nis2

NIS2 is the EU Network and Information Systems Directive 2. It came into force on October 17, 2024 after a two-year transposition window, and it requires roughly 160,000 European organizations to implement cybersecurity risk-management measures that include workforce training. Management bodies are personally accountable for approving and following that training.

If you run security inside an essential or important entity, the training question is no longer abstract. Auditors and national competent authorities now expect documented evidence that staff and leadership have been trained, that the content reflects current threats, and that management is involved rather than observing from a distance.

Regulatory compliance is not optional. If you handle healthcare data, process payments, or serve European customers, specific frameworks mandate how you protect information. Security awareness training sits at the center of nearly every one of those requirements.

And yet most organizations treat compliance training as a checkbox exercise. Annual videos. Generic quizzes. Certificates that prove nothing except attendance. I’ve watched this pattern repeat for years, and it fails both the spirit and the letter of what regulators actually expect.

The organizations that get this right do something different. They build training that satisfies auditors and creates employees who understand why regulations exist, how their daily actions either protect or expose sensitive data, and what to do when something looks wrong.