NIS2 asks for trained people. Here is how you show it happens.

What is NIS2?

NIS2 is an EU directive from 2022 that raises the bar for cybersecurity. In the Netherlands it becomes law through the Cybersecurity Act (Cyberbeveiligingswet, Cbw). It covers far more organisations than the old rules: not only energy and drinking water, but also, for example, waste management, food production, digital services and many manufacturers.

Does it apply to you?

Usually, if you work in one of the sectors it lists and have 50 or more employees or more than 10 million euros in turnover. Some organisations fall under it whatever their size. Not sure? The Digital Trust Center explains who is covered, or ask your adviser. NIS2 is EU law: it does not apply to organisations that operate only in the United Kingdom, although insurers and clients there often ask for proof of training too.

What NIS2 says about training

• Directors must follow cybersecurity training themselves (article 20).
• Basic cyber hygiene and cybersecurity training are among the measures an organisation must take (article 21).
• Organisations are encouraged to offer their employees similar training regularly.
• Directors approve and oversee these measures, and can be held responsible for them.

How scamcanary helps

• Practice emails at five levels for everyone taking part, the board included.
• Modules on cyber and data security from A to Z, in a set order, from passwords to what to do when something goes wrong.
• Per employee you see which modules they finished and when.
• A certificate and a printable report as proof for your auditor or supervisor.

What scamcanary is not

NIS2 has no certificate, and scamcanary does not make you NIS2-compliant. The law asks for much more than training: risk management, reporting incidents, securing your suppliers. We take care of the training part, and of the proof that it happens.