What is the NIS2 Directive (EU) 2022/2555?
NIS2 is the EU directive that expands cybersecurity obligations to an estimated 160,000 organisations across 18 critical sectors. It introduces personal management liability and explicit requirements for employee cybersecurity training.
Article 20 requires management bodies to undergo cybersecurity training themselves and ensure all employees receive regular security awareness training. National authorities can fine organisations and personally ban non-compliant managers from their roles.
NIS2 covers essential entities (energy, transport, banking, health, digital infrastructure, public administration) and important entities (manufacturing, food, chemicals, postal, digital providers, research). CyberSek helps organisations across all covered sectors meet their Article 20 obligations.
What happens without NIS2 awareness?
Most compliance failures trace back to employees who weren’t trained. Here’s what’s at stake.
NIS2 can ban senior managers from their roles if non-compliance results from management negligence. This is unprecedented personal accountability in EU cybersecurity law.
Essential entity fines reach 10 million euros or 2% of global turnover. Important entity fines reach 7 million euros or 1.4%.
Significant incidents require an early warning within 24 hours. Staff who cannot recognise an incident cost your organisation this window — and non-notification is penalised separately.
NIS2 requires managing cybersecurity in your supply chain. Inadequate oversight of suppliers who cause incidents increases your own exposure.
Energy, health, digital infrastructure, and other sector regulators are building enforcement capacity specifically for NIS2. Early compliance demonstrates good faith.
Trained employees and dated records — in place in under 10 minutes.
Start free trialNIS2 training — simple, trackable, audit-ready
CyberSek is a security awareness training platform. We give your management and all employees the knowledge NIS2 Article 20 requires, with records to demonstrate it. We do not provide legal compliance advice or NIS2 certification.
Management learn their personal Article 20 obligations. All staff learn what NIS2 means for them, how to recognise and report incidents, why supply chain risks matter, and the 24-hour notification process.
NIS2 awareness modules
2–5 minute video modules. Completion tracked automatically. Certificate issued per employee. Reports ready for auditors.
The directive explained, covered sectors, essential vs important entities, and your specific obligations
For boards and executives — personal accountability provisions, training obligations, and liability
Identifying significant incidents and the 24-hour early warning, 72-hour notification, and 1-month report
How supply chain attacks work, evaluating supplier risk, and NIS2 due diligence requirements
How threat actors target critical sectors and how employees are the primary line of defence
Tailored threat scenarios for energy, health, transport, digital infrastructure, and banking employees
Your role during a cyber incident and how to support organisational recovery
NIS2 disclosure requirements for technology product and digital service organisations