Use case · NIS2
NIS2 training: for the board and for everyone else
NIS2 puts training in two places. Members of management bodies are required to follow cybersecurity training, and entities are to offer comparable training to employees regularly. Separately, basic cyber hygiene practices and cybersecurity training sit among the risk-management measures every essential and important entity must take.
Five questions, and none of them is "do you have a program?"
The obligation is short. The evidence behind it is not. National law carries both into local supervision, and what a supervisor asks to see is a record.
- That a training program exists and runs regularly, rather than once
- That the management body itself was trained, not only the staff
- That training matches roles and risks — finance and IT administrators face different attacks from the warehouse
- That its effect is measured, and that the measurements are acted on
- Records: who completed what, and when
The mapping, requirement by requirement
- 01
Regular staff training
A monthly simulation and topic, curricula with deadlines and reminders, and automated campaigns that keep testing between cycles.
- 02
Management-body training
A separate curriculum for directors with its own completion report, and simulations built around the lures executives actually receive.
- 03
Role-appropriate content
Curricula per group or department, assigned automatically from your directory.
- 04
Cyber hygiene basics
Modules on phishing, passwords, safe browsing, data protection and physical security, in English, German and Hungarian.
- 05
Effectiveness
A baseline simulation, then the click rate and the reporting rate tracked over time, per person, team and department.
- 06
Policy awareness
Policy acknowledgement campaigns: a dated acceptance per named person.
- 07
Evidence
Excel and CSV exports per person: training, date sent, date completed, quiz score against the pass mark, policy acceptances.
What the managed option actually does, month by month
- 01
Month one
An unannounced baseline simulation, plus a directors’ briefing and curriculum.
- 02
Months two to twelve
One topic and one matching simulation per month. Anyone who clicks receives the matching training immediately.
- 03
Quarterly
A management report for the board, with the trend since the baseline.
- 04
Ongoing
New joiners are enrolled automatically, and policy acknowledgements are collected as policies change.
- 05
On request
The audit export, for your supervisor or your auditor.
The two services this sits next to
Phishing Investigation
Incident handling is another NIS2 measure, and reported phishing is often the first sign of an incident.
Virtual CISO
For the governance, risk management and supervisory reporting around the program.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
It is a hard position to defend. The directive asks for training that happens regularly and for risk-management measures whose effect is assessed, and one session a year measured by attendance answers neither.
A program that tests behavior, trains on what the test finds and records the result per person is a much stronger position — and it does not take more of your employees’ time, it spreads the same time differently.
Yes. The directive requires members of management bodies to follow cybersecurity training themselves, and it also makes them responsible for approving and overseeing the entity’s risk-management measures.
A short, dedicated curriculum for directors, with its own completion record, is the simplest way to show it happened. Whether and how personal liability applies to your organization is a question for your own counsel — the training record is the part we can make straightforward.
Per person: the training assigned, the date it was sent, the date it was completed, the quiz result against a pass mark, and the policy acceptances.
Per program: the plan, the simulation results over time, and the management reports that show somebody read them. The platform produces all of it as exports, which matters because the alternative is assembling it by hand in the week an auditor asks.
Where to go next
Training & curricula
Short modules assembled into learning paths with deadlines and certificates.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.