NIS2 is often read as a technical directive, but a large part of it is about people. Article 21 lists “basic cyber hygiene practices and cybersecurity training” as a required risk-management measure, and Article 20 makes management bodies personally responsible for approving and overseeing those measures. In practice that means two things for your organisation: everyone has to be trained, and someone senior has to be able to show it happened.
Who has to be trained
Not just IT. The obligation covers the whole workforce, because the people who get phished are rarely the security team, they are finance approving an invoice, HR opening a CV, or a manager acting on an “urgent” message from the CEO. Training written for specialists misses exactly the people most likely to be the way in.
What you have to be able to prove
Auditors do not accept “we ran some training.” They want records: who was assigned, who completed, when, and how they scored. The useful test is whether you could, on request, export a per-person completion log mapped to the control it satisfies. If that export takes days of screenshots and spreadsheets, your evidence is a liability.
This is why we record completion, quiz results and certificates as the team goes, and let a manager export them as audit-ready documentation in minutes. The goal is not to “have training”, it is to be able to hand an auditor proof without a scramble.
A sensible baseline
Short recurring lessons in the language your team speaks, a simple completion deadline, a knowledge check, and a certificate on the record. Add phishing simulation once the training is solid. None of this is exotic, the hard part is finishing it, which is the whole reason we design for completion rather than coverage.