Start here: the directive itself, and how the 27 member states transpose it.
What NIS2 asks of each function in an essential or important entity.
Foundation
NIS2 All Staff: Cyber Hygiene
What NIS2 means for your working day: recognise, protect, report
Basic cyber hygiene for every employee of an organisation covered by Directive (EU) 2022/2555, in plain language: why article 21(2)(g) puts cyber hygiene and training among the measures every essential and important entity must take, how attacks actually start, how to protect accounts with passphrases, password managers and multi-factor authentication, how to spot phishing, voice cloning and payment fraud, how to handle devices and data without leaks, and why the organisation's 24-hour early warning under article 23 depends on staff reporting at once.
- 4 modules, 9 lessons, 92 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 40 points towards your rank
Practitioner
NIS2 Business Continuity and Crisis Management
Build the continuity, backup, disaster recovery and crisis management of article 21(2)(c), test it, and keep the reporting clock running while you recover
Article 21(2)(c) of NIS2 requires every essential and important entity to cover business continuity, such as backup management and disaster recovery, and crisis management. The directive names the measure; Implementing Regulation (EU) 2024/2690 spells it out, but only for the entity types in its article 1. This certification separates what the law requires from good practice, then covers the business impact analysis and recovery objectives, backups that survive ransomware and site loss, restoration testing, the crisis organisation and its communication, the exercise programme, the article 23 reporting chain that keeps running during recovery, the resilience obligations of critical entities under Directive (EU) 2022/2557, and the evidence a supervisor will ask to see.
- 4 modules, 9 lessons, 90 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for HR and Security Awareness
Training duties, awareness that changes behaviour, and human resources security from hiring to departure, within the limits of data protection law
Directive (EU) 2022/2555 puts people at the centre of two of its ten minimum measures: point (g) of article 21(2), basic cyber hygiene practices and cybersecurity training, and point (i), human resources security, access control policies and asset management. Article 20(2) adds that members of management bodies are required to follow training. This certification turns those provisions into an HR and awareness practice: who must be trained and on what legal basis, how to design an awareness programme and role-based training and measure whether they work, how to secure the employment lifecycle from screening to offboarding and access revocation, how to set policies, acknowledgements and a disciplinary process, where the GDPR limits background checks and monitoring of staff, and which records a supervisor will ask to see. Where Implementing Regulation (EU) 2024/2690 applies, its annex points on awareness, training and human resources security are covered precisely; for other entities they serve as a reference.
- 4 modules, 9 lessons, 93 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for ICT Suppliers to Regulated Entities
Know whether NIS2 binds you directly, answer what your regulated customers must ask, and sign only what you can deliver
Cloud, data centre, content delivery network, managed service and managed security service providers are themselves NIS2 entities once they reach medium size; DNS, TLD and trust service providers are in scope whatever their size. Every other ICT supplier is bound by nothing in NIS2, yet receives its requirements through customers who must manage supply chain security under article 21(2)(d) and take into account each direct supplier's vulnerabilities, product quality and secure development under article 21(3). This certification shows a SaaS vendor, MSP or integrator how to settle its own scope, answer questionnaires and audits, negotiate the clauses drawn from Implementing Regulation (EU) 2024/2690, notify customers in time for their 24-hour early warning, run coordinated vulnerability disclosure under article 12, and use certifications as evidence rather than as a claim of compliance.
- 4 modules, 9 lessons, 91 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 Incident Response and Reporting
Qualify a significant incident, run the 24-hour, 72-hour and one-month chain, and close it with evidence
Article 23 of NIS2 turns incident response into a regulated sequence: decide whether an incident is significant, send an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report one month later, to the right CSIRT or authority, while the GDPR and sector regimes run their own clocks in parallel. This certification covers the definitions, the significance criteria of the directive and of Implementing Regulation (EU) 2024/2690, the moment the clock starts, the content of each report, the CSIRT and single point of contact, recipients of services, voluntary notification and information sharing, and the post-incident review a supervisor will ask to see.
- 4 modules, 9 lessons, 92 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 Internal Audit and Assurance
Plan and perform independent assurance over the NIS2 measures, audit the management body's article 20 duties, and prepare for supervisory audits without mistaking a certificate for compliance
Article 21(2)(f) of NIS2 requires every essential and important entity to have policies and procedures to assess the effectiveness of its cybersecurity risk-management measures. The directive does not mention internal audit; Implementing Regulation (EU) 2024/2690 adds an effectiveness procedure, compliance monitoring and an independent review, but only for the entity types in its article 1. This certification separates what the law requires from what internal-audit methodology adds, then covers the risk-based audit universe, auditing the management body's approval, oversight and training under article 20, testing the evidence of each of the ten measures, sampling and evidence quality, reporting findings to the management body, the inspections and regular, targeted and ad hoc security audits that competent authorities can order under articles 32 and 33, remediation and follow-up under article 21(4), and what ISO/IEC 27001 certification and other external audits do and do not prove.
- 4 modules, 9 lessons, 97 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for IT Operations and Infrastructure
Run assets, access, patching, configuration, cryptography, logging and backups to the standard of article 21(2), and prove it
Six of the ten measures in article 21(2) of NIS2 are carried out in large part by IT operations: incident handling, business continuity, security in acquisition, development and maintenance including vulnerability handling and disclosure, cryptography, access control and asset management, and multi-factor authentication with secured communications. This certification turns each into operational practice: the asset inventory and classification that drive every other decision, identity and privileged access, multi-factor authentication where appropriate, vulnerability handling and patching with documented exceptions, coordinated vulnerability disclosure under article 12, secure configuration and segmentation, a cryptography policy with key management, logging and monitoring, backup and recovery, and the evidence a supervisor asks for. Each lesson separates what the directive requires, what Implementing Regulation (EU) 2024/2690 requires of the entity types it binds, and what is practice.
- 4 modules, 10 lessons, 104 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Legal, Compliance and DPOs
Scope, class, jurisdiction, lex specialis, GDPR and CER interplay, supplier contracts and enforcement, read from the text
Directive (EU) 2022/2555 reaches entities through national law, and the legal questions this certification addresses are answered chiefly in articles 2 to 6, 26 to 28 and 31 to 37. This certification works through them the way counsel does: whether an entity is in scope and whether it is essential or important, which member state has jurisdiction and what must be registered, when DORA or another sector-specific act displaces NIS2, how NIS2 interacts with the GDPR and the CER Directive, what supplier contracts can and cannot do, and how supervision, fines and personal liability work, together with the procedural safeguards that frame them.
- 5 modules, 10 lessons, 117 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for OT and Industrial Control Systems
Bring control systems under the NIS2 measures without compromising safety: inventory, zones, unpatchable assets, remote access, reporting and recovery
NIS2 never uses the words operational technology or industrial control system, yet it reaches every programmable controller, SCADA server and engineering workstation an essential or important entity uses for its operations: article 6(1) defines network and information systems by what devices do, and article 21(1) applies the risk-management measures to the systems an entity uses for its operations. This certification shows how that reasoning holds, and how to apply the article 21(2) measures where safety, availability and long asset lifetimes constrain what security can do: OT asset inventory, segmentation between IT and OT, vulnerability handling with compensating controls when patching is not possible, governance of remote access and third-party maintenance, detection and article 23 reporting under safety constraints, and recovery of the physical process. It places IEC 62443, the electricity network code of Delegated Regulation (EU) 2024/1366, the CER Directive and Implementing Regulation (EU) 2024/2690 where they belong: what each binds, whom, and what to prove.
- 4 modules, 9 lessons, 93 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 Risk Management
Run an all-hazards risk analysis, calibrate it to article 21(1), treat and accept risk on the record, and prove that the measures work
Article 21 of NIS2 makes risk the basis of every cybersecurity measure: measures must be appropriate and proportionate, based on an all-hazards approach that covers network and information systems and their physical environment, and they include both policies on risk analysis and policies and procedures to assess the effectiveness of those measures. This certification covers the definition of risk in article 6(9), the proportionality factors of article 21(1), risk criteria and appetite, identification, analysis and treatment, the acceptance of residual risk, supplier risk under article 21(3) and the Union-level coordinated assessments of article 22, effectiveness under article 21(2)(f), and the reporting a management body and a supervisor will expect, with the risk management framework of Implementing Regulation (EU) 2024/2690 for the entities it binds.
- 4 modules, 9 lessons, 90 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 Secure Development and Product Security
Build article 21(2)(e) into the way your teams design, code, test, release and patch software, and know exactly where the Cyber Resilience Act takes over
Article 21(2)(e) of NIS2 requires every essential and important entity to secure the acquisition, development and maintenance of its network and information systems, including vulnerability handling and disclosure; article 21(3) makes the secure development procedures of suppliers something their customers must take into account. This certification turns those words into a working development life cycle: security requirements and threat models at design, managed components and software bills of materials, secure coding and review, risk-based security testing, controlled release, change, configuration and patching, and a vulnerability process tied to coordinated disclosure under article 12 and the European vulnerability database. It uses point 6 of the Annex to Implementing Regulation (EU) 2024/2690 as the binding text for the entity types in its article 1 and as a reference for all others. It then sets out precisely how NIS2 meets the Cyber Resilience Act, Regulation (EU) 2024/2847, which binds manufacturers of products with digital elements: its essential requirements, its SBOM and vulnerability handling duties, the reporting of actively exploited vulnerabilities and severe incidents under article 14, and the application dates of article 71.
- 4 modules, 9 lessons, 102 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 Procurement and Supply Chain Security
Tier and assess suppliers, contract for security, monitor and exit, and use Union risk assessments and certification for what they are worth
Article 21(2)(d) of NIS2 makes supply chain security a mandatory risk-management measure, and article 21(3) says what an entity must weigh when choosing it: the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, including secure development procedures, and the results of Union coordinated risk assessments under article 22. This certification turns those provisions, and section 5 of the annex to Implementing Regulation (EU) 2024/2690, into a working programme: supplier directory and tiering, due diligence, contract clauses, monitoring, incidents at a supplier and exit, European cybersecurity certification under article 24 and Regulation (EU) 2019/881, and the particular case of managed service, managed security service and cloud providers, which can be NIS2 entities in their own right.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Advanced
NIS2 for CISOs and Security Programme Leads
Build, run and evidence an article 21 programme that a supervisor will accept
The practitioner's certification for the person who has to make NIS2 work. It turns article 21 into a sequenced programme built on the ten measures of article 21(2), applies the proportionality factors of article 21(1) and the all-hazards approach, and specifies the evidence each measure needs. It covers when Implementing Regulation (EU) 2024/2690 binds and what its annex adds, how to run the article 23 reporting chain and use voluntary notification under article 30, what supervisors can demand under articles 32 and 33, and how to reuse ISO/IEC 27001, NIST and national frameworks without duplicating work or mistaking a framework for compliance.
- 5 modules, 11 lessons, 118 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 120 points towards your rank
Advanced
NIS2 for Management Bodies
What article 20 asks of a board, the evidence that proves it, and what is at stake when it is missing
Article 20 of Directive (EU) 2022/2555 requires member states to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for infringements, and that its members follow training. This certification covers those duties and the evidence for each: scope and class, challenging a risk analysis, the board's decisions in a significant incident, supervision, fines, temporary management bans, personal liability, governance and supplier risk.
- 5 modules, 10 lessons, 101 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 120 points towards your rank
What changes in your sector: scope, sector law, threats and supervision.
Practitioner
NIS2 for Chemicals: Manufacture, Production and Distribution
Scope through the REACH definitions, Seveso III, process-control measures, reporting and supervision for manufacturers, distributors and producers of articles
The manufacture, production and distribution of chemicals is point 3 of Annex II of NIS2, and the row defines its entities by borrowing three definitions from the REACH Regulation: manufacturer, distributor and article. This certification reads the row and those definitions word for word, shows who they bring in and who they leave out, and declares the questions the wording leaves open, from formulators of mixtures to producers of articles in other industries. It applies the size rule and the class rules to an Annex II sector that the CER Directive does not list; explains what REACH and the Seveso III Directive require of chemical undertakings and why neither displaces NIS2 under article 4; and applies the ten measures, supply chain security, incident reporting and supervision to process control and safety systems, recipes and formulations, and distribution logistics, alongside the Seveso duties a cyber event can trigger when it threatens a major accident.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Digital Infrastructure
Scope, sector law and incident criteria for IXPs, DNS and TLD operators, cloud, data centre and CDN providers, trust services and electronic communications
Annex I, point 8, of NIS2 lists nine digital infrastructure types of entity: five are in scope whatever their size, and DNS service providers, TLD name registries and qualified trust service providers are essential whatever their size. This certification takes Internet Exchange Point, DNS, TLD, cloud, data centre, content delivery network, trust service and electronic communications providers through their exact scope and class, the separate regime of domain name registration services and article 28, the sector law that NIS2 absorbed or sits beside (eIDAS as amended in 2024, the European Electronic Communications Code, the CER Directive), the binding Annex and type-specific incident criteria of Implementing Regulation (EU) 2024/2690, the 24-hour reporting of trust service providers, jurisdiction by establishment, by service or by main establishment, and the ENISA registry.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Digital Providers
Scope, class, incident criteria and supervision for online marketplaces, online search engines and social networking services platforms, kept apart from the Digital Services Act
Annex II, point 6, of NIS2 lists three digital provider types: providers of online marketplaces, of online search engines and of social networking services platforms. They are in scope from medium size, and important entities unless a member state identifies them as essential. This certification takes them through the definitions NIS2 borrows from the Unfair Commercial Practices Directive as amended in 2019 and from the platform-to-business Regulation, the size rule and the classification of article 3, the binding Annex and type-specific incident thresholds of Implementing Regulation (EU) 2024/2690, jurisdiction by main establishment, the EU representative and the ENISA registry. It keeps the Digital Services Act where it belongs: a separate regime of due diligence and systemic risk, not a lex specialis, that a provider may have to meet at the same time.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for the Energy Sector
Scope every energy entity type word for word, apply the ten measures to OT, and run NIS2 beside the electricity network code and CER
Energy is the first sector of Annex I to NIS2: electricity, district heating and cooling, oil, gas and hydrogen, nineteen types of entity in all, from transmission system operators to recharging point operators. This certification reads each entry word for word, applies the size rule and its exceptions, and sorts essential from important entities. It then places NIS2 beside the two other texts an energy company meets: the network code on cybersecurity aspects of cross-border electricity flows (Delegated Regulation (EU) 2024/1366), which binds only the entities identified as high-impact or critical-impact and does not displace NIS2, and the CER Directive, whose critical entities are essential under NIS2 regardless of size. It applies the ten measures of article 21(2) to control rooms, substations, pipelines and charging networks, covers the energy supply chain, and runs incident reporting and supervision across the three regimes.
- 4 modules, 9 lessons, 98 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Banking and Financial Market Infrastructures: NIS2 under DORA
Read the two Annex I rows, place DORA where article 4 puts it, and run what each regime asks of a bank, a trading venue operator or a CCP
Credit institutions, operators of trading venues and central counterparties are Annex I entity types under NIS2 and financial entities under Regulation (EU) 2022/2554 (DORA). Article 4 of NIS2 and article 1(2) of DORA make DORA the sector-specific act that governs their ICT risk management, incident reporting and supervision. This certification quotes the two annex rows word for word, applies the size rule and its exceptions, explains exactly what DORA displaces and what of NIS2 remains, and works through DORA's ICT risk management, testing, third-party risk and major incident reporting at the level the regulation itself sets, together with the group companies and ICT providers that stay within NIS2.
- 4 modules, 9 lessons, 102 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Food: Production, Processing and Distribution
Scope, food law, plant and cold-chain measures, reporting and supervision for food producers, processors and wholesale distributors
Production, processing and distribution of food is point 4 of Annex II of NIS2, and its single row borrows the definition of a food business from Regulation (EC) No 178/2002, the General Food Law. This certification reads that row word for word with the food-law definitions it relies on, separates what it covers (wholesale distribution and industrial production and processing) from what it does not name (retail, catering, restaurants, feed) and records the questions the text leaves open; applies the size rule of Recommendation 2003/361/EC, including seasonal staff and group structures, and compares the differently worded food row of the CER Directive; explains why the traceability, withdrawal, recall and rapid alert provisions of the General Food Law do not displace NIS2 under article 4, and where a cyber incident engages both; and applies the ten measures, supply chain security, incident reporting and supervision to production lines, cold-chain monitoring, warehouse and transport systems and electronic data interchange with customers.
- 4 modules, 9 lessons, 98 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for the Health Sector
Hospitals, laboratories, pharmaceutical and medical device manufacturers: scope, device law, health data and continuity of care
Health is point 5 of Annex I of NIS2: healthcare providers, EU reference laboratories, research and development of medicinal products, pharmaceutical manufacturing and the makers of medical devices critical during a public health emergency, while every other medical device and in vitro diagnostic manufacturer sits in Annex II. This certification reads those entries word for word, applies the size rule and the classes, sets NIS2 beside the medical device regulations, the GDPR and the CER Directive, applies the ten measures where continuity of care is the first constraint, and runs incident reporting and supervision in a sector where one event can trigger four regimes.
- 4 modules, 9 lessons, 95 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for ICT Service Management
Scope, class, jurisdiction, the binding Annex and incident criteria of Implementing Regulation (EU) 2024/2690, and supervision for managed service and managed security service providers
Annex I, point 9, of NIS2 lists managed service providers and managed security service providers under ICT service management (business-to-business). Unlike DNS or trust service providers, they are in scope only from medium size, unless a member state identifies them, and essential above the medium-sized ceilings. This certification takes MSPs and MSSPs through the definitions of article 6(39) and 6(40) and the services that add other entity types, the size rule and classification, the binding Annex of Implementing Regulation (EU) 2024/2690 applied to privileged access, customer segregation and change deployment, their own supply chain, the incident criteria of articles 3 and 10 of that Regulation, jurisdiction by main establishment and the ENISA registry, and what DORA adds when customers are financial entities, without displacing NIS2 for the provider itself.
- 4 modules, 9 lessons, 102 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for the Manufacturing Sector
Medical devices, electronics, electrical equipment, machinery and vehicles: scope by NACE division, the Cyber Resilience Act beside NIS2, and security on the shop floor
Manufacturing is point 5 of Annex II of NIS2 and the only Annex II sector divided into subsectors: makers of medical devices and in vitro diagnostic medical devices, and undertakings carrying out the activities of NACE Rev. 2 divisions 26 to 30, from electronic components to machinery, motor vehicles and other transport equipment. This certification reads those entries word for word with the classification they borrow, applies the size rule and the classes, separates the Cyber Resilience Act, which governs the products a manufacturer places on the market, from NIS2, which governs the systems it runs, and applies the ten measures, supply chain security, incident reporting and supervision to production plants.
- 4 modules, 9 lessons, 90 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Postal and Courier Services
Scope, class, the Postal Services Directive, sorting and tracking security, last-mile supply chain, reporting and supervision for postal and courier providers
Postal and courier services are point 1 of Annex II of NIS2, and the row borrows its definition from the Postal Services Directive 97/67/EC, in a point inserted by Directive 2008/6/EC. This certification reads the row and the definitions it imports word for word, including the courier clause and what recital 12 says about transport alone; applies the size rule to operators with seasonal staff, subcontracted couriers and group structures; explains why a large postal provider is important rather than essential unless a Member State identifies it, and why a designated universal service provider is not essential by designation alone; shows why the Postal Services Directive does not displace NIS2 under article 4 and why the CER Directive does not reach the sector; and applies the ten measures, supply chain security, incident reporting and supervision to sorting centres, tracking platforms, customer APIs, delivery devices and last-mile partners, alongside the GDPR obligations a postal incident can trigger.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Public Administration
Scope, class, exclusions and the adapted supervision regime for central government and regional public administration entities
Annex I, point 10, of NIS2 lists two types of entity: public administration entities of central governments, and public administration entities at regional level, each as defined by a member state in accordance with national law. Central government entities are in scope whatever their size and are essential; regional entities are in scope where, following a risk-based assessment, they provide services whose disruption could have a significant impact on critical societal or economic activities. This certification takes ministries, agencies and regional authorities through the definition of article 6(35) and the bodies it leaves out, the national security and law enforcement exclusion of article 2(7) and the exemptions of article 2(8), the member-state options for the local level and education institutions, the CER Directive and the GDPR, the ten measures of article 21(2) and procurement as the supply chain channel, incident reporting to authorities and to citizens, and a supervision regime in which the measures of article 32(5) are not applicable and fines on public bodies are left to each member state.
- 4 modules, 9 lessons, 94 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Research Organisations
Applied research institutes and R&D organisations: the definition element by element, open collaboration, research data and intellectual property
Research is point 7 of Annex II of NIS2. Its only type of entity, research organisations, is defined in article 6(41): an entity whose primary goal is to conduct applied research or experimental development with a view to exploiting the results for commercial purposes, excluding educational institutions. This certification reads that definition element by element and says what it leaves open, applies the size rule and the classes, sets NIS2 beside the GDPR rules for research data, the CER Directive and Implementing Regulation 2024/2690, applies the ten measures where open collaboration, guest researchers, shared infrastructures and unpublished results meet industrial espionage, and runs incident reporting and supervision for an important entity.
- 4 modules, 9 lessons, 94 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for the Space Sector
Scope, class, CER and incident reporting for operators of ground-based infrastructure that support space-based services
Annex I, point 11, of NIS2 brings one type of entity into scope for space: operators of ground-based infrastructure, owned, managed and operated by Member States or by private parties, that support the provision of space-based services, excluding providers of public electronic communications networks. This certification reads that row element by element and declares what it leaves open. It then takes operators of ground stations, control centres and space data facilities through size and class, the CER Directive that lists the same row and keeps its obligations for space, the boundary with electronic communications under Annex I, point 8, the threats the ground segment's operating model exposes it to, the ten measures and the supply chain in that reality, significant-incident reporting with dependent services and cross-border impact, and the kinds of authority that supervise them.
- 4 modules, 9 lessons, 98 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for the Transport Sector
Air, rail, water and road under NIS2: the annex word for word, aviation Part-IS and CER alongside it, the measures in operations, reporting and supervision
Annex I of NIS2 lists ten types of transport entity across four subsectors, from commercial air carriers and airport managing bodies to railway undertakings, port managing bodies, vessel traffic services and operators of intelligent transport systems, each defined by reference to another Union act. This certification reads that annex word for word, applies the size rule, the size-independent cases and the critical-entity route of the CER Directive, and sets out the class each entity falls into. It then places the aviation information security rules of Implementing Regulation (EU) 2023/203 and Delegated Regulation (EU) 2022/1645 (Part-IS) and the CER Directive next to NIS2: whom each binds, what each requires, from when, and why none of them displaces NIS2 unless the equivalence test of article 4 is met. The second half applies the ten article 21(2) measures and the supply chain duty to transport operations, where safety, round-the-clock service and many interfacing operators shape every control, runs the article 23 reporting chain alongside the Part-IS and CER notifications, and maps the authorities that supervise a transport entity, closing with a full case study.
- 4 modules, 9 lessons, 96 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Waste Management
Scope, waste law, plant and fleet measures, reporting and supervision for undertakings that collect, transport, recover, dispose of, deal in or broker waste
Waste management is point 2 of Annex II of NIS2, defined by reference to article 3, point (9), of the Waste Framework Directive 2008/98/EC as replaced by Directive (EU) 2018/851. This certification reads the annex row and the borrowed definitions word for word, applies the principal-economic-activity exclusion exactly as it is written and declares what the text leaves open; applies the size rule to public and private operators, including the disapplication of the public-body rule of Recommendation 2003/361/EC; explains why a large waste operator is still an important entity unless it is identified as essential or is also of an Annex I type, and why the CER route does not reach waste management as such; shows that EU waste law contains no cybersecurity obligation that could displace NIS2 under article 4; and applies the ten measures, supply chain security, incident reporting and supervision to collection fleets, weighbridges, sorting plants, incinerators, landfills and hazardous-waste traceability.
- 4 modules, 9 lessons, 94 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
Practitioner
NIS2 for Water: Drinking Water and Waste Water
Scope, sector law, control-system measures, reporting and supervision for water suppliers, distributors and waste-water undertakings
Drinking water and waste water are Annex I sectors of NIS2, and the same two rows define the water operators from which Member States identify critical entities under the CER Directive. This certification reads both annex rows word for word, with the definitions they borrow from the Drinking Water Directive and the urban wastewater legislation and their exclusion clauses; applies the size rule to public and private operators, including the disapplication of the public-ownership rule of Recommendation 2003/361/EC; explains why neither the Drinking Water Directive (EU) 2020/2184 nor the urban wastewater recast (EU) 2024/3019 displaces NIS2 under article 4; and applies the ten measures, supply chain security, incident reporting and supervision to treatment works, networks, remote sites and telemetry, alongside the CER, drinking-water and GDPR obligations an incident can trigger.
- 4 modules, 9 lessons, 95 minutes
- Assessment: 20 questions, 70% to pass, 3 attempts
- Verifiable certificate with a public check page
- 90 points towards your rank
