annex point 8.1.3 of Regulation 2024/2690 applies directly. If you decide testing is not appropriate, Article 2(2) requires you to document why.	Binding
Every other essential or important entity	Article 21(2)(f) (assessing the effectiveness of measures) and (g) (cyber hygiene and training), as transposed into your national law. The Annex is a strong benchmark, not a binding text.	Risk-based
Public administration entities in NIS2 scope	As above, but GDPR legitimate interest is not available for processing done in the performance of public tasks.	Narrower lawful basis
Any employer with a works council in Germany, Austria or the Netherlands	Co-determination or consent rules for systems capable of monitoring behaviour	Labour-law precondition

The list in the first row comes from Article 1 of the Implementing Regulation 2024/2690. Everyone else reaches the Annex only by analogy, though it remains the most detailed public benchmark. Here is what the two texts say about phishing and testing:

Term	NIS2 Directive	Regulation 2024/2690	Where it sits
“simulation”	0	0	Nowhere
“phishing”	1	2	Directive Recital 89; Regulation Recital 20 (both non-binding)
“tested in terms of effectiveness”	0	1	Annex point 8.1.3 (binding for the provider types above)

Phishing appears only in recitals. Recital 89 of the NIS2 Directive says entities should “raise awareness concerning cyber threats, phishing or social engineering techniques.” Recitals explain intent; they do not create obligations. Phishing is a topic the training should cover, not a test it must pass. Our NIS2 training requirements guide covers the full set of obligations under Articles 20(2) and 21(2)(g).

Point 8.1.3: “Where Appropriate” Is a Documentation Duty, Not an Opt-Out

In plain terms: You choose how to test, and may decide not to, but if the regulation binds you, the decision and its reasons must be written down.

Point 8.1.3 opens: “The awareness raising programme shall, where appropriate, be tested in terms of effectiveness.” Article 2(2) of the regulation adds that where the Annex says “where appropriate” and an entity considers a requirement not appropriate, the entity “shall in a comprehensible manner document its reasoning to that effect.” Skipping the test is allowed. Skipping it silently is not.

Section 8 puts its stricter test elsewhere. Point 8.2.3 says the effectiveness of role-based training for staff in security-relevant roles “shall be assessed”, with no “where appropriate”. The unconditional duty therefore falls on training for administrators and developers, not on the all-staff programme that phishing simulations target. A monthly simulation for everyone, with no check on what the system administrators learned, puts the effort in the wrong place.

ENISA’s Technical Implementation Guidance (June 2025) suggests testing the programme “for example by using quizzes or real scenarios”, tracking the KPIs from Annex point 7.2 and reviewing at least annually. Its evidence list for 8.1.3 (completion logs, quiz results, feedback forms, review records) does not include simulation results. The phrase “periodic simulations” appears seven times in the guidance, all under incident handling, business continuity and physical security. None is in the awareness chapter.

Test method	What it shows for 8.1.3	Personal data created	Monitoring risk (works councils)
Knowledge quiz after training	Understanding of the content	Score per person, or none if anonymous	Low if no individual scores are kept
Simulation reported only in aggregate	Behaviour under a realistic lure	Depends on whether the tool can still identify recipients	Present if the tool can identify individuals
Simulation tracked per person	Individual behaviour, repeat clickers	Click, submission and report records per employee	High
Report-button rate and time-to-report	Whether staff detect and escalate attacks	Reporter identity unless pseudonymised	Moderate
Tabletop or scenario walk-through	Team response to a phishing-led incident	Minimal	Low

The last column is our reading of the works-council rules below, not a ruling on any product. For which requirements a platform can evidence and which need a written policy, see security awareness training platform vs policy template.

What Field Evidence Says About Simulations as a Test

In plain terms: Click rates are a weak measure of training. Report rates hold up better and give your security team something to act on.

The strongest evidence comes from a 15-month field study by researchers at ETH Zurich, (IEEE Security & Privacy 2022), covering 14,773 employees. Half the participants were assigned to a group that was sent to a voluntary training page whenever they fell for a simulated phish; the other half saw no training page. The trained group did worse: 3,593 clicks against 3,087, and 2,730 dangerous actions (such as entering credentials) against 2,155. Among repeat clickers, 801 were in the training group and 647 were not. The authors limit the finding to that delivery method; the study “did not test the effectiveness of mandatory training.”

Reporting fared better. Participants with a report button flagged thousands of suspicious emails, exposing hundreds of real, previously unseen campaigns, and reports on the simulated emails came in fast enough to detect a new campaign within minutes. That makes report rate and time-to-report the better primary metrics: they measure detection. A click rate also moves with the lure; send easier emails and it falls without anyone learning anything. A 19,500-employee trial at UC San Diego Health pointed the same way, as we explain in what security awareness training actually buys.

Annex point 7.2 asks you to define what is measured, how, when, by whom, and who evaluates it; our security metrics and KPIs guide turns that into an indicator sheet.

The GDPR Limits: Which Lawful Basis Holds

In plain terms: Consent will not work, legal obligation is debatable, and legitimate interest needs a documented balancing test. Public bodies cannot use legitimate interest at all.

Consent. The Article 29 Working Party’s Opinion 2/2017 on data processing at work (WP249) states that “consent is highly unlikely to be a legal basis for data processing at work, unless employees can refuse without adverse consequence.” Opt-in would also defeat the surprise a simulation depends on.

Legal obligation, Article 6(1)(c). NIS2 Recital 121 says processing for network and information security “could be considered” lawful as compliance with a legal obligation. It mentions “measures to raise awareness in relation to specific cyber threats” and data such as email addresses. But because 8.1.3 leaves the method open and an anonymous quiz would satisfy it, recording each employee’s clicks is hard to call necessary for compliance. Some advisers read Recital 121 more broadly; treat this basis as contested.

Legitimate interest, Article 6(1)(f). Most simulations will rest here. The EDPB’s Guidelines 1/2024 (version 1.0, adopted for consultation on 8 October 2024) set three cumulative conditions (legitimate interest, necessity, balancing), to be documented before processing starts. They accept that security processing “may, in principle, be based on Article 6(1)(f)” but warn that security “cannot justify an excessive processing of personal data.” Per-person click histories kept indefinitely and shared with line managers will struggle; pseudonymised results, short retention and aggregate reporting stand a much better chance.

Public bodies. Article 6(1) of the GDPR states that point (f) “shall not apply to processing carried out by public authorities in the performance of their tasks.” Public administration entities in NIS2 scope need a basis in national law, so check it before buying a simulation licence.

Germany’s general clause. Article 88 allows more specific employee-data rules “by law or by collective agreements”, if they include “suitable and specific measures”, notably on “monitoring systems at the work place.” In case C-34/21 (30 March 2023), the Court of Justice held that national provisions failing that test “must be disregarded” unless they qualify as a legal basis under Article 6(3). The case concerned Hesse state law, but the judgment also sets out the federal § 26(1) BDSG, and a Gleiss Lutz analysis concluded that § 26(1) sentence 1 BDSG does not meet the Article 88(2) test either. Document an Article 6 basis directly; a works agreement can also supply the specific rule Article 88(1) allows.

Data point	Keep it?	Why
Passwords typed into the fake login page	Never store	The ETH study’s partner company did not record entered credentials or check them; nothing in 8.1.3 needs them
Per-person click and submission events	Only if justified in the balancing test; short retention; pseudonymised	Article 5(1)(c) data minimisation; EDPB warning on excessive security processing
Report-button events	Yes, ideally aggregated	Directly measures the detection capability you want to prove
Individual results sent to line managers or HR	Avoid	Turns a training measure into performance monitoring

The stakes are real: under GDPR Article 83(5), infringements of Articles 5 and 6 carry fines of up to €20 million or 4% of worldwide annual turnover, whichever is higher. See NIS2 vs GDPR for how the regimes overlap.

Works Councils: Germany, Austria and the Netherlands

In plain terms: Here, a tool that can identify who clicked likely needs the works council’s agreement before launch, whatever your intentions.

Country	Provision	What triggers it	Effect
Germany	§ 87(1) No. 6 BetrVG	“Technical devices intended to monitor the behaviour or performance of employees”	Co-determination: the works council must agree to introduction and use; without agreement, the conciliation board (Einigungsstelle) decides
Austria	§ 96(1) No. 3 ArbVG	Control measures and technical systems for controlling employees “insofar as these measures (systems) affect human dignity”	Works-council consent is a condition of legal validity
Netherlands	Art. 27(1)(l) WOR	Arrangements for facilities “aimed at or suitable for” observing or checking employees’ attendance, behaviour or performance	Prior consent of the works council (ondernemingsraad) required

The German test is objective. In its decision 1 ABR 7/15 (13 December 2016), the Federal Labour Court held that a technical device is “intended” for monitoring if it is objectively suitable for it, and that the employer’s subjective intention does not matter. A platform that logs which recipient clicked is objectively suitable, whether or not anyone reads individual results. A Haufe practitioner commentary reaches the same conclusion: social engineering audits run with phishing software or click tracking “as a rule” fall under § 87(1) No. 6. In Austria, whether a simulation “affects human dignity” is case by case; naming and ranking repeat clickers is likely more exposed than team-level reporting.

So negotiate the agreement before the tool goes live. Haufe recommends it cover how tests run, how data is handled, and protection from employment-law sanctions. WP249 adds that a representative sample of employees should help assess whether the monitoring is necessary.

A Defensible Simulation Programme in Seven Steps

In plain terms: NIS2 decision first, then GDPR and labour law, then the first test email.

Step	Owner	Effort	Evidence it produces
1. Choose the 8.1.3 test method and record why (Article 2(2) for regulation-bound providers)	CISO	Low	Method decision note
2. Run the three-step legitimate-interest assessment; decide whether a DPIA is needed	DPO	Medium	Legitimate interest assessment
3. Agree a works agreement (DE/AT/NL) covering scope, data and no sanctions	HR + works council	High	Signed agreement
4. Configure for minimisation: no credential capture, pseudonymised results, fixed retention, restricted access	CISO + DPO	Medium	Tool configuration record
5. Tell staff in general terms that unannounced tests may happen; inform them afterwards	HR / Communications	Low	Privacy notice and announcement
6. Measure report rate and time-to-report alongside click rate, using Annex 7.2 fields	CISO	Low	Measurement report
7. Feed results into the programme update “at planned intervals” and report to the management body	CISO + board	Low	Review record

For SME owners with a few dozen staff and no works council, a quiz after each training round plus a report-button rate is, in our view, a defensible reading of “where appropriate” without any simulation, if the reasoning is written down. For boards, ask not “what is our click rate?” but “how fast do staff report a lure, and is that improving?” For compliance officers, steps 1 to 3 are the file a supervisor, a data protection authority or a works council will ask for.

Frequently Asked Questions

Are phishing simulations mandatory under NIS2?

No. Neither text contains the word “simulation”. For the provider types in Article 1 of Regulation 2024/2690, point 8.1.3 requires effectiveness testing where appropriate; a simulation is one permissible method.

Does ENISA recommend monthly phishing simulations?

Not in its Technical Implementation Guidance. Under 8.1.3 it suggests “quizzes or real scenarios” and an annual review; it sets no simulation frequency.

Is works-council agreement the same as employee consent?

No. It is a labour-law requirement in Germany, Austria and the Netherlands. The GDPR basis is separate, usually legitimate interest.

Can we discipline employees who keep clicking?

Risky. Sanctions turn a training tool into performance monitoring and weaken the balancing test. And in the ETH Zurich study, staff sent to a training page after a click went on to click more, not less.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

How This Guide Was Verified

Term counts come from the full English EUR-Lex texts of Directive (EU) 2022/2555 and Regulation (EU) 2024/2690, retrieved 9 October 2026. Every quoted provision was checked word for word against EUR-Lex or the national legislation portal; ENISA’s guidance was searched in full. Where a step rests on practitioner judgement, the article says so.

Sources

1. Directive (EU) 2022/2555 (NIS2), Articles 2(2)(f), 21(1)–(2) and Recitals 89, 121 — EUR-Lex
2. Commission Implementing Regulation (EU) 2024/2690, Articles 1–2, Recitals 6, 20 and Annex points 7.2, 8.1–8.2 — EUR-Lex
3. ENISA, Technical Implementation Guidance on cybersecurity risk-management measures, version 1.0, June 2025 (points 8.1.2–8.1.3)
4. Regulation (EU) 2016/679 (GDPR), Articles 5(1)(c), 6(1), 83(5), 88 and Recital 49 — EUR-Lex
5. Court of Justice of the EU, Case C-34/21, Hauptpersonalrat der Lehrerinnen und Lehrer, judgment of 30 March 2023 — EUR-Lex
6. European Data Protection Board, Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR, version 1.0, 8 October 2024
7. Article 29 Working Party, Opinion 2/2017 on data processing at work (WP249)
8. Betriebsverfassungsgesetz (BetrVG), § 87 — gesetze-im-internet.de
9. Bundesarbeitsgericht, decision of 13 December 2016, 1 ABR 7/15
10. Arbeitsverfassungsgesetz (ArbVG), § 96 — Rechtsinformationssystem des Bundes (RIS)
11. Wet op de ondernemingsraden (WOR), Article 27 — wetten.overheid.nl
12. Lain, Kostiainen and Čapkun, “Phishing in Organizations: Findings from a Large-Scale and Long-Term Study”, IEEE Symposium on Security and Privacy 2022
13. Nils Müller, “Pflichten und Anforderungen für Arbeitgeber bei der Durchführung eines Social Engineering Audits”, Haufe
14. Gleiss Lutz, “Unanwendbarkeit nationaler Generalklauseln des Beschäftigtendatenschutzes”, 26 April 2023