- 360 DIGITALE TRANSFORMATION
NIS-2 Training for Management: Meet the Legal Training Obligation in 53 Minutes
Managing directors, board members and authorised officers of companies covered by NIS-2 must regularly attend cybersecurity training – this is required by Section 38(3) of the German BSI Act (BSIG). Our NIS-2 training is self-paced e-learning: fully online, no fixed date, no travel. The core part takes 53 minutes, after which you receive your certificate of attendance.
Why management must be trained
With the German NIS-2 Implementation Act, the obligations have applied since December 2025 without a transition period. Around 29,500 companies and organisations in Germany are affected. The law holds management personally responsible:
- Implement and oversee: management must approve the risk-management measures and oversee their implementation.
- Liability: anyone who breaches these duties is liable to their own organisation.
- Training: management must regularly attend training to be able to identify and assess cybersecurity risks and management practices.
Lesson 2 shows whether your company is affected – or check beforehand with our overview of the NIS-2 requirements.
What the training covers
13 lessons, around 97 minutes. Each lesson has one learning objective and takes 4 to 10 minutes – you can pause and continue at any time.
Core part – covers the training obligation (53 minutes)
| # | Lesson | Minutes |
|---|---|---|
| 1 | Why this training matters – the legal requirement | 6 |
| 2 | NIS-2: does it apply to my organisation? | 9 |
| 3 | Duties of the management bodies | 8 |
| 4 | Liability and sanctions | 7 |
| 5 | The minimum measures under Art. 21 | 10 |
| 6 | Reporting obligations and deadlines (24 h / 72 h / 1 month) | 8 |
| 7 | Knowledge check and completion | 5 |
Optional deep dive (44 minutes)
| # | Lesson | Minutes |
|---|---|---|
| 8 | Purpose and benefits of an ISMS | 10 |
| 9 | Terms and terminology | 8 |
| 10 | The PDCA cycle | 6 |
| 11 | The key processes | 8 |
| 12 | Risk management from a C-level perspective | 7 |
| 13 | Accountability and documented information | 5 |
The knowledge check covers the core part only. You receive your certificate of attendance after lesson 7 – the deep dive is an offer, not a requirement.
What the training looks like
Short video lessons with a trainer, plus the text to read along – on desktop, tablet and smartphone.
Lesson 1: the legal requirement
Why NIS-2 makes information security a management responsibility and what Section 38 BSIG requires of management.
Lesson 2: does NIS-2 apply to you?
Why the number of employees or the industry alone does not decide – and how activities, entity type and size come together.
Lesson 12: risk management for management
Risk management as a governance and decision-making tool – from identifying risks to reviewing residual risk.
Who the training is for
- Managing directors, board members and authorised officers of companies covered by NIS-2
- Members of management who need to document their training
- Parent companies that also train the management of foreign subsidiaries – the training is available in English and German
What you get
- 13 self-paced lessons, online in our academy
- Knowledge check for the core part
- Certificate of attendance for your records
- English and German
- €249 net price per licence
Your company is not covered by NIS-2?
Even without a legal obligation, management is responsible for information security. The training works just as well as ISMS training for management: optional lessons 8 to 13 explain the purpose, terms and processes of an ISMS, risk management from a management perspective and accountability – the foundations for ISO 27001 and TISAX®.
Several participants or whole groups of companies?
Want to train your entire management team, or the management of your subsidiaries as well? We will prepare an offer for company licences.
Questions? 15 minutes – direct answers.
Not sure whether your company is covered by NIS-2 or whether the training fits your situation? We will clarify it in a short call – with no obligation.
Frequently asked questions about the NIS-2 training
Who must be trained under NIS-2?
The management of companies covered by NIS-2. This includes managing directors, board members and authorised officers. Section 38(3) BSIG requires them to attend training regularly.
How long does the training take?
The core part takes 53 minutes. With the optional deep dive, around 97 minutes. You learn at your own pace and can pause at any time.
Do I get a certificate?
Yes. After the core part and the knowledge check you receive a certificate of attendance for your records.
Is the training also available in German?
Yes. The training is available in English and German.
How much does the training cost?
€249 net price per licence. For several participants or groups of companies we prepare an offer on request.
How often must the training be repeated?
The law requires regular attendance but does not set a fixed interval. We recommend repeating the training at least once a year.