NIS2 Training Kit: Management Body & Staff Awareness
149,00 €
- 2 ready-to-deliver PowerPoint decks: management body (27 slides) and all-staff cyber hygiene (20 slides)
- Full speaker script in the notes of every slide, plus a ransomware tabletop exercise for the board
- 2 knowledge checks (12 questions each) with answer keys and legal references
- Training register (Excel) with due dates and a coverage dashboard, attendance sheet, board training record, certificate
- Mapped to NIS2 Art. 20(2), Art. 21(2)(g) and CIR 2024/2690, Annex section 8
- Instant download · Secured by Stripe
📄 Look inside first: free sample (PDF) — 3 pages of the trainer guide plus 9 real slides from both decks. No email needed.
Licence scope: one legal entity. Train your own management body, staff and direct suppliers in as many sessions as you like. Consultants who want to deliver it to clients: ask us for a multi-client licence at info@nis-2-templates.com.
Description
Every member of your management body must follow cybersecurity training under NIS2 Article 20(2), and your staff need cyber hygiene training under Article 21(2)(g). This kit lets you run both sessions yourself, with your own trainer, and keep the evidence a supervisor asks for: who attended, what was covered, when, and what the board decided.
CIR 2024/2690 Annex section 8
47 slides with speaker scripts
Editable PPTX, DOCX, XLSX
Board training is a legal duty, with a paper trail
Article 20(2) of the NIS2 Directive requires the members of the management bodies of essential and important entities to follow training, so that they can identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides. The duty is personal: each member attends, and each attendance is recorded. National laws add detail. In Germany, § 38(3) BSIG requires management to train “regularly”, and the BSI can audit it. In Poland, Art. 8e of the amended KSC Act requires the head of the entity to complete training once per calendar year, with documented participation.
Your employees are covered by Article 21(2)(g): basic cyber hygiene practices and cybersecurity training are one of the ten minimum measures. Implementing Regulation (EU) 2024/2690 describes what a compliant awareness programme looks like: repeated over time, covering new joiners and management, covering threats, the measures in place, contact points and hygiene practices, with its effectiveness tested. Read more in our guides to the Article 20(2) board training obligation and NIS2 training requirements.
What is in the kit
| File | What it is |
|---|---|
| T00 Trainer Guide (DOCX) | Legal basis with national examples, customisation checklist, timings, evidence requirements, annual calendar, plan for role-based training |
| T01 Management Body Training (PPTX, 27 slides) | Duties and liability, the ten minimum measures with a status column, incident reporting, risk appetite, board indicators, a three-inject ransomware tabletop, decisions for the record |
| T02 Staff Cyber Hygiene Training (PPTX, 20 slides) | Phishing, payment fraud, phone and QR scams, passwords, MFA fatigue, devices, remote work, AI tools, reporting, three real-life scenarios |
| T03 / T04 Knowledge Checks (DOCX) | 12 questions for the board and 12 for staff, pass mark 10 of 12 |
| T05 Answer Keys (DOCX) | Correct answers with explanations and the article each one comes from |
| T06 Training Register (XLSX) | People, sessions, attendance and scores; next due date and “Overdue” flag per person; dashboard with board and staff coverage and pass rate |
| T07 Attendance Sheet (DOCX) | Printable sign-in sheet with the session details auditors ask for |
| T08 Management Training Record (DOCX) | Formal record of the board session and its decisions, for the minute book |
| T09 Certificate of Completion (DOCX) | Certificate for each participant |
The management body session: 75 to 90 minutes
The board deck is written for directors, not for IT. It explains what Article 20(1) means in practice: approve the measures, oversee their implementation, answer for infringements. It covers the difference between essential and important entities, the fine ceilings in Article 34, and the temporary management ban in Article 32(5), described precisely and without scare tactics. It covers the 24-hour, 72-hour and one-month reporting timeline, and the parallel GDPR and customer notifications. Then the board practises: a ransomware attack on a Friday evening, a supplier compromise and a data leak on Saturday, a ransom deadline on Monday. The session ends with five decisions recorded in the training record, so the training leaves a governance trail and not only an attendance list.
The staff session: 45 to 60 minutes
Practical habits people can use the next morning: how to spot phishing and payment fraud, why an unexpected MFA prompt is an alarm, how to handle devices, remote work and AI tools, and above all how and why to report fast. One slide holds your own contacts and policies, as the CIR awareness programme requires. Three short scenarios get the room talking before the knowledge check.
Evidence that holds up
An attendance list proves that people sat in a room. Supervisors also ask what was covered, by whom, for how long, and whether it worked. The kit captures all of it: session details in the register, signed attendance, knowledge-check scores as evidence of effectiveness, and the board’s decisions in a formal record. The register shows each person’s next due date and flags anyone overdue, so annual refreshers and new joiners do not slip.
Who it is for
- NIS2 officers, CISOs and IT leads who have to train the board and the staff without an e-learning budget
- HR and compliance teams who need training evidence for an audit
- Owners of the NIS2 Complete Toolkit: the toolkit contains the training plan (doc 03) and the training tracker (doc 55); this kit adds the training content itself
What it is not
It is not an e-learning platform and it does not send phishing simulations. It does not replace role-specific technical training for administrators or developers (CIR point 8.2); the trainer guide shows how to plan that part. It is a training aid, not legal advice: national transposition laws differ, and the guide tells you where to check yours.
Frequently asked questions
Does NIS2 require a test after the training?
The Directive does not require an exam, and the German BSI states that none is required for management training. The CIR does expect the effectiveness of awareness and training to be assessed. A short knowledge check is the simplest way to show it.
How often must the board be trained?
The Directive does not set an interval. National law may: Poland requires training once per calendar year, Germany requires it “regularly”. The trainer guide recommends an annual session plus a catch-up for new members. See also how often NIS2 training must run.
Can we deliver the training with an internal trainer?
Yes. Internal and external trainers are both allowed. The guide explains the BSI’s caveat about purely internal board training and how to address it.
Can we edit the slides?
Yes. Everything is editable: PowerPoint, Word and Excel. Red placeholders mark every place where your company details go.
Who can buy
We sell to businesses only. Customers in the EU outside Poland need a valid VAT number; the reverse-charge mechanism then applies.
