How do we plan cybersecurity training for our management body?

Start

The management body needs a cybersecurity training plan

NIS2 requires members of the management body to follow training, so that each can judge the entity's cyber risks and challenge how they are managed. The plan is also the record: what each member attended, when, and what it covered. A supervisor may ask for it.

• Then: List every member of the body, with the date appointed

Step

List every member of the body, with the date appointed

The body is the board of directors, or the management board in a two-tier structure; where there is no board, the people national law makes responsible for running the entity. NIS2 does not define the term, so confirm with counsel. Record each member's role and appointment date, and keep members who leave on the list with the date they left.

• Then: Set the cadence: yearly, and soon after appointment

Step

Set the cadence: yearly, and soon after appointment

The pack's defaults: every member at least every 12 months, and a new member within 3 months of appointment. Shorten them if national law sets a shorter time. Each member's next due date is the last training plus 12 months, or, for someone not yet trained, the appointment date plus 3 months.

• Then: Build one topic for each duty the body has

Step

Build one topic for each duty the body has

The pack's default is six topics, about 120 minutes: your NIS2 status and what it asks of the body; the ten measures and where you stand; top risks and appetite; incidents and the decisions only the board or its equivalent takes; supervision, enforcement and personal accountability; reading and challenging the cyber report. Change the content, but keep a topic for each duty.

• Then: Use your own readiness result, gaps and cyber report

Step

Use your own readiness result, gaps and cyber report

Each session should speak of the entity's own position, so the plan depends on the latest readiness result, the open gaps and the quarterly cyber report. The annual session refreshes all six topics with the year's readiness result, incidents and gaps.

• Then: Is the management body one or two people?

Decision

Is the management body one or two people?

The pack scales the plan to the size of the body. The attendance record is kept in every case.

• Yes: Hold one session a year covering all six topics
• No: Plan an annual session, inductions and refreshers

Step

Hold one session a year covering all six topics

For a body of one or two people, one session a year that covers every topic is enough. It can be a briefing by the NIS2 lead or an outside trainer. Keep the attendance record all the same.

• Then: Have the chair and the board secretary approve the plan

Step

Plan an annual session, inductions and refreshers

The annual session covers all six topics for every member. An induction covers the whole programme for a new member. A refresher covers the topics a material change touches, for example a change in the law, the classification or the risks. An outside trainer or provider may deliver sessions, but the content and attendance record stay yours.

• Then: Have the chair and the board secretary approve the plan

Step

Have the chair and the board secretary approve the plan

The plan names its objectives and measures of success, who is trained, the trainer, the budget and the review points. The pack has the chair of the management body and the board secretary approve it.

• Then: Has a member joined who is not yet trained?

Decision

Has a member joined who is not yet trained?

A new member falls due soon after appointment, so the induction cannot wait for the next annual session. The board secretary checks when a member joins.

• Yes: Book their induction in their first month
• No: Book every member before they fall due

Step

Book their induction in their first month

The pack's review point is an induction booked within the first month, inside the 3 months. In the pack's example, a member appointed in mid-July was booked on an induction in early October, before the due date in mid-October. A booking after the due date shows as a problem to move forward.

• Then: Book every member before they fall due

Step

Book every member before they fall due

In the pack's default, a member due within 60 days and not booked shows Book now. Move any booking that falls after the member's due date. Check every member's status and bookings each quarter.

• Then: Record attendance, topics and materials for each session

Step

Record attendance, topics and materials for each session

One row per member per session: booked, then attended yes or no. For each session keep the date, the trainer, the topics covered, the agenda, the slides and the sign-in, and say where they are kept. That, with the plan, is the record a supervisor may ask for.

• Then: Is any member past their due date and untrained?

Decision

Is any member past their due date and untrained?

A member past the due date and not trained since is overdue, and the training duty is not met for them. If a member's status is not known, check it before answering no.

• Yes, or not known: Train them at once, and report it as not met
• No: Did a session leave out a topic for anyone?

Outcome

Train them at once, and report it as not met

Train anyone overdue at once. Report the gap with the quarterly cyber report and in your management body record, with the date it will close. A member of the body who is not trained is itself a gap your readiness work should track.

Decision

Did a session leave out a topic for anyone?

The plan counts sessions that left out a topic. A member who missed a topic should cover it at the next session.

• Yes: Cover the missed topic at their next session
• No: Report the board's figure with the quarterly cyber report

Step

Cover the missed topic at their next session

The plan marks which topics each session covered. Make sure the member's next session includes the topic they missed, and check afterwards that it did.

• Then: Report the board's figure with the quarterly cyber report

Outcome

Report the board's figure with the quarterly cyber report

Report how many members are trained, as the board half of the board and staff training measure, and give the figures to whoever keeps the management body record. Once a year, at the annual approval, the chair and the NIS2 lead review the programme's content.