NIS2 for everyone in the organisation

In this lesson

• Explain in one sentence why NIS2 concerns you, whatever your job.
• Tell apart what the directive asks of your organisation, of its management body and of you.
• Read the two words of article 21(2)(g), “cyber hygiene”, as a list of everyday habits rather than a technical project.
• Name the three things this course asks of you: recognise, protect, report.

The one sentence to remember

If someone asks you why a European cybersecurity law has anything to do with your job, this is the answer: NIS2 requires your organisation to manage cybersecurity risk and to report serious incidents fast, and it can only do either if the people who use its systems every day behave safely and speak up quickly.

You do not need to know the directive by heart, only what it expects to happen at your desk, on your phone and in your inbox, and why.

What NIS2 is, in plain terms

Art. 41(1)

NIS2 is Directive (EU) 2022/2555, adopted on 14 December 2022. A directive is addressed to the member states of the European Union: each state has to turn it into its own national law. Article 41 required the states to adopt and publish those national measures by 17 October 2024 and to apply them from 18 October 2024. What actually binds your employer is therefore the national law of the country where it operates. Who your organisation reports to, how it registers and some deadlines differ from one country to another, and our transposition pages track those national details. This course stays with what is common to all of them.

Art. 2 and 3

The directive covers organisations it calls “essential entities” and “important entities”. They work in the sectors listed in its two annexes: eleven sectors of high criticality in Annex I, such as energy, transport, banking, health, drinking water, digital infrastructure and public administration, and seven other critical sectors in Annex II, such as postal and courier services, waste management, food, manufacturing and research. As a rule they must be medium-sized or larger, but some are covered whatever their size. If you are taking this course, your organisation is probably one of them, or supplies one.

Three levels: the organisation, its management, and you

The organisation: take measures, and report

Art. 21(1) and (2)

Article 21(1) requires member states to ensure that essential and important entities take “appropriate and proportionate technical, operational and organisational measures” to manage the risks to the network and information systems they use. Article 21(2) lists ten areas those measures must at least cover, from risk analysis to backups, supplier security and encryption. Point (g) of that list is the one this course is about: “basic cyber hygiene practices and cybersecurity training”. Training and good daily habits are not an optional extra: they are one of the ten measures every covered organisation must take.

Art. 23(1) and (4)

Article 23 adds a reporting duty. When a significant incident happens, the organisation must send an early warning to its national CSIRT (computer security incident response team) or competent authority “without undue delay and in any event within 24 hours of becoming aware” of it, then a fuller notification within 72 hours, then a final report. Module 4 explains why that clock depends on you.

The management body: approve, oversee, be trained

Art. 20

Under article 20(1), the management body, the board or the executive team depending on how your organisation is set up, approves the cybersecurity measures, oversees their implementation and can be held liable for the organisation’s infringements of article 21. Article 20(2) requires member states to ensure that its members “are required to follow training”. For them, training is compulsory.

You: what the directive actually says about staff

Here precision matters, because the point is often misquoted. Article 20(2) does not impose a training obligation on employees. Its second half says that member states “shall encourage essential and important entities to offer similar training to their employees on a regular basis”. That is encouragement addressed to states, not a duty placed on you.

Your duties come from somewhere else: from your employer. To meet article 21(2)(g), your organisation has to put cyber hygiene practices and cybersecurity training in place, and it does that through policies, rules and courses like this one. When your organisation asks you to complete training, lock your screen or report a suspicious email, it is implementing a measure the law requires it to take. The directive speaks to the organisation; the organisation speaks to you.

What “cyber hygiene” means

Recital 49

The articles do not define cyber hygiene, but the recitals, the explanatory paragraphs at the start of the text, describe it. Recital 49 speaks of “a common baseline set of practices, including software and hardware updates, password changes, the management of new installs, the limitation of administrator-level access accounts, and the backing-up of data”.

Recital 89

Recital 89 goes further. It says entities should adopt “a wide range of basic cyber hygiene practices, such as zero-trust principles, software updates, device configuration, network segmentation, identity and access management or user awareness”, and should “organise training for their staff and raise awareness concerning cyber threats, phishing or social engineering techniques”.

Hygiene is a good word for it. Washing your hands does not make you immune to every illness, but it stops a great deal of everyday infection, costs very little, and only works if everyone does it. The same is true of updates, unique passwords, thinking before you click, and speaking up.

Why your laptop, phone and badge are “network and information systems”

Art. 6(1) and (6)

The directive protects “network and information systems”. Article 6(1) defines them broadly: an electronic communications network, any device that carries out automatic processing of digital data, and the digital data stored, processed, retrieved or transmitted by them. Your laptop, your work phone, the shared printer, the badge reader at the door and the spreadsheet you are editing all fall within that definition.

Article 6(6) defines an incident as “an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems”. In plain words, an incident is anything that makes data or a service unavailable, untrustworthy, altered or exposed. Notice what the definition does not say: it does not require an attacker. A file sent to the wrong person, a laptop left on a train or a database deleted by mistake can all be incidents.

Art. 21(2)

Article 21(2) also says the measures follow “an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents”. Physical security is part of the picture. A fire door propped open next to the server room, or a visitor who follows you through a badge-controlled door, is a cybersecurity matter.

Recognise, protect, report

This course turns all of the above into three habits.

• Recognise. Attacks can start with something ordinary: an email, a text, a phone call, a request that seems to come from your boss. Lesson 1.2 and module 3 teach you to spot them.
• Protect. Your accounts, devices and data are the doors an attacker wants to open. Modules 2 and 3 and lesson 4.2 cover them, at the office and away from it.
• Report. The organisation has 24 hours from becoming aware of a significant incident to warn the authorities, and it cannot become aware of what nobody tells it. Lesson 4.1 explains what to report, how, and why immediately.

If you work for a supplier

Art. 21(2)(d) and 21(3)

Some people taking this course work for a company that is not itself covered but supplies one that is: an IT provider, a maintenance contractor, a software vendor. Article 21(2)(d) requires covered entities to manage supply chain security, and article 21(3) requires them to take into account “the overall quality of products and cybersecurity practices of their suppliers and service providers”. Your habits are part of your customer’s risk assessment. A supplier’s employee who reuses a password or opens a malicious attachment can be the way into a hospital or a water utility.

What a supervisor will ask

• “How do you deliver cyber hygiene and cybersecurity training under article 21(2)(g)?” The training plan, the content, and records of who completed what and when.
• “Have the members of the management body followed training, as article 20(2) requires?” Attendance records for each member, kept separately from staff training.
• “Do staff know the rules?” Policies people can find, and staff who can say how they would report a suspicious event. A policy nobody has heard of is weak evidence that a measure is in place.

Key points

• NIS2 requires your organisation to manage cyber risk and report significant incidents fast; both depend on what everyone does every day.
• Article 21(2)(g), “basic cyber hygiene practices and cybersecurity training”, is one of the ten measures every essential and important entity must take.
• Members of the management body must follow training (article 20(2)). For employees, the directive asks member states to encourage regular training; your own duties come from your employer’s policies.
• An incident does not need an attacker: a lost laptop or a misdirected email can be one.
• National law decides the details; the habits in this course are the same everywhere.