Get consulting from Sterling
Expert and experienced consultants, 8,100+ client engagements in 60+ countries, from gap assessment to a system ready for its certification audit.
Talk to a Sterling consultant← All courses
Awareness training · Cybersecurity
NIS2 Training: What the NIS2 Directive Means for You and Your Board
NIS2 training for staff and managers at companies that have just learned they are an essential or important entity, or that supply one. Perhaps your national NIS2 law has come into force, your management board has been told it must approve cybersecurity measures and follow training, or a client has sent a supplier questionnaire asking how you handle incidents and security in your supply chain.
This course explains Directive (EU) 2022/2555 in plain language: who is in scope, the ten minimum risk-management measures, how significant incidents are reported within 24 hours, 72 hours and one month, what management bodies must do and what fines can follow. You follow a cloud hosting provider in Amsterdam, so you can see what NIS2 asks of each role, from the board to the service desk.
NIS2 training explains the NIS2 Directive, Directive (EU) 2022/2555, the EU law that sets cybersecurity duties for essential and important entities in critical sectors. An awareness course covers scope, national laws, the risk-management measures of Article 21, supply chain security, incident reporting stages, management body accountability, supervision and penalties, and each person's everyday part.
Training a team? Get a quote for your organisation
Part of: Information Security and ISO 27001 Training
Part of: Information Security & Privacy
Secure payment by Stripe · for yourself or for your team
What you get
- 10 video modules
About 111 minutes, with captions. Watch at your own pace on any device.
- Practice after every module
Short questions check your understanding before you move on.
- Final exam
Multiple choice, with immediate retakes if you need them.
- Built by experts
Industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC.
A certificate you can prove, and share
Verifiable certificate with a QR code anyone can scan, plus a digital badge to add to your LinkedIn profile.
See how verification works →Standard and editionDirective (EU) 2022/2555 (NIS2 Directive)
Last updated31 October 2026
Why NIS2 matters now: recent incidents and new national laws
NIS2 is no longer a future obligation. Member States had to apply it from 18 October 2024, and the laws are now arriving: the Dutch Cybersecurity Act came into force on 15 August 2026, and in July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice over late transposition.
Recent events show why the directive looks beyond your own walls. From 19 September 2025, ransomware at a third-party provider of passenger processing software disrupted check-in at several European airports; ENISA called it a third-party ransomware incident. That is exactly the supply chain risk NIS2 asks entities to manage.
NIS2 is also an all-hazards law. On 28 April 2025, mainland Spain and Portugal lost electricity; the Spanish government's report of June 2025 found technical and planning failures and no cyberattack. Continuity planning has to cover events like that too. And in October 2025, the ENISA Threat Landscape analysed 4,875 incidents and found phishing behind about 60% of initial intrusions, which is why staff awareness sits at the heart of the directive.
Who this NIS2 training course is for
The course is for everyone at an entity in scope, and for the suppliers and service providers that support them.
You need it when your organisation has registered as an essential or important entity, when board members must follow the training NIS2 requires, when a customer asks for evidence that your staff understand NIS2, or when you start a new role in security, IT or management.
- Members of management bodies who must approve and oversee cybersecurity measures
- Managers and team leaders in IT, operations, procurement and service delivery
- Employees at essential and important entities in energy, transport, health, digital infrastructure and other sectors
- Staff of managed service providers, software suppliers and outsourcers serving EU clients
- Compliance and risk staff starting an NIS2 programme
What you will learn
By the end you will know what NIS2 requires, how it reaches you through national law and what is expected of you personally.
- Explain the purpose of NIS2 and how it is applied through national law
- Recognise the sectors in scope and the difference between essential and important entities
- Describe the cybersecurity risk-management measures NIS2 requires
- Know the stages of significant incident reporting and your part in them
- Understand the duties and accountability of management bodies
- Recognise supply chain security and everyday good practice in your own role
Course outline: 10 modules
Each topic opens with a real-life moment, then gives the rule in plain words with its article, what it means in practice and the common mistake.
- Module 1, Why NIS2: three recent events, why the directive exists, the company you follow and how the course works.
- Module 2, From NIS to NIS2, through national law: how NIS2 replaced NIS, how it works through national law, the authorities and where DORA fits.
- Module 3, Who is in scope: sectors, size rules and exceptions, essential and important entities, registration and non-EU providers.
- Module 4, Risk management, the all-hazards approach: proportionate measures, risk analysis, incident handling, business continuity and checking that measures work.
- Module 5, Supply chain security: choosing suppliers, the contract, an outsourced service desk partner, secure development and reviews.
- Module 6, Cyber hygiene, training, cryptography and access: people, access control, assets, multi-factor sign-in and standards.
- Module 7, Incident reporting: what makes an incident significant, the 24-hour, 72-hour and one-month stages, clients and your part.
- Module 8, Information sharing and the authorities: sharing threat information, vulnerability disclosure, the CSIRT and requests from authorities.
- Module 9, Management bodies, supervision and penalties: board duties and training, supervision, enforcement, fines, liability and the GDPR link.
- Module 10, Your role, what is changing, and the exam: everyday habits, one case from start to finish, the January 2026 proposal and the final exam.
The NIS2 Directive explained
NIS2 is Directive (EU) 2022/2555, adopted in December 2022 and in force from 16 January 2023. It replaced the first NIS Directive, which was repealed from 18 October 2024. Because it is a directive, it applies through each Member State's national law, so registration channels, authorities and some details differ by country.
It covers medium and large entities in the sectors of high criticality in its first annex, such as energy, transport, banking, health, drinking water and digital infrastructure, and in the other critical sectors of its second annex, such as postal services, waste, chemicals, food and manufacturing. Some entities are in scope whatever their size. Entities are either essential or important, which changes how they are supervised and the maximum fines.
The core duties are in Articles 20, 21 and 23. Article 21 requires appropriate and proportionate measures on an all-hazards basis, with ten minimum measures, including risk analysis, incident handling, business continuity, supply chain security, cyber hygiene and training, cryptography, access control and multi-factor authentication. Article 23 sets reporting: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Article 20 makes management bodies approve the measures, oversee them and follow training, and they can be held liable. Fines can reach at least €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.
How the course works
The course is 10 on-demand video modules, about 2 hours of video in total. Practice questions after each module help you check your understanding before you move on.
At the end you take a scenario-based multiple-choice final exam drawn from the course's question bank. Complete the course and its assessed final exam (pass mark 70%, one retake included) and you receive a Sterling Academy Certificate of Completion. You study online, on any device, at your own pace, which makes it easy to roll out across shifts and offices.
What you can do after the course
The course turns a long legal text into everyday actions.
- Work out whether your organisation, or your client, is an essential or important entity
- Recognise a possible significant incident and report it internally at once, knowing the 24-hour clock
- Answer a client's NIS2 supplier questionnaire on training, incidents and secure development with confidence
- Spot phishing and follow access, multi-factor and cryptography rules in daily work
- Brief a manager or board member on what NIS2 expects of them
- Follow national NIS2 law and the January 2026 amendment proposal without overreacting
For teams and organisations
NIS2 asks Member States to encourage regular training for employees, not only for management bodies. A company plan lets a client administrator add staff, assign courses and follow progress reports, so you can show who has completed the course. One invoice covers your organisation.
Get a quote for your organisation and tell us how many people you want to train.
Why Sterling Academy
Sterling Academy courses are built by industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC. The Academy is the training arm of Sterling International Consulting, with 8,100+ client engagements in 60+ countries over 20+ years.
Every course teaches the current text. This one follows the NIS2 Directive, Implementing Regulation (EU) 2024/2690 for digital providers and national transposition up to October 2026, and teaches the January 2026 amendment proposal only as a proposal.
Preview this course
Experience the learning
before you enrol.
Watch a sample from NIS2 Awareness before you enrol.
NIS2 AwarenessSample
Inside the course
A clear path through the essentials.
10 modules, 10 practice checkpoints and a final exam. Video runtimes are approximate; allow additional time for the practice questions and the final exam. Modules marked optional can be skipped; the others are studied in any order.
Part 1What NIS2 is and who is in scopeApprox. 32 min
- Why NIS29 min
What the EU NIS2 Directive is and why it exists, shown through the September 2025 airport check-in attack, the Iberian blackout and ENISA's threat report.
What this module covers
Opens with the question of who outside your company would feel it if your systems stopped, and an exercise imagining one service down for a day. Covers three events: the cyberattack on a passenger processing supplier that disrupted check-in at Brussels, Berlin and London Heathrow from 19 September 2025; the loss of electricity in mainland Spain and Portugal on 28 April 2025; and ENISA's October 2025 threat report analysing 4,875 incidents, with phishing the way in for about 60%. Draws three lessons on suppliers, all hazards and people. Explains NIS2's aim under Article 1. Introduces PQR Cloud, an Amsterdam hosting provider with partners in Manila, Mumbai and Dublin, then the ten modules and the final exam. It ends with a recap and three practice questions.
What you will be able to do
- Explain the three risks recent events showed
- Describe what NIS2 aims to achieve
- Describe how the course and final exam work
Why it matters
Seeing how one supplier, one blackout or one message can stop services shows why NIS2 asks something of every employee.
Practice: Practice: Why NIS2 · 3 questions
- From NIS to NIS2, through national law11 min
How NIS2 replaced the first NIS Directive, how a directive is transposed into national law, who supervises, and where DORA fits.
What this module covers
Starts with a hospital in Madrid asking PQR Cloud's account manager which NIS2 law the company follows: Dutch, Spanish or the EU directive itself. Covers where NIS2 came from, the first NIS Directive, and how NIS2 replaced it with more sectors and one size rule from 18 October 2024. Explains that as a directive, NIS2 works through national law, which sets which authority supervises your sector, how you register and how you report, and that in May 2025 the Commission sent reasoned opinions to 19 Member States. Covers how PQR Cloud maps its measures against Article 21 with owners and dates, and why sector laws with equivalent rules, such as DORA for finance, apply instead. It ends with a recap and three practice questions.
What you will be able to do
- Explain how NIS2 differs from the first NIS Directive
- Explain how a directive takes effect through national law
- Identify when a sector law such as DORA applies instead
Why it matters
Knowing which national law applies to you, and to your clients, lets contracts reflect the right duties on both sides.
Practice: Practice: From NIS to NIS2, through national law · 3 questions
- Who is in scope12 min
Who is in scope of NIS2: the sectors in its two annexes, the size rule and exceptions, essential and important entities, and registration.
What this module covers
Opens with a PQR Cloud finance assistant asking why NIS2 would cover a company that is not a bank or power company. Explains the two tests: a sector type listed in the annexes, with eleven sectors of high criticality in the first annex, and a size of medium-sized or larger. Covers entities in scope whatever their size, and the difference between essential and important entities, which share the same duties but face different supervision and fines. Explains registration, shown through the Dutch register for PQR Cloud, and how providers outside the EU can be reached. Applies the tests to PQR Cloud, including what would change if it had only 80 staff. It ends with a recap and three practice questions.
What you will be able to do
- Apply the sector and size tests to an organisation
- Tell essential entities from important entities
- Explain registration and the position of providers outside the EU
Why it matters
Checking the sector, then the size, tells you quickly whether NIS2 duties apply to your organisation.
Practice: Practice: Who is in scope · 3 questions
Part 2Risk-management measures and supply chain securityApprox. 34 min
- Risk management: the all-hazards approach11 min
NIS2 Article 21 cybersecurity risk-management measures: the all-hazards approach, risk analysis, incident handling and business continuity.
What this module covers
Starts with a power failure at one of PQR Cloud's Amsterdam data centres, where generators start but a database restore fails because nobody had tested it for a year. Covers Article 21: appropriate and proportionate measures in at least ten areas, following an all-hazards approach to power cuts, fire, failures and human error as well as cyberattacks. Looks in detail at three measures: risk analysis, with a register copied from a template three years ago and reviewed after major changes and serious incidents; incident handling with monitoring and logs; and business continuity with tested backups. Ends with four habits for your own role, including knowing who to call and taking exercises seriously. It ends with a recap and three practice questions.
What you will be able to do
- Explain the all-hazards approach of Article 21
- Describe risk analysis, incident handling and business continuity
- Check that plans and backups are actually tested
Why it matters
Testing the plan before you need it turns a power cut into a short interruption instead of a lost day.
Practice: Practice: Risk management: the all-hazards approach · 3 questions
- Supply chain security11 min
NIS2 supply chain security: choosing suppliers on security, contract clauses, supplier registers, monitoring and secure development.
What this module covers
Opens with PQR Cloud's procurement lead choosing the cheapest backup software vendor the same afternoon, without asking how it builds software, fixes flaws or reports breaches, for a product holding data for eighteen hundred clients. Covers how NIS2 makes the security of relationships with direct suppliers part of your own measures. Explains choosing suppliers on security as well as price, putting security duties in the contract including fast incident reporting, and a register of direct suppliers with a contact point and the ICT products and services each provides. Covers secure development and maintenance, regular supplier reviews, and what suppliers can do, such as keeping records of security training that clients increasingly ask for. It ends with a recap and three practice questions.
What you will be able to do
- Choose a supplier on security as well as price
- Write security duties into a supplier contract
- Keep a supplier register and review suppliers regularly
Why it matters
Treating supplier choice as a security decision keeps a weak vendor from becoming your weakest point.
Practice: Practice: Supply chain security · 3 questions
- Cyber hygiene, training, cryptography and access11 min
NIS2 cyber hygiene and training, cryptography, human resources security, access control, asset management and multi-factor authentication.
What this module covers
Starts with a PQR Cloud finance assistant who receives an urgent email about changed bank details for the Frankfurt data centre rent, notices the sender's address differs by one letter, calls the landlord on the number on file and reports it. Covers cyber hygiene and training for everyone, from new joiners to the board, repeated over time and tested. Explains cryptography, people security and asset management that protect data and systems, and access that follows least privilege, is reviewed and is protected by multi-factor sign-in where appropriate. Shows how PQR Cloud mapped its system to Article 21 and found two gaps, and four things an authority may ask to see, including an asset inventory that matches a network scan. It ends with a recap and three practice questions.
What you will be able to do
- Spot and report a phishing attempt such as a fake payment request
- Apply least privilege and multi-factor sign-in to access
- Explain how cryptography and asset management protect data
Why it matters
Small daily habits, like checking an unusual request, stop the incidents that most often start with one message.
Practice: Practice: Cyber hygiene, training, cryptography and access · 3 questions
Part 3Incident reporting and information sharingApprox. 23 min
- Incident reporting12 min
NIS2 incident reporting under Article 23: significant incidents, the 24-hour early warning, 72-hour notification and final report.
What this module covers
Opens at ten past two on a Saturday when a PQR Cloud storage cluster in Amsterdam goes down for about 400 clients, the Manila service desk sees tickets arrive, and by three o'clock the on-call engineer finds signs of a stolen administrator password. Covers when an incident is significant: severe disruption or loss, or considerable damage to others, with exact thresholds for cloud providers. Explains the stages: an early warning within 24 hours, a notification within 72 hours, and a final report within one month, plus telling clients where appropriate. Shows a named on-call approver and an early warning template ready to fill in, each step logged, and your own part: spot it, report internally at once and keep the evidence. It ends with a recap and three practice questions.
What you will be able to do
- Decide whether an incident is significant under NIS2
- List the NIS2 reporting stages and their deadlines
- Report an incident internally at once and keep the evidence
Why it matters
A quick internal report from whoever spots a problem is what lets the company meet its 24-hour deadline.
Practice: Practice: Incident reporting · 3 questions
- Information sharing and the authorities11 min
NIS2 information sharing under Article 29, coordinated vulnerability disclosure, the role of CSIRTs and ENISA, and answering the authority.
What this module covers
Starts with a Mumbai developer who finds a flaw in a storage tool used by thousands of companies, and weighs posting a warning online against keeping quiet until PQR Cloud is fixed. Covers Article 29: voluntary sharing of threats, vulnerabilities and signs of attacks through agreed arrangements, shown as a sharing group with written rules, and the risk of oversharing client names, network maps or passwords. Explains coordinated vulnerability disclosure, with a CSIRT as a trusted intermediary, and ENISA's European vulnerability database. Covers the CSIRT as a partner during an incident, and answering requests from the authority fully, on time and honestly, sending them to the person who owns NIS2 compliance. It ends with a recap and three practice questions.
What you will be able to do
- Share threat information without exposing confidential details
- Disclose a vulnerability in a coordinated way through a CSIRT
- Respond to an authority's request fully and on time
Why it matters
Sharing the right information the right way warns others without handing attackers a head start.
Practice: Practice: Information sharing and the authorities · 3 questions
Part 4Management duties, supervision and your roleApprox. 22 min
- Management bodies, supervision and penalties11 min
NIS2 Article 20 duties of management bodies, supervision of essential and important entities, enforcement, fines and personal liability.
What this module covers
Opens in PQR Cloud's boardroom, where a board member suggests signing whatever the IT team brings and moving on to the budget. Covers Article 20: management bodies of essential and important entities must approve and oversee the risk-management measures, follow training, and can be held liable. Explains how authorities supervise essential entities before and after incidents, and important entities after the fact, and how they can ask for evidence. Covers enforcement measures from warnings and orders to fines of at least €10 million or 2% for essential entities, and personal accountability. Ends with what staff can do: say in writing when a measure lacks people, time or tools, and keep evidence such as access reviews and training records. It ends with a recap and three practice questions.
What you will be able to do
- Explain what Article 20 requires of management bodies
- Describe how essential and important entities are supervised
- Explain the range of NIS2 enforcement measures and fines
Why it matters
Knowing that the board is accountable helps you give it clear, written information on what security needs.
Practice: Practice: Management bodies, supervision and penalties · 3 questions
- Your role, what is changing, and the exam11 min
Your everyday role under NIS2, a supplier case from outside the EU, the 2026 proposal to amend NIS2, and the final exam.
What this module covers
Opens with a new joiner at PQR Cloud's security monitoring partner in Dublin asking what she needs to do if she is neither in IT nor on the board. Sets out NIS2 role by role in everyday language, from every employee's safe habits and quick reporting upward. Follows one case from start to finish: an IT managed service provider in Mumbai with clients in Germany, Ireland and Spain, naming an EU representative, using named accounts, multi-factor sign-in, tested backups and contracts with fast incident notice. Covers the European Commission's January 2026 proposal for targeted amendments, and why today's law applies until changes are adopted. Ends with four everyday habits, a recap and the final exam of thirty questions.
What you will be able to do
- Describe your own everyday role in meeting NIS2
- Apply NIS2 duties as a supplier based outside the EU
- Explain the status of the 2026 proposal to amend NIS2
Why it matters
Clear everyday habits, whatever your job, are what keep your organisation's and your clients' services running.
Practice: Practice: Your role, what is changing, and the exam · 3 questions
Frequently asked questions
Your questions,
answered.
About NIS2 Awareness, its certificate and enrolment.
Ask SterlingIs Sterling Academy a good choice for NIS2 training?
Yes. Sterling Academy's NIS2 training is built by the Sterling consulting group, which has taken organisations to certification across 8,100+ client engagements in 60+ countries over 20+ years. It is always on the current edition, with practice questions that show the right answer. Each course ends with a final exam and a verifiable certificate that anyone can check online, plus a LinkedIn badge, and client administrators can show an auditor exactly who has been trained. You will understand what NIS2 asks of you, contribute to your organisation's implementation and audit readiness, and play your part with confidence when the auditor visits. Sterling Academy courses carry the same content as Sterling's classroom training, whose certificates are trusted and accepted by all major certification bodies, as evidence of training at client audits for over 20 years.
What is NIS2 training?
NIS2 training explains the NIS2 Directive, Directive (EU) 2022/2555, and what it means at work. This awareness course covers who is in scope, the risk-management measures, supply chain security, the incident reporting stages, the duties of management bodies, supervision and penalties, and the everyday behaviour expected of each employee.
Is NIS2 training mandatory?
For management bodies, yes. Article 20 requires members of the management bodies of essential and important entities to follow training, and Member States must encourage similar regular training for employees. Article 21 also lists cyber hygiene practices and cybersecurity training among the minimum measures.
Who needs NIS2 training?
Board members, managers and employees at essential and important entities in the EU need it, together with staff of suppliers and service providers that support them, such as managed service providers and software companies. Anyone who may spot or handle an incident should know the reporting stages.
What is the difference between essential and important entities?
Both must apply the same risk-management measures and report significant incidents. Essential entities, generally large entities in the highest-criticality sectors, face proactive supervision and higher maximum fines; important entities are supervised mainly after evidence of a problem. Module 3 explains how to tell which you are.
What are the NIS2 incident reporting deadlines?
A significant incident needs an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report within one month of the notification. Module 7 explains what counts as significant and what each person's part is in getting the clock started.
What is the difference between NIS2 and DORA?
NIS2 is a directive covering many critical sectors through national law; DORA is an EU regulation on digital operational resilience for the financial sector. For financial entities covered by DORA, DORA's sector-specific rules take precedence. Module 2 explains where each applies.
How long does the NIS2 training course take?
The course has about 2 hours of video across 10 modules. Allow a little extra time for the practice questions after each module and for the final exam. You can complete it in one session or spread it over a few days.
Do I get a certificate?
Yes. Complete the course and the scenario-based multiple-choice final exam, drawn from the course's question bank and assessed with a pass mark of 70%, and you receive a Sterling Academy Certificate of Completion for NIS2 Awareness. One retake is included if your first attempt does not meet the mark.
How much does NIS2 training cost?
The course costs US$19 per learner, with online access on any device. Organisations that want to train boards, managers and staff together can ask for a quote for a company plan with a client administrator, progress reports and one invoice.
Can my team take the course together?
Yes. A company plan lets a client administrator add your staff and managers, assign the course and track progress through reports, which helps you show that employees have been trained. Get a quote for your organisation and tell us how many people you want to train.
Your certificate
Prove what you learned.
Share it with confidence.
You will understand what NIS2 asks of you, contribute to your organisation's implementation and audit readiness, and play your part with confidence when the auditor visits. Your certificate can be verified online in seconds, so certification body auditors, employers and clients can confirm your training instantly.
Complete the course and its final exam and you receive a Sterling Academy Certificate of Completion, verifiable online by QR code, with a LinkedIn badge to share.
- Pass mark
- 70%
- Prerequisites
- None
Sterling Academy courses carry the same content as Sterling's classroom training, whose certificates are trusted and accepted by all major certification bodies, as evidence of training at client audits for over 20 years.
Ask about course requirementsYour next step
Not sure which course?