NIS2 / BSIG § 30

NIS2 Training for Employees

One generic online course a year is not enough under NIS2. We explain what training obligations actually exist and what an effective programme looks like.

Request Consultation NIS2 Overview

Legal Basis

What NIS2 Really Requires for Employees

The explicit training obligation under § 38 BSIG applies to executive management. There is no comparably direct individual obligation for employees — but § 30 BSIG obligates entities to comprehensive risk management measures that simply cannot be implemented without trained staff.

Rule of thumb: Without regular, audience-appropriate training, NIS2-compliant risk management cannot be demonstrated. The BSI expects documented training measures for all employees who perform security-relevant tasks.

Training Content

What an NIS2-Compliant Training Programme Covers

An effective security awareness programme is neither a one-off nor generic. It is tailored to target groups, repeated regularly, and tested for effectiveness.

All Employees

Phishing and social engineering recognition
Secure password management & MFA
Reporting channels for security incidents
Handling unknown files & links
Mobile device and home office security

IT Staff & Administrators

Patch management and vulnerability management
Network segmentation and access controls
Incident response procedures
Log management and monitoring
Backup and recovery

Managers Below Executive Level

Risk assessment and reporting obligations
Escalation processes for incidents
Supplier assessment and contract review
Business continuity and crisis management

More Than Knowledge Transfer

How Training Actually Becomes Effective

Are online courses enough for NIS2 compliance?

Not as the sole measure. Online courses can scale knowledge transfer, but they do not replace audience-specific in-person or live formats, simulated phishing tests, or role-specific exercises. The BSI expects a programme, not a single measure.

How often do employees need to be trained?

At least annually, more frequently in an elevated threat environment. Phishing simulations should be run quarterly. New employees must be trained before taking on security-relevant tasks.

What needs to be documented?

For every training measure: date, topic, participant list, format and, for tests, results. This evidence must be presented in the event of a BSI review or an incident. Missing documentation can be treated as a compliance gap.

Further NIS2 Topics

Build a Security Awareness Programme

We develop audience-tailored training programmes that fulfil NIS2 requirements and actually work within your workforce.

Request a Training Programme