Management Body Cybersecurity Training Plan
Plans and evidences the cybersecurity training members of the management body are required to follow.
Available soon
- Format
- Excel
- Size
- 87 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
The training interval is this pack's default, not the Directive's.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | On the Plan Overview sheet, set the As-at date. The EXAMPLE uses 2026-09-30, the example quarter end; type today's date, or =TODAY() to keep it current. Check the cadence: at least every 12 months, and within [[3]] months for a new member (NR-05), unless national law sets a shorter time. |
| 2 | On the Programme sheet, review the six topics (MT-01, MT-02, MT-03, MT-04, MT-05, MT-06) and their minutes: 120 minutes in all. Change the content to fit your entity, but keep a topic for each duty the body has. Say where the materials are kept. |
| 3 | On the Members sheet, list every member of the management body: an ID, the role, the date appointed, and the date left when someone leaves. Do not delete a member who leaves: the record stays. |
| 4 | On the Sessions sheet, enter each session, held or planned: an ID, the type (Induction, Annual, Refresher), the date, the trainer, and Yes or No for each topic it covered. The minutes and the topics covered calculate. |
| 5 | On the Attendance sheet, add one row per member per session: Booked when booked, then Yes or No once the session is held. The role, the date, the topics, the trainer and the next due date fill in. |
| 6 | Read the Members sheet: each member's last training, booking, next due date and status. Book anyone showing Book now, move a booking that is booked after due date, and train anyone overdue at once. Clear every Record check that does not say OK. |
| 7 | Read "Where we stand" on the Plan Overview sheet and report the board figure with the quarterly cyber report (P03 BM-08). Give the board secretary the figures for Part F of the Management Body Cybersecurity Accountability Record. |
| 8 | Keep the agenda, the slides and the attendance sign-in for each session where the Sessions sheet says. That, with this workbook, is the record a supervisor may ask for. |
| 9 | Delete the EXAMPLE rows before the plan is approved. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Its management body is a board of seven: the chair, the chief executive, the chief financial officer and four non-executive directors. Six members were trained at the annual session on 26 Feb 2026; the member appointed on 15 Jul 2026 is booked on an induction on 8 Oct 2026, inside the 3 months (due 15 Oct 2026). The board figure is Board 6 of 7, as P03's BM-08 reports.
Tailoring — small organisation: where the management body is one or two people, one session a year that covers all six topics is enough, and it can be a briefing by the NIS2 lead or an outside trainer. Keep the attendance record all the same.
Tailoring — regulated entity (NIS2, DORA): national law may set how often members are trained, or what the training must cover; check it with counsel and change the cadence on the Plan Overview. A financial entity under DORA keeps its management body's ICT risk training to DORA Article 5(4) as well. Offer similar training to staff (NR-05), and keep that record in your awareness programme.
Tailoring — IT run by a service provider: a provider or an outside trainer may deliver the sessions. Content and attendance stay yours: record them here, and ask the trainer for the slides.
Plan Overview
Plan overview
Where the training stands, what the plan is for, how often each member is trained, and who approved it. Yellow cells are yours; the EXAMPLE entries show a completed plan.
| As-at date | 30 Sep 2026 | EXAMPLE date (the example quarter end). Replace it with today's date, or type =TODAY(). |
| Train every member at least every (months) | 12 | At least once a year (this pack's default; NIS2 Art 20(2) and DORA Art 5(4) require the training and set no interval), as the Board Cybersecurity Reporting pack sets it. Shorten it if national law does. |
| Train a new member within (months) | 3 | NR-05. The pack's default; set your own. |
| Book-ahead window (days) | 60 | A member due within this many days and not booked shows Book now. The pack's default; set your own. |
Where we stand
| Measure | Value | What it means | ||
|---|---|---|---|---|
| Members of the management body | 7 | Everyone listed who has not left. | ||
| Trained in the last 12 months | 6 | Attended a session within the cadence, as at the as-at date. | ||
| Board figure for the cyber report (P03 BM-08) | Board 6 of 7 | The board half of BM-08, board and staff security training. | ||
| Booked | 1 | Not yet trained within the cadence, but booked in time. | ||
| To book | 0 | Book now, or booked after due date. | ||
| Overdue | 0 | Past the due date and not trained: NR-05 is not met for them. | ||
| Training status (NR-05) | On schedule: members booked | Every member trained; on schedule while the others are booked in time; action needed when someone must be booked; not met when anyone is overdue. | ||
| Sessions held in the last 12 months | 1 | Sessions on the Sessions sheet dated within the cadence. | ||
| Sessions that left out a topic | 0 | A member who missed a topic should cover it at the next session. | ||
| Programme length (minutes) | 120 | The six topics on the Programme sheet. | ||
Objectives and measures of success
| Objective | Measure of success | |||
|---|---|---|---|---|
| Every member able to judge the entity's cyber risks and challenge how they are managed (NIS2 Article 20(2)) | Every member trained within the cadence: "Every member trained" or "On schedule" above, never "Not met" | |||
| Every new member trained within [[3]] months of appointment (NR-05) | No member overdue; a new member booked in their first month | |||
| The record ready for a supervisor | Every session with its date, trainer, topics and materials; every attendance recorded | |||
Scope
| Item | Entry | |||
|---|---|---|---|---|
| Who is trained | Every member of the management body. The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. | |||
| Not in this plan | Staff awareness training, which NR-05 says must be offered to staff too. Keep it in your awareness programme; its figure is the staff half of BM-08 (EXAMPLE: staff 92%). | |||
| Period covered | [[e.g. 1 Jan to 31 Dec 2027]] | |||
Cadence and content
| Session | When | Content | Length | Evidence kept |
|---|---|---|---|---|
| Induction | Within [[3]] months of appointment (NR-05) | All six topics on the Programme sheet | About 120 minutes | Attendance, agenda, slides, trainer |
| Annual session | At least every 12 months (NIS2 Article 20(2), NR-05) | All six topics, refreshed with the year's readiness result, incidents and gaps | About 120 minutes | Attendance, agenda, slides, trainer |
| Refresher | [[When a law, the classification or the risks change materially]] | [[The topics the change touches]] | [[30 to 60 minutes]] | Attendance, agenda, slides |
Resources and dependencies
| Item | Entry | |||
|---|---|---|---|---|
| Trainer | [[e.g. external counsel with the Head of Information Security, or an outside trainer]] | |||
| Budget | [[€ amount for trainer and materials, and who holds it]] | |||
| Depends on | The latest readiness result (NIS2 Readiness Self-Assessment), the open gaps (NIS2 Gap & Remediation Tracker) and the quarterly cyber report, so each session speaks of the entity's own position | |||
Review points
| When | Who | What is checked | ||
|---|---|---|---|---|
| Each quarter | Board secretary | Every member's status; bookings; the board figure for the cyber report | ||
| When a member joins | Board secretary | The induction booked within the first month, inside the 3 months | ||
| Once a year, at the annual approval | Chair of the management body, with the NIS2 lead | The content of the programme, and Part F of the Management Body Cybersecurity Accountability Record | ||
Approval of the plan
| Role | Name | Date |
|---|---|---|
| Chair of the management body | [[Name]] | [[YYYY-MM-DD]] |
| Board secretary | [[Name]] | [[YYYY-MM-DD]] |
Members
One row per member of the management body, current or past. Yellow columns are inputs; white columns calculate from the Attendance sheet. Every colour sits beside a word.
| Example | Member | Role on the management body | Appointed | Left | Last trained | Booked for | Next due | Days to due date | Trained in the last 12 months | Status | Record check | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | M-01 | Chair (non-executive) | 1 Jun 2019 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-02 | Chief Executive | 11 Jan 2021 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-03 | Chief Financial Officer | 5 Sep 2022 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-04 | Non-executive director | 2 Mar 2020 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-05 | Non-executive director | 15 May 2023 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-06 | Non-executive director | 4 Nov 2024 | 26 Feb 2026 | 26 Feb 2027 | 149 | Yes | Up to date | OK | |||
| EXAMPLE | M-07 | Non-executive director | 15 Jul 2026 | 8 Oct 2026 | 15 Oct 2026 | 15 | No | Booked | OK |
Attendance
One row per member per session: the record NR-05 asks for. Booked when booked; Yes or No once the session is held.
| Example | Member | Role on the management body | Appointed | Session | Date | Topics covered | Trainer | Attended | Next due | Record check |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | M-01 | Chair (non-executive) | 1 Jun 2019 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-02 | Chief Executive | 11 Jan 2021 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-03 | Chief Financial Officer | 5 Sep 2022 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-04 | Non-executive director | 2 Mar 2020 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-05 | Non-executive director | 15 May 2023 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-06 | Non-executive director | 4 Nov 2024 | S-2026-01 | 26 Feb 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Yes | 26 Feb 2027 | OK |
| EXAMPLE | M-07 | Non-executive director | 15 Jul 2026 | S-2026-02 | 8 Oct 2026 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | [[e.g. external counsel with the Head of Information Security]] | Booked | OK |
Sessions
One row per session, held or planned. Mark each topic it covered; the minutes use the Programme sheet.
| Example | Session ID | Type | Date | Trainer | MT-01 | MT-02 | MT-03 | MT-04 | MT-05 | MT-06 | Minutes | Topics covered | All topics covered | Held or planned | Attended | Materials kept at |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | S-2026-01 | Annual | 26 Feb 2026 | [[e.g. external counsel with the Head of Information Security]] | Yes | Yes | Yes | Yes | Yes | Yes | 120 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | Yes | Held | 6 | [[e.g. board portal, NIS2 training folder]] |
| EXAMPLE | S-2026-02 | Induction | 8 Oct 2026 | [[e.g. external counsel with the Head of Information Security]] | Yes | Yes | Yes | Yes | Yes | Yes | 120 | MT-01 MT-02 MT-03 MT-04 MT-05 MT-06 | Yes | Planned | 0 | [[e.g. board portal, NIS2 training folder]] |
Programme
The content of the training: one topic per duty the body has. Rows marked Default are the pack's programme, 120 minutes in all; adapt them.
| Row | Topic ID | Topic | What it covers | Minutes | In the induction | In the annual session | Materials kept at | Content owner |
|---|---|---|---|---|---|---|---|---|
| Default | MT-01 | Our NIS2 status and what it asks of the management body | Whether we are essential or important and why; approving and overseeing the measures; that members can be held liable (Article 20(1)). | 20 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
| Default | MT-02 | The ten measures and where we stand | Each Article 21(2) measure in plain words, our readiness level on it and the open gaps. | 25 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
| Default | MT-03 | Our top cyber risks and our appetite | The risks outside appetite, what they would cost and what is being done (P05, P03). | 20 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
| Default | MT-04 | When an incident happens | Who decides what, which decisions only the board or its equivalent takes, and the reporting deadlines the policy sets (P09 IM-08, RD-01 to RD-04). | 20 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
| Default | MT-05 | Supervision, enforcement and personal accountability | What the competent authority may ask for, the measures it may order and the fines it may impose (Articles 32 to 34). | 15 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
| Default | MT-06 | Reading the cyber report and challenging it | What good answers look like to the board's questions (P03 question bank). | 20 | Yes | Yes | [[Location of slides and notes]] | [[e.g. Head of Information Security]] |
Lists
| YesNo | Attended | SessionType | MemberStatus |
|---|---|---|---|
| Yes | Yes | Induction | Left |
| No | No | Annual | Overdue |
| Booked | Refresher | Booked |
Booked after due date
Book now
Up to date
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Management body | The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. |
| Member | A person who sits on the management body. Use an ID (M-01, M-02 …) or the name, the same on every sheet. |
| Induction | The first session for a new member: the whole programme, within 3 months of appointment (NR-05). |
| Annual session | The session every member attends at least every 12 months (NIS2 Article 20(2)). |
| Last trained | The latest session the member attended (Attended = Yes), from the Attendance sheet. |
| Booked for | The latest session the member is booked on (Attended = Booked), from the Attendance sheet. |
| Next due | The last training plus 12 months; for a member not yet trained, the appointment plus 3 months. |
| Status: Left | No longer a member: the date left is on or before the as-at date. Kept as the record. |
| Status: Overdue | The next due date has passed and the member has not been trained since. |
| Status: Booked | Booked on a session on or before the next due date. |
| Status: Booked after due date | Booked, but on a session after the next due date: bring the booking forward. |
| Status: Book now | Due within the book-ahead window (60 days by default) and not booked. |
| Status: Up to date | Trained within the cadence, and not yet due within the book-ahead window. |
| As-at date | The date the statuses are measured against. Set on the Plan Overview sheet. |
| MT-nn | The number of a topic in the programme. |
| NR-05 | Every member of the management body must follow cybersecurity training (Article 20(2)), and similar training must be offered to staff on a regular basis. The Directive sets no interval. This pack's default is at least once a year for each member, and within [[3]] months of appointment for a new member; attendance and content are recorded. |
| EXAMPLE row | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Delete before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 7.2 — Competence | Programme and Attendance: the competence the members need, and the record that they have it |
| ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | Programme and Sessions: the education and training delivered to the members |
| NIST CSF 2.0 | PR.AT-02 — “Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind” | The whole plan: people in a specialised role, the management body, trained for it |
| NIS2 — Directive (EU) 2022/2555 | Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices | Members, Sessions and Attendance: every member trained, and the record |
| NIS2 — Directive (EU) 2022/2555 | Article 20(1) — management bodies approve the cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements | Programme, topics MT-01 and MT-05: the duties to approve and oversee, and liability |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.