NIS2 for HR and Security Awareness

In this lesson

Locate every provision of NIS2 that turns on people, and quote the two minimum measures that HR and awareness teams own: points (g) and (i) of article 21(2).
Explain why the directive binds your organisation through national law, and why Implementing Regulation (EU) 2024/2690 binds only some entity types.
Split the work between HR, security, the data protection officer, line managers and the management body without leaving gaps.
Place this certification next to the employee course and the board course, so that each audience gets the right content.

Why a directive about networks talks about people

Directive (EU) 2022/2555 is about the security of network and information systems, yet the legislator was explicit that technology alone does not make a system secure. Recital 78 says that cybersecurity risk-management measures “should provide for systemic analysis, taking into account the human factor, in order to have a complete picture of the security of the network and information system.”

The human factor runs in two directions. People detect: an employee who reports a strange e-mail gives the security team time. People are also a source of risk: an account that outlives its owner, an administrator with more rights than the job needs, a new hire who was never told how to report an incident. NIS2 addresses both, and much of the practical work sits with HR and with whoever runs security awareness.

Recital 89

Recital 89 describes the expected baseline. Essential and important entities “should adopt a wide range of basic cyber hygiene practices, such as zero-trust principles, software updates, device configuration, network segmentation, identity and access management or user awareness, organise training for their staff and raise awareness concerning cyber threats, phishing or social engineering techniques.” A recital explains the intent of the articles; it does not create obligations of its own. The obligations are in article 21.

The two measures that belong to you

Art. 21(1)

Article 21(1) requires “appropriate and proportionate technical, operational and organisational measures” to manage the risks posed to the security of network and information systems. Proportionality is not a loophole: when assessing it, “due account shall be taken of the degree of the entity's exposure to risks, the entity's size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.” A hospital and a small software firm will not run the same awareness programme, but both must be able to explain why theirs fits their risks.

Art. 21(2)(g), (i)

Article 21(2) then lists ten minimum measures, introduced by the words “shall include at least the following”. Two of them are about people:

Point (g): “basic cyber hygiene practices and cybersecurity training”.
Point (i): “human resources security, access control policies and asset management”.

Point (g) is where the entity's own duty to train its staff comes from. Point (i) joins three subjects that fail together in practice: the person who is hired, the access that person receives, and the equipment and information the person holds. An HR process that does not talk to the access control process produces leavers with live accounts and laptops that never come back.

Other points depend on people too. Incident handling, point (b), starts when someone reports a suspicious event. Point (f) requires “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”, training included. This certification focuses on (g) and (i) and touches the others where HR meets them.

How the directive reaches your organisation

Art. 46

Article 46 states it plainly: “This Directive is addressed to the Member States.” Article 21 obliges each member state to ensure that entities take the measures; what binds your organisation is the national law that transposes the directive. Article 5 allows member states to adopt or maintain provisions “ensuring a higher level of cybersecurity”. National texts may therefore add detail on training, on screening of staff in sensitive roles or on documentation. This course teaches the European layer; for the national texts and their status, start from the transposition tracker.

Employment law is national too. Whether you may ask a candidate for a criminal record extract, whether employee representatives must be consulted before a phishing simulation, how a disciplinary sanction is imposed: none of this is decided by NIS2. The directive tells you what security outcome to achieve. National labour and data protection rules tell you how you may achieve it. Module 4 returns to that boundary.

Implementing Regulation 2024/2690: precise, but not for everyone

Reg. 2024/2690, art. 1

Article 21(5) of the directive required the Commission to adopt implementing acts for a list of digital entity types. The result is Commission Implementing Regulation (EU) 2024/2690. Its article 1 names the entities it covers, the “relevant entities”: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers.

For those entities, the annex is binding and detailed. Section 8 covers basic cyber hygiene practices, awareness raising and security training, section 10 human resources security, including background verification, termination or change of employment and the disciplinary process, section 11 access control and section 12 asset management, including the return of assets on departure. For every other essential or important entity, the regulation is not an obligation. It remains a detailed official description of what the measures can look like, and any entity may use it as a reference. This course always says which of the two situations a requirement belongs to.

Reg. 2024/2690, art. 2(2)

One mechanism of the regulation matters for HR from the start. Several annex requirements apply “where appropriate”, “where applicable” or “to the extent feasible”. Article 2(2) says that where a relevant entity considers such a requirement not appropriate, not applicable or not feasible, it “shall in a comprehensible manner document its reasoning to that effect.” Background verification is one of those requirements. A relevant entity that decides not to verify the background of anyone therefore needs a written reason, not just silence.

Who does what

NIS2 does not say which department carries each task. It speaks of the entity, and in article 20 of the management body. The allocation below is practice, not law: adapt it to your organisation, but make sure every line has an owner.

Actor	Owns	Gap to watch for
Management body	Approves the article 21 measures, oversees them, and its members follow training (article 20)	Board training organised once, never for new members
HR	Hiring checks, contracts and post-employment clauses, joiner-mover-leaver events, disciplinary process, training records	Leaver dates reach IT late or not at all
Security function	Awareness content, role-based training needs, access reviews, simulations, effectiveness indicators	Content chosen without a link to the entity's risks
Data protection officer, where designated	Legal basis, transparency, minimisation and impact assessment for screening, simulations and monitoring	Consulted after the tool is bought
Line managers	Confirm role changes, approve access, ensure their teams complete training	Approve access requests without reading them

A sound design gives the joiner-mover-leaver process a single source of truth, the HR system, and makes every access change follow from an HR event. The evidence is then produced as a by-product.

Data protection runs alongside

Art. 2(12), 2(14)

Almost everything in this course processes personal data about staff: training results, simulation clicks, screening outcomes, access logs, disciplinary files. Article 2(12) states that the directive “applies without prejudice to Regulation (EU) 2016/679”, the GDPR. Article 2(14) requires entities to “process personal data to the extent necessary for the purposes of this Directive and in accordance with Regulation (EU) 2016/679, in particular such processing shall rely on Article 6 thereof.” NIS2 gives you a reason to process; it does not set aside a single GDPR rule. Lesson 4.2 works through what that means for screening and for measuring awareness.

Three audiences, three courses

This certification is for the people who design the programme: HR, awareness leads, security managers and data protection officers. Two other certifications serve the people the programme reaches:

Employees, contractors and temporary staff: the NIS2 All Staff: Cyber Hygiene certification is the employee-facing course, covering accounts, phishing, devices, data handling and reporting.
Members of the management body: the NIS2 for Management Bodies certification covers the content of board training, from article 20 duties to supervision and liability.

In practice

A fictional case. Halden Rail is a railway undertaking running passenger and freight trains in two member states, with 900 employees. Its legal team has concluded that it is in scope of NIS2: railway undertakings are listed under transport in Annex I. The CISO asks the HR director for a people plan within a month.

The HR director starts with a map, not a training catalogue. For point (g): who must be trained (the nine members of the management body, all staff, and the 40 people in roles that need security skills, such as system administrators and the traffic control room), on what, and how often. For point (i): the hiring checks applied today, the contract clauses on confidentiality, the leaver process, and how long it takes for a departure recorded in the HR system to disable accounts.

The map shows three gaps. Departures reach IT by e-mail, on average four days late. Nobody can say which board members have followed training. Background checks differ by country with no written criteria. Halden is not a relevant entity under Regulation 2024/2690, so section 10 of its annex is not binding on it; the HR director still uses it as the reference structure for the plan, and records that choice.

What a supervisor will ask

How does the entity implement basic cyber hygiene practices and cybersecurity training under article 21(2)(g)? The awareness programme, the role-based training plan and the attendance records.
How does the entity implement human resources security under article 21(2)(i)? The joiner-mover-leaver procedure and evidence that it runs.
Who owns each of these measures? A responsibility matrix approved as part of the measures.
For a relevant entity under Regulation 2024/2690: where has the entity decided that an annex requirement is not appropriate, applicable or feasible, and where is the reasoning documented?

Key points

Recital 78 asks the measures to take “the human factor” into account; recital 89 lists hygiene practices, staff training and awareness of phishing and social engineering.
Article 21(2)(g) and (i) are the two minimum measures about people: hygiene and training; HR security, access control and asset management.
The directive is addressed to member states; national law binds the entity and may go further (article 5). Employment law stays national.
Regulation 2024/2690 binds only the entity types of its article 1; for them, a qualified requirement that is not applied needs documented reasoning (article 2(2)).
NIS2 applies without prejudice to the GDPR, and processing of staff data must rely on article 6 of the GDPR.