Security Awareness Training: What NIS2 and DORA Expect

The legal hooks

Rule	Requirement
NIS2 Art. 21(2)(g)	Basic cyber hygiene practices and cybersecurity training are a minimum measure
NIS2 Art. 20(2)	Management body members must follow training; entities are encouraged to offer similar training to employees regularly
2024/2690 Annex, section 8	Detailed awareness and training requirements for NIS2 digital providers
DORA Art. 13(6)	ICT security awareness programmes and digital operational resilience training are compulsory for all employees and senior management, with complexity matching their role; ICT providers included where appropriate
DORA Art. 5(4)	Management body members keep up to date, including through specific regular training
DORA Art. 30(2)(i)	ICT contracts set the conditions for providers' participation in your training

Layer 1: awareness for everyone

Implementing Regulation (EU) 2024/2690 requires an awareness programme for employees, including members of management bodies, and where appropriate direct suppliers and service providers (Annex, point 8.1). It must:

be scheduled over time, so activities are repeated and cover new employees;
follow your security policy, topic-specific policies and procedures;
cover relevant threats, the measures you have in place, who to contact for help, and cyber hygiene for users;
where appropriate, be tested for effectiveness, and be updated at planned intervals as threats change.

Layer 2: role-based security training

Staff whose roles need security skills, such as IT administrators, developers and the people handling incidents, need regular, job-relevant training (point 8.2). It should cover:

secure configuration and operation of your systems, including mobile devices;
known cyber threats;
how to behave when a security-relevant event occurs.

Training needs are defined per role, people moving into such roles are trained when they transfer, effectiveness is assessed, and the programme is updated periodically.

Layer 3: the management body

Both NIS2 and DORA single out the board. The goal is not technical depth but enough knowledge to identify risks and judge the security measures and their impact on the business, which directors must approve and oversee. See NIS2 and the board.

A practical yearly programme

When	Who	What
Onboarding, day 1	Every new starter	Acceptable use, passwords and MFA, phishing, how to report
Every quarter	All staff	15-minute refresher on a current threat; short phishing simulation where appropriate
Every year	All staff	Full awareness module and policy acknowledgement
Every year	IT, developers, incident team	Role-based training: secure configuration, secure coding, incident handling
Every year	Management body	Board session on risks, duties and the incident reporting process
On change	People changing roles; key suppliers	Role training on transfer; supplier briefing on your requirements

Proving it works

Records: who completed what, when.
Effectiveness measures: phishing simulation trends, reported-suspicious-email rates, quiz scores, incidents caused by human error.
Updates: dated changes to content when threats or systems change.

Completion rates alone show attendance, not effectiveness; the 2024/2690 Annex asks for both.

Start with the basics: the free Cyber Risk Score includes staff training as a weighted control, and the Security Policy Generator drafts the acceptable use policy your training refers to.

A programme outline, ready to run. The Cybersecurity Starter Pack includes a security awareness training outline and an employee security onboarding and offboarding checklist, alongside a 90-day roadmap and core procedures.

Security Awareness Training: What NIS2 and DORA Expect

The legal hooks

Layer 1: awareness for everyone

Layer 2: role-based security training

Layer 3: the management body

A practical yearly programme

Proving it works

Sources

Related tools

Cyber Risk Score

Security Policy Generator