Art. 21(2)(g) NIS2 All Staff: Cyber Hygiene — certification
Cyber hygiene for every employee, in plain language: accounts and multi-factor authentication, phishing and payment fraud, devices and data, and why the organisation's 24-hour early warning depends on staff reporting at once.
- 9 lessons across 4 modules, about 1 h 32 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 65, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Explain in one sentence why NIS2 concerns every employee, and tell apart what it requires of the organisation, of its management body and of staff
- Recognise phishing, smishing, vishing, voice cloning and payment fraud, and verify an unusual request through a channel you already trust
- Protect your accounts with unique passphrases, a password manager and multi-factor authentication, and recognise how attackers get around multi-factor authentication
- Keep devices and removable media safe: updates, screen locking, approved software only, and the right reaction when a device is lost or stolen
- Handle and share data, cloud services and AI tools without causing a leak, and recognise a personal data breach under the GDPR
- Report a suspected incident immediately through the right channel, and explain why the organisation's 24-hour early warning depends on that report
- Work securely away from the office: at home, while travelling, on public networks and on social media
Art. 23 NIS2 Incident Response and Reporting — certification
Qualify a significant incident, run the 24-hour, 72-hour and one-month reporting chain from the moment of becoming aware, work with CSIRTs and authorities, and handle the GDPR and other notifications that run in parallel.
- 9 lessons across 4 modules, about 1 h 32 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 66, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Qualify an event as an incident, a significant incident, a near miss or a cyber threat, applying article 23(3) of the directive and, for the entities it covers, articles 3 to 14 of Implementing Regulation (EU) 2024/2690
- Fix the moment of becoming aware and run the 24-hour, 72-hour and one-month deadlines of article 23(4) from it, including the trust service provider derogation and the progress report
- Draft the early warning, incident notification, intermediate report and final report with the content article 23(4) requires
- Work with the CSIRT, the competent authority and the single point of contact, including for cross-border and cross-sectoral incidents
- Decide when and how to inform recipients of services of a significant incident or a significant cyber threat, and prepare for public disclosure under article 23(7)
- Run the GDPR breach notification and other parallel regimes (DORA, CER) alongside the NIS2 chain, each with its own trigger, addressee and deadline
- Use voluntary notification under article 30 and information-sharing arrangements under article 29 for near misses, cyber threats and non-significant incidents
- Conduct a post-incident review and assemble the evidence file a supervisor will request
Art. 20 NIS2 for Management Bodies — certification
What article 20 asks of a management body and how to evidence it: approving and overseeing the measures, the training its members must follow, the board's decisions in a significant incident, supervision, fines and the personal exposure of article 32.
- 10 lessons across 5 modules, about 1 h 41 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 72, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Set out the article 20 duties of a management body (approve the measures, oversee their implementation, be held liable for infringements, follow training) and the evidence that demonstrates each one
- Determine whether the organisation is in scope of NIS2 and whether it is an essential or an important entity, and record that determination as a board decision
- Challenge a cybersecurity risk analysis and the measures management proposes against the all-hazards and proportionality requirements of article 21
- Take the decisions that belong to the management body during a significant incident, from the reporting chain of article 23 to communication with service recipients
- Assess the exposure of the entity and of its leaders under articles 32, 33 and 34: supervisory measures, administrative fines, temporary management bans under article 32(5)(b) and personal liability under article 32(6)
- Set the governance that makes oversight real: roles, the security function's reporting line, indicators, budget, minutes and training records
- Oversee at board level the supply-chain and third-party measures that articles 21(2)(d) and 21(3) require
Art. 21 NIS2 for CISOs and Security Programme Leads — certification
Build and run a NIS2 programme on the ten measures of article 21(2): proportionality, the evidence file, Implementing Regulation (EU) 2024/2690 for the entities it binds, reporting, supervision, and reusing ISO/IEC 27001 or NIST work without duplicating it.
- 11 lessons across 5 modules, about 1 h 58 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 69, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Build a NIS2 security programme on the ten measures of article 21(2), with owners, sequencing and the corrective duty of article 21(4)
- Apply the proportionality factors of article 21(1) and the all-hazards approach, and document decisions not to apply a requirement
- Specify, for each measure, the evidence artefacts that demonstrate it is implemented and effective
- Manage registration and the relationship with the competent authority, and prepare for the supervisory measures of articles 32 and 33
- Operate the article 23 reporting chain, voluntary notification under article 30 and information sharing under article 29
- Determine whether Implementing Regulation (EU) 2024/2690 binds an entity, and apply its annex and significance criteria
- Reuse ISO/IEC 27001, NIST and national frameworks without duplicated work, and without presenting a framework or certificate as compliance
- Report to the management body on programme status, effectiveness and residual risk
Art. 21(2)(c) NIS2 Business Continuity and Crisis Management — certification
Business continuity, backup management, disaster recovery and crisis management under article 21(2)(c): impact analysis, restoration testing, crisis communication, exercises, and how continuity meets incident reporting and the CER directive.
- 9 lessons across 4 modules, about 1 h 30 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 68, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Scope continuity under article 21(2)(c), separating what the directive requires of every essential and important entity, what Implementing Regulation (EU) 2024/2690 requires of the entity types in its article 1, and what is good practice
- Conduct a business impact analysis and set recovery objectives and a recovery order that drive the business continuity and disaster recovery plan
- Design backup and redundancy that survive ransomware, insider action and the loss of a site, and prove recoverability through restoration testing
- Organise crisis management: activation criteria, roles and decision rights, deputies, out-of-band communications and the interface with the CSIRT and competent authority
- Communicate during a crisis with staff, recipients of services, authorities and the public, applying article 23(1), (2) and (7) and keeping every audience consistent
- Plan and run an exercise programme and turn findings and post-incident lessons into updated plans and corrective measures
- Run recovery and the article 23 reporting chain in parallel, and articulate NIS2 with the resilience and notification obligations of critical entities under Directive (EU) 2022/2557
- Assemble the evidence file that demonstrates article 21(2)(c) to a supervisor, an auditor or the management body
Art. 21(1) NIS2 Risk Management — certification
The all-hazards risk analysis NIS2 expects: the proportionality factors of article 21(1), risk criteria and treatment, residual risk accepted by the management body, supply chain and Union coordinated assessments, and measuring effectiveness.
- 9 lessons across 4 modules, about 1 h 30 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 72, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Run an all-hazards risk analysis that covers network and information systems and the physical environment of those systems, as article 21(2) requires
- Apply the proportionality factors of article 21(1) and set risk criteria, scales and a risk tolerance the management body can approve, telling legal requirement from practice
- Identify, analyse and evaluate risks as incident scenarios, using the definition of risk in article 6(9) and, where it applies, the risk management framework of Implementing Regulation (EU) 2024/2690
- Build a risk treatment plan with owners and dates, obtain acceptance of residual risk from the right person, and treat non-compliance as a corrective action under article 21(4)
- Integrate supplier-specific risk under article 21(3) and the results of Union-level coordinated security risk assessments of critical supply chains under article 22
- Design the policies and procedures to assess the effectiveness of cybersecurity risk-management measures that article 21(2)(f) requires
- Report risk to the management body for approval and oversight under article 20, and assemble the evidence a supervisor can request under articles 32 and 33
Art. 21(2)(d) NIS2 for ICT Suppliers to Regulated Entities — certification
For SaaS vendors, MSPs and integrators selling to NIS2 entities: whether NIS2 applies to you directly, what your customers must ask of you under article 21(3), clauses, notification in time for their deadlines, vulnerability disclosure and the proof that holds.
- 9 lessons across 4 modules, about 1 h 31 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 69, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Determine whether your company is itself an essential or important entity, applying the Annex I entity types, the definitions of article 6, the size rule of article 2(1) with Recommendation 2003/361/EC, the size-independent cases of article 2(2) and (4), the classification of article 3 and the scope of Implementing Regulation (EU) 2024/2690
- Explain precisely how requirements reach a supplier that NIS2 does not bind, through the customer's supply chain measures under article 21(2)(d) and the factors of article 21(3), and anticipate the requests that follow
- Answer security questionnaires and accommodate audits with scoped, evidence-backed responses, without claiming a compliance you cannot have
- Negotiate the security clauses regulated customers propose, from point 5.1.4 of the Annex to Implementing Regulation (EU) 2024/2690 to GDPR processor terms and DORA contract requirements, accepting what you can deliver and amending what you cannot
- Design a customer notification process that lets customers meet the 24-hour and 72-hour deadlines of article 23(4), which run from their own awareness, while distinguishing contractual duties from the statutory duties of an in-scope supplier or a GDPR processor
- Operate a vulnerability disclosure policy and patch commitments consistent with article 12, the national coordinated vulnerability disclosure policy and the European vulnerability database
- Use certifications, attestation reports and frameworks, including European cybersecurity certification under Regulation (EU) 2019/881, as evidence of what they cover and never as proof of NIS2 compliance
- Assemble a supplier security pack and price the compliance effort, including when and how to decline a requirement
Art. 21(2)(d) NIS2 Procurement and Supply Chain Security — certification
Supply chain security under article 21(2)(d) and 21(3): tiering and assessing suppliers, contract clauses, monitoring and exit, Union coordinated risk assessments, certification schemes and what they prove, and managed service and cloud providers.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 69, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Apply article 21(2)(d) and the considerations of article 21(3) to an entity's supply chain, separating the legal perimeter of direct suppliers and service providers from the risk-based extension further down the chain
- Build a supplier directory and tier suppliers by criticality, access and substitutability, identifying the critical ICT suppliers that need the deepest treatment
- Run proportionate due diligence before contract, including the assessment of secure development procedures, product quality and supplier-specific vulnerabilities, and record the decision
- Draft and negotiate security clauses on requirements, staff, incident notification, audit, vulnerabilities, subcontracting and termination, aligned with article 28 of the GDPR where personal data is processed
- Monitor suppliers during the contract, handle an incident at a supplier against the entity's own reporting deadlines, and plan exit and substitution
- Take into account Union coordinated security risk assessments under article 22 and non-technical risk factors in sourcing decisions
- Use European cybersecurity certification schemes and certificates under article 24 and Regulation (EU) 2019/881 for what they prove, at an assurance level commensurate with the risk
- Oversee managed service providers, managed security service providers and cloud providers, knowing when they are NIS2 entities themselves under Annex I and what that does and does not change for their customers
Art. 2–4 NIS2 for Legal, Compliance and DPOs — certification
Scope and classification, jurisdiction and the ENISA registry, lex specialis and DORA, the interplay with the GDPR and the CER directive, supply chain contracts, supervision, enforcement and the liability of management and natural persons.
- 10 lessons across 5 modules, about 1 h 57 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 65, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Read NIS2 as a directive: separate the obligations it places on entities through national law from those on member states, the national options and the Union-level acts, and keep a watch on national transposition
- Determine whether an entity is in scope of NIS2, applying the Annex types, the size cap of Recommendation 2003/361/EC with linked and partner enterprises, the size-independent cases and the exclusions of article 2, and whether it is an essential or an important entity under article 3
- Establish which member state has jurisdiction under article 26, including the main establishment rule for the listed digital entities, and the registration and information duties that follow from articles 3(4) and 27
- Apply article 4 and the sector-specific act rules, including DORA for financial entities, to decide which provisions of NIS2 apply to an entity and which authority supervises it
- Coordinate NIS2 with the GDPR and the CER Directive: parallel notifications, the article 35 cooperation with data protection authorities, the rule against a double fine, lawful processing of personal data and confidentiality
- Draft and review supplier contract clauses that support articles 21(2)(d) and 21(3), distinguishing contractual practice from what the law actually requires
- Advise on supervision and enforcement under articles 31 to 37: the ex ante and ex post regimes, information requests, the procedural safeguards, administrative fines and mutual assistance between member states
- Assess the exposure of the management body and of natural persons under articles 20, 32(5)(b), 32(6) and 33(5), and identify what the directive leaves to national law
Art. 21(2)(f) NIS2 Internal Audit and Assurance — certification
Assess the effectiveness of the measures as article 21(2)(f) requires: an audit programme against article 21, testing evidence, auditing the management body's article 20 duties, preparing for the authority's inspections and targeted audits, reporting and follow-up.
- 9 lessons across 4 modules, about 1 h 37 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 66, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Separate what article 21(2)(f) requires of every essential and important entity, what Implementing Regulation (EU) 2024/2690 requires of the entity types in its article 1, and what internal-audit methodology adds as practice
- Plan a risk-based audit universe and programme covering article 20, the ten measures of article 21(2), article 21(4) and article 23, with event-driven triggers and an assurance map
- Audit the management body's article 20 duties: the approval of the measures, the oversight of their implementation and the training of its members
- Test the evidence for each of the ten measures, with complete populations, reproducible samples and evidence graded by sufficiency, relevance and reliability
- Report findings and an opinion on effectiveness to the management body, labelling each criterion as law, implementing regulation, internal policy or good practice
- Prepare the entity for inspections, security scans, requests and the regular, targeted and ad hoc security audits of articles 32 and 33, distinguishing essential from important entities
- Track remediation to validated closure under article 21(4) and under supervisory instructions and orders, keeping risk acceptance within its limits
- Use ISO/IEC 27001 certification audits and other external assurance as evidence without treating a certificate as compliance with NIS2
Art. 21(2)(g) NIS2 for HR and Security Awareness — certification
The people side of NIS2: training for management-body members under article 20(2), an awareness programme for staff under article 21(2)(g), HR security from screening to offboarding, measuring effectiveness within privacy limits, and the records a supervisor asks for.
- 9 lessons across 4 modules, about 1 h 33 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 71, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Explain where people sit in NIS2, and tell apart the three training provisions: members of the management body are required to follow training, member states encourage entities to train employees (art. 20(2)), and cybersecurity training is part of the entity's own measures (art. 21(2)(g))
- Organise and record the training of the members of the management body so that it meets the purpose stated in article 20(2)
- Design an awareness programme and role-based security training that meet article 21(2)(g) and, for the entities it binds, section 8 of the annex to Implementing Regulation (EU) 2024/2690
- Measure whether awareness and training change behaviour, with indicators and simulations that respect the privacy of staff
- Secure the employment lifecycle under article 21(2)(i): screening within the limits of the law, onboarding, role changes, offboarding and the revocation of access and return of assets
- Set security policies, staff acknowledgements, post-employment duties and a disciplinary process for violations of security policies
- Apply the GDPR to HR security: a legal basis under article 6, the limits of articles 9, 10 and 88, transparency, minimisation and impact assessment
- Keep the records a supervisor will ask for: training registers, acknowledgements, screening decisions, joiner-mover-leaver evidence and documented reasoning
Art. 21(2)(e), (h)-(j) NIS2 for IT Operations and Infrastructure — certification
What NIS2 asks of IT operations: asset management, access and privileged access, MFA or continuous authentication, vulnerability handling and coordinated disclosure, hardening and segmentation, cryptography, logging, backups and the evidence a supervisor checks.
- 10 lessons across 4 modules, about 1 h 44 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 84, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Map IT operations work to the article 21(2) points that govern it, quoted as written, and determine whether the Annex to Implementing Regulation (EU) 2024/2690 binds the entity or serves as a reference
- Build and maintain an asset inventory and a classification scheme that drive access, logging, backup and cryptography decisions
- Operate identities, access rights and privileged accounts, and deploy multi-factor or continuous authentication and secured communications where appropriate
- Run vulnerability handling and security patching with documented exceptions, and work with coordinated vulnerability disclosure under article 12 and the European vulnerability database
- Establish and enforce secure configurations, control changes, and segment networks according to the risk assessment
- Apply a cryptography policy covering protocols, algorithms, key management and the ability to change them
- Log, monitor and detect events, and back up and restore systems so that incident handling and recovery can rely on them
- Produce the operational evidence a supervisor checks, and separate legal requirements from practice choices in every record
Art. 21(2)(e) NIS2 Secure Development and Product Security — certification
Secure development under article 21(2)(e) and coordinated vulnerability disclosure under article 12, and how NIS2 meets the Cyber Resilience Act: SBOM, vulnerability handling, reporting of actively exploited vulnerabilities, and the CRA application dates as written.
- 9 lessons across 4 modules, about 1 h 42 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 76, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Apply article 21(1), 21(2)(e) and 21(3) to the entity's software development life cycle, in-house and outsourced, using point 6 of the Annex to Implementing Regulation (EU) 2024/2690 as binding text only for the entity types of its article 1 and as a reference for all others
- Derive security requirements and threat models at the specification and design phases and connect them to the entity's risk assessment and risk treatment decisions
- Manage third-party and open-source components with an inventory and a software bill of materials, knowing that the SBOM is a Cyber Resilience Act requirement for manufacturers and not a NIS2 obligation
- Organise secure coding, code review, protected development environments and risk-based security testing with documented methodology, results and mitigating actions
- Run vulnerability handling and coordinated disclosure consistent with article 12 of NIS2, the national coordinated vulnerability disclosure policy and the European vulnerability database, and recognise when the Cyber Resilience Act adds reporting duties
- Secure release, deployment, change, configuration and patch management, including the build and deployment pipeline itself
- Explain how NIS2 and the Cyber Resilience Act meet without merging: who each binds, for what, under which authority, and from which dates under article 71 of Regulation (EU) 2024/2847
- Assemble evidence of secure development that answers a supervisor's request under articles 32 and 33 of NIS2 and a customer's due diligence under article 21(3)
Art. 6(1), 21 NIS2 for OT and Industrial Control Systems — certification
How NIS2 reaches operational technology without naming it: control systems as network and information systems, OT inventory and segmentation, vulnerabilities when you cannot patch, remote access, detection and reporting under safety constraints, and the electricity network code.
- 9 lessons across 4 modules, about 1 h 33 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 74, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Show, from articles 6(1) and 21(1) of NIS2, why programmable control systems and the data they process are network and information systems, and where that definition stops, without attributing to the directive OT obligations it does not contain
- Turn safety, the priority of control, real-time constraints and long asset lifetimes into proportionate measures under article 21(1), through a risk analysis that starts from physical consequences
- Build and maintain an OT asset inventory under article 21(2)(i) that serves risk analysis, vulnerability handling, incident scoping and recovery, and protect it as a sensitive document
- Design and evidence segmentation between IT and OT and within OT, with every permitted data flow justified, documented and monitored
- Handle vulnerabilities that cannot be patched promptly under article 21(2)(e), with compensating controls, documented risk acceptance and supplier commitments
- Govern remote access and third-party maintenance under article 21(2)(d), (i) and (j), including integrators that may be managed service providers in their own right
- Detect, classify and report OT incidents under article 23 without diverting resources from safe operation, and recover the process from known-good state under article 21(2)(c)
- State correctly what IEC 62443, Delegated Regulation (EU) 2024/1366, the CER Directive and Implementing Regulation (EU) 2024/2690 require and of whom, and assemble the evidence a supervisor will ask for
Annex I, points 3-4; Art. 4 NIS2 for Banking and Financial Market Infrastructures — certification
Credit institutions, trading venue operators and central counterparties under NIS2 and DORA: the two Annex I rows quoted word for word, what DORA displaces through article 4 and what of NIS2 remains, ICT risk management and testing, third-party risk, major incident reporting, and the group companies and ICT providers that stay within NIS2.
- 9 lessons across 4 modules, about 1 h 42 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 74, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Quote the banking and financial market infrastructure rows of Annex I word for word, identify the three entity types and the acts that define them, and match them to the scope list of DORA article 2
- Apply the size rule of Recommendation 2003/361/EC, the size-independent cases of article 2(2) and 2(3), the narrow exclusion of article 2(10) and the classification of article 3 to a bank, a trading venue operator or a CCP
- Explain how DORA displaces NIS2 for financial entities, citing NIS2 article 4, DORA article 1(2), NIS2 recital 28 and DORA recital 16, and list what of NIS2 still concerns them and who in a group stays fully within NIS2
- Describe the sector's threat picture qualitatively, from the legislator's own reasoning, and turn it into risk scenarios
- Locate each topic of NIS2 article 21(2) in DORA's ICT risk-management, continuity and testing provisions, and apply them to round-the-clock payments, trading and clearing
- Manage ICT third-party risk under DORA articles 28 to 30, understand the Oversight Framework for critical ICT third-party service providers, and place providers and group IT companies under NIS2
- Classify and report a major ICT-related incident under DORA articles 17 to 19, and coordinate it with the NIS2 authorities, group NIS2 entities and the GDPR
- Map the supervisory authorities by kind and legal basis — DORA competent authorities, the ECB, the ESAs, NIS2 authorities and CSIRTs — and find the national details on the transposition tracker
Annex I, points 6-7; Art. 21 NIS2 for Drinking Water and Waste Water — certification
Drinking water and waste water operators under NIS2: the two Annex I rows and their exclusion clauses quoted word for word, the size rule and the classes, the control systems behind treatment and distribution, the ten measures applied to public and private operators, incident reporting next to the Drinking Water Directive, and supervision.
- 9 lessons across 4 modules, about 1 h 35 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 66, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Decide whether an operator is a drinking-water or waste-water entity under Annex I, points 6 and 7, reading their exact wording, the definitions borrowed from Directive (EU) 2020/2184 and Directive 91/271/EEC, and the two exclusion clauses
- Apply the article 2(1) size rule and Recommendation 2003/361/EC to public and private water operators, identify the size-independent routes of articles 2(2) and 2(3), and derive the class under article 3
- Explain what the Drinking Water Directive, the urban wastewater treatment recast and the CER Directive require of water operators, and why none of them displaces NIS2 under article 4
- Describe, qualitatively, the threats a water operator faces and the features of its operating model that expose it, under the all-hazards approach
- Apply the ten measures of article 21(2) to treatment works, networks, remote sites and telemetry, using Implementing Regulation (EU) 2024/2690 only as a reference
- Manage the security of a water operator's direct suppliers and service providers under articles 21(2)(d) and 21(3), from integrators and equipment vendors to shared municipal IT
- Run the article 23 reporting chain in a water incident alongside the CER, Drinking Water Directive and GDPR obligations it may trigger
- Identify the kinds of authority that supervise a water operator, the supervisory regime its class entails, and the evidence they will ask for
Annex I, point 1; Art. 21 NIS2 for the Energy Sector — certification
Electricity, district heating and cooling, oil, gas and hydrogen under NIS2: the nineteen Annex I entity types quoted word for word, the size rule and the classes, the network code on cybersecurity of cross-border electricity flows (Delegated Regulation 2024/1366) and whom it binds, the CER Directive for critical entities, and incident reporting and supervision across the three texts.
- 9 lessons across 4 modules, about 1 h 38 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 83, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Match an energy activity to the exact Annex I entity type, quoting the annex wording and the act it refers to, including recharging point operators
- Apply the size rule, the size-independent cases and the CER route to an energy entity, and classify it as essential or important
- Explain whom Delegated Regulation (EU) 2024/1366 binds, how high-impact and critical-impact entities are identified, and why it applies alongside NIS2 rather than instead of it
- Explain what CER critical-entity status adds for an energy entity and how the CER and NIS2 obligations and authorities connect
- Describe the threat picture for the energy sector from the texts: interdependence, real-time and legacy systems, supply chain, ransomware, insiders and physical hazards
- Apply the ten measures of article 21(2) to energy operating reality: OT, safety, round-the-clock availability and legacy systems
- Manage the energy supply chain under article 21(2)(d) and 21(3), using the supply chain controls of Delegated Regulation (EU) 2024/1366 where they bind
- Run incident reporting and prepare for supervision across NIS2, the network code and CER, identifying each authority by kind
Annex I, point 2; Art. 21 NIS2 for the Transport Sector — certification
Air, rail, water and road under NIS2: the ten Annex I entity types quoted word for word, the size rule, the size-independent cases and the CER route, the aviation information security rules of Part-IS (Regulations 2023/203 and 2022/1645) beside NIS2 without claiming equivalence, the control systems of traffic and operations, and incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 69, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Identify, from the words of Annex I point 2 of NIS2, the ten types of air, rail, water and road entity the directive lists, the Union act that defines each, and the qualifiers that widen or narrow each entry
- Determine whether a transport entity is in scope and in which class, applying article 2(1) with Recommendation 2003/361/EC, the size-independent cases of article 2(2), the critical-entity route of article 2(3) and the classification rules of article 3
- State whom the aviation Part-IS rules of Implementing Regulation (EU) 2023/203 and Delegated Regulation (EU) 2022/1645 bind, what they require and from when, and explain why NIS2 applies alongside them unless the article 4 equivalence test is met
- Place the CER Directive and the aviation and maritime security regimes correctly next to NIS2, using the cooperation and recognition mechanisms the texts provide and never an equivalence they do not state
- Describe the threat picture of the transport sector qualitatively and apply the ten measures of article 21(2) to transport operations, where safety, continuous service and long-lived control systems shape each control
- Manage supply chain risk specific to transport under article 21(2)(d) and 21(3), including the contracting and interface duties Part-IS adds for aviation organisations
- Run incident reporting where NIS2 article 23, the Part-IS external reporting scheme and CER article 15 overlap, with the right trigger, addressee and deadline for each
- Identify the kinds of authority that supervise a transport entity, the supervisory regime of its class, and where to find the national details
Annex I, point 5; Annex II, point 5(a); Art. 21 NIS2 for the Health Sector — certification
Healthcare providers, reference laboratories, pharmaceutical research and manufacturing and medical device makers under NIS2: the Annex I and Annex II entries quoted word for word, the size rule and the classes, NIS2 beside the medical device regulations, the GDPR and the CER Directive, the ten measures where continuity of care comes first, and incident reporting when one event triggers several regimes.
- 9 lessons across 4 modules, about 1 h 35 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 70, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Place a health organisation in NIS2 by quoting the Annex I point 5 entity type that fits it, word for word, with the Union act that defines it, and separate the Annex I health manufacturers from the Annex II point 5(a) manufacturers of medical devices and in vitro diagnostic medical devices
- Apply the size rule of article 2(1) and Recommendation 2003/361/EC, the size-independent routes of articles 2(2) and 2(3), and article 3 to classify a health entity as essential or important
- Explain what Regulations (EU) 2017/745 and 2017/746 require of manufacturers on information security and unauthorised access, and why they apply alongside NIS2 rather than replacing it, together with the GDPR and the CER Directive
- Describe the threats a health entity faces and apply the ten measures of article 21(2) to clinical operating reality, with continuity of care as the first constraint
- Manage the supply chain risks specific to health: medical device manufacturers, clinical software and service providers, and the information the device regulations oblige manufacturers to supply
- Run NIS2 incident reporting alongside GDPR breach notification for health data, medical device vigilance and, for critical entities, CER incident notification
- Identify the kinds of authority that supervise a health entity, prepare for supervision under articles 32 and 33, and find national details through the transposition tracker
Annex I, point 8; Art. 21, 23, 26-28 NIS2 for Digital Infrastructure — certification
IXP, DNS, TLD, cloud, data centre, CDN, trust service and electronic communications providers under NIS2: the nine Annex I types with their exact scope and class, domain name registration and article 28, eIDAS and the European Electronic Communications Code beside NIS2, the binding Annex and incident criteria of Implementing Regulation 2024/2690, jurisdiction and the ENISA registry.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 76, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Identify which of your services fall under the nine digital infrastructure types of Annex I, point 8, using the definitions of article 6 and the eIDAS and Electronic Communications Code definitions it borrows
- Determine in-scope status and class for each type, applying the size rule of article 2(1) with Recommendation 2003/361/EC, the size-independent cases of article 2(2), (3) and (4) and the classification of article 3, including the separate regime and article 28 duties of domain name registration services
- Explain how NIS2 relates to eIDAS as amended by Regulation (EU) 2024/1183, the European Electronic Communications Code, the CER Directive and data protection law, and which point 8 types Implementing Regulation (EU) 2024/2690 binds
- Describe the threats the sector's operating model exposes it to, grounded in the recitals of NIS2 and of Implementing Regulation (EU) 2024/2690
- Apply the ten measures of article 21(2) to networks, facilities, name services and trust services, using the Annex to Implementing Regulation (EU) 2024/2690 as binding text where it applies and as a reference where it does not
- Manage supply chain security under article 21(2)(d), 21(3) and 22 as both a supplier to other NIS2 entities and a customer of utilities, carriers, facilities and vendors
- Qualify and report significant incidents per entity type under article 23 and articles 3 to 14 of Implementing Regulation (EU) 2024/2690, including the 24-hour notification of trust service providers and the eIDAS and GDPR notifications that run in parallel
- Determine which member state has jurisdiction under article 26, meet the registration duties of articles 3(4) and 27, and identify the kinds of authority that supervise each entity type
Annex I, point 10; Art. 2(2)(f), 6(35) NIS2 for Public Administration — certification
Central and regional public administration under NIS2: the Annex I row and the definition of article 6(35) with all its conditions and exclusions, central government regardless of size and regional bodies after a risk-based assessment, the member-state options for local level and education, classes, the enforcement measures that do not apply to public bodies, and the CER Directive.
- 9 lessons across 4 modules, about 1 h 34 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 65, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Identify the two public administration types of Annex I, point 10, word for word, and test a body against the definition of article 6(35): national recognition, the exclusion of the judiciary, parliaments and central banks, and criteria (a) to (d)
- Determine whether a public body is in scope and in which class, applying both limbs of article 2(2)(f), the options of article 2(5), the exclusion and exemptions of article 2(7) to (9) and article 3, and explain why the size rule of Recommendation 2003/361/EC is not the test for this sector
- Explain how NIS2 relates to the CER Directive, the GDPR and national frameworks, and why Implementing Regulation (EU) 2024/2690 is a reference and not an obligation for public administration entities
- Describe the threats that the operating model of public administration exposes it to, grounded in the recitals of NIS2 and the CER Directive
- Apply the governance duties of article 20 and the ten measures of article 21(2) to the operating reality of ministries, agencies and regional authorities
- Use public procurement and shared-service agreements as the channel for supply chain security under article 21(2)(d) and 21(3), distinguishing the entity's duty from the member-state policies of article 7(2)
- Qualify and report significant incidents under article 23, inform citizens as recipients of services, and run the GDPR and CER notifications in parallel
- Explain how jurisdiction, supervision and enforcement apply to public administration entities: article 26(1)(c), the operational independence of article 31(4), the non-application of article 32(5), the liability carve-outs of articles 20(1) and 32(6), and member-state choice on fines under article 34(7)
Annex II, point 6; Art. 21, 23, 26-27 NIS2 for Digital Providers — certification
Online marketplaces, online search engines and social networking services platforms under NIS2: the Annex II row and the definitions it borrows, size and class, the binding Annex and incident criteria of Implementing Regulation 2024/2690, jurisdiction by main establishment and the ENISA registry, and the Digital Services Act as a separate regime that a provider may face at the same time.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 73, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Identify which of your services fall under the three digital provider types of Annex II, point 6, using articles 6(28), 6(29) and 6(33) and the definitions they borrow from Directive 2005/29/EC, as amended by Directive (EU) 2019/2161, and from Regulation (EU) 2019/1150
- Determine in-scope status and class, applying the size rule of article 2(1) with Recommendation 2003/361/EC, the member-state identification of article 2(2)(b) to (e), article 2(3) and article 3, and explain why an Annex II provider is important unless identified as essential
- Explain how NIS2 relates to the Digital Services Act, the Unfair Commercial Practices Directive, the platform-to-business Regulation and the GDPR, and why the Digital Services Act is not a lex specialis under article 4
- Describe the threats the operating model of marketplaces, search engines and social networks exposes them to, grounded in the recitals and provisions of NIS2, Implementing Regulation (EU) 2024/2690 and the Digital Services Act
- Apply the ten measures of article 21(2) to platform operations, using the Annex to Implementing Regulation (EU) 2024/2690 as binding text and documenting the reasoning its 'where appropriate' requirements call for
- Manage supply chain security under articles 21(2)(d), 21(3) and 22 and point 5 of the Annex to Implementing Regulation (EU) 2024/2690, as a customer of hosting, delivery and verification services and as a service others depend on
- Qualify and report significant incidents under article 23 and articles 3, 4 and 11 to 13 of Implementing Regulation (EU) 2024/2690, alongside the GDPR breach notifications and Digital Services Act duties that run in parallel
- Determine which member state has jurisdiction under article 26, meet the representative and registration duties of articles 26(3), 3(4) and 27, and tell NIS2 supervision apart from Digital Services Act and data protection supervision
Annex I, point 11; Art. 21, 23 NIS2 for the Space Sector — certification
Operators of ground-based infrastructure that support space-based services under NIS2: the Annex I row and its exclusion read word for word, size and class, the CER Directive for critical entities, the ground segment as IT and OT, interference and supply chain risks, incident reporting across NIS2 and CER, and jurisdiction.
- 9 lessons across 4 modules, about 1 h 38 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 77, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Read Annex I, point 11, word for word and test an organisation against each of its elements, including the Union space programme boundary of recital 37, the exclusion of providers of public electronic communications networks and the questions the wording leaves open
- Determine in-scope status and class using the size rule of article 2(1) with Recommendation 2003/361/EC, the size-independent cases of article 2(2) and (3), the national security provisions of article 2(7) and (8) and the classification of article 3
- Explain how NIS2 relates to the CER Directive, to Annex I, point 8, and the electronic communications definitions it borrows, to article 4 on sector-specific acts and to Implementing Regulation (EU) 2024/2690, which does not bind space operators
- Describe the threats the ground segment's operating model exposes it to, from mission control and command links to signal interference and specialised suppliers, grounded in the definitions and recitals of NIS2 and CER
- Apply the ten measures of article 21(2) to ground stations, control centres and data chains, including the network and information systems the operator uses beyond the ground
- Manage supply chain security under article 21(2)(d), 21(3) and 22 as both a customer of specialised suppliers and hosted sites and a supplier to satellite operators and other entities
- Qualify and report significant incidents under article 23, including notification of service recipients, cross-border impact and the parallel CER notification of critical entities
- Identify jurisdiction under article 26, registration under article 3, the kinds of authority that supervise a space operator, mutual assistance under article 37 and the supervisory regimes of articles 32 to 34
Annex I, point 9; Art. 6(39)-(40), 21, 23, 26-27 NIS2 for Managed Service Providers (ICT Service Management) — certification
Managed service providers and managed security service providers under NIS2: the Annex I row and the definitions of article 6(39) and 6(40), size, class and the scope traps for small providers, the binding Annex and incident criteria of Implementing Regulation 2024/2690, jurisdiction by main establishment and the ENISA registry, and DORA for providers serving financial entities.
- 9 lessons across 4 modules, about 1 h 42 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 73, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Identify whether your services make you a managed service provider or a managed security service provider under Annex I, point 9, and article 6(39) and (40), and which other entity types your other services may add
- Determine in-scope status and class, applying the size rule of article 2(1) with Recommendation 2003/361/EC, the member state routes of article 2(2)(b) to (e) and 2(3), the exemptions of article 2(8) and the classification of article 3
- Explain how NIS2 relates to Implementing Regulation (EU) 2024/2690, DORA, the GDPR and the CER Directive for a managed service provider, including why DORA does not displace NIS2 for the provider itself
- Describe the threats the managed service operating model exposes a provider to, grounded in the recitals of NIS2 and of Implementing Regulation (EU) 2024/2690
- Apply the ten measures of article 21(2) to remote administration, privileged access, customer segregation and change deployment, using the binding Annex to Implementing Regulation (EU) 2024/2690
- Manage supply chain security in both directions: the provider's own suppliers and subcontractors under article 21(2)(d), 21(3), 22 and point 5 of the Annex, and the duties customers apply when selecting and monitoring it, including DORA articles 28 to 30
- Qualify and report significant incidents under article 23 and articles 3, 4 and 10 of Implementing Regulation (EU) 2024/2690, and run the parallel notifications to customers, data controllers and financial-entity customers
- Determine jurisdiction by main establishment under article 26, meet the registration duties of articles 3(4) and 27, and identify the kinds of authority that supervise a managed service provider, including under the DORA oversight framework
Annex II, point 1; Art. 21, 23 NIS2 for Postal and Courier Services — certification
Postal service providers, including courier services, under NIS2: the Annex II row and point (1a) of the Postal Services Directive as inserted by Directive 2008/6/EC, size and class, why postal law is not a lex specialis, sorting centres, tracking platforms and subcontracted couriers in the ten measures, incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 72, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Decide whether an organisation is a postal service provider under Annex II, point 1, reading the definitions of Directive 97/67/EC as amended by Directive 2008/6/EC, the courier clause and what recital 12 says about transport alone
- Apply the article 2(1) size rule and Recommendation 2003/361/EC to postal and courier operators, including seasonal staff, subcontracted couriers, groups and public ownership, and derive the class under article 3
- Explain what the Postal Services Directive requires of Member States and postal providers, why it does not displace NIS2 under article 4, and where the CER Directive, the GDPR and Implementing Regulation (EU) 2024/2690 stand for the sector
- Describe, qualitatively, the threats a postal or courier operator faces and the features of its operating model that expose it, under the all-hazards approach
- Apply the ten measures of article 21(2) to sorting centres, tracking platforms and customer APIs, delivery devices, access points and peak periods
- Manage the security of last-mile partners, subcontracted couriers, line-haul carriers, equipment vendors and platform providers under articles 21(2)(d) and 21(3), alongside the GDPR rules on processors
- Run the article 23 reporting chain in a postal incident alongside the GDPR breach regime and the information and complaint mechanisms of the Postal Services Directive
- Identify the kinds of authority that supervise a postal provider, the supervisory regime its class entails, and the evidence they will ask for
Annex II, point 2; Art. 21, 23 NIS2 for Waste Management — certification
Waste management undertakings under NIS2: the Annex II row and article 3(9) of the Waste Framework Directive as amended by Directive 2018/851, the principal-activity exclusion, size and class, why waste law is not a lex specialis, treatment plants, tracking and fleets in the ten measures, incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 34 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 64, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Decide whether an undertaking is of the type in Annex II, point 2, reading the row word for word, the definition of waste management in article 3, point (9), of Directive 2008/98/EC as replaced by Directive (EU) 2018/851, the related definitions, and the principal-economic-activity exclusion as it is worded
- Apply the article 2(1) size rule and Recommendation 2003/361/EC to public and private waste operators, test the size-independent routes of articles 2(2) and 2(3), and derive the class under article 3
- Explain what the Waste Framework Directive requires of waste operators, why it does not displace NIS2 under article 4, and how the CER Directive, the GDPR and Implementing Regulation (EU) 2024/2690 relate to a waste operator
- Describe, qualitatively, the threats a waste operator faces and the features of its operating model that expose it, under the all-hazards approach
- Apply the ten measures of article 21(2) to collection fleets, weighbridges, sorting plants, incinerators, landfills and hazardous-waste traceability, using Implementing Regulation (EU) 2024/2690 only as a reference
- Manage the security of a waste operator's direct suppliers and service providers under articles 21(2)(d) and 21(3), from plant integrators and fleet telematics to subcontracted hauliers and downstream facilities
- Run the article 23 reporting chain in a waste-sector incident alongside the GDPR and the obligations that waste law and permits may attach to it
- Identify the kinds of authority that supervise a waste operator, the supervisory regime its class entails, the rules specific to public administration entities, and the evidence they will ask for
Annex II, point 3; Art. 21, 23 NIS2 for the Chemicals Sector — certification
Manufacturers and distributors of substances and mixtures and producers of articles under NIS2: the Annex II row and the REACH definitions it borrows, the open questions it leaves, size and class, Seveso III beside NIS2 without any equivalence, process control and safety systems in the ten measures, incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 36 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 67, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Decide whether an undertaking is of the type in Annex II, point 3, reading its exact wording and the REACH definitions it borrows (manufacturer, distributor, article), and record the questions the wording leaves open
- Apply the article 2(1) size rule and Recommendation 2003/361/EC to chemical undertakings, identify the size-independent routes of articles 2(2) and 2(3), and derive the class of an Annex II entity under article 3
- Explain what REACH and the Seveso III Directive require of chemical undertakings, and why neither is a cybersecurity act that displaces NIS2 under article 4
- Describe, qualitatively, the threats a chemical undertaking faces and the features of its operating model that expose it, under the all-hazards approach
- Apply the ten measures of article 21(2) to process control and safety systems, recipes and formulations and distribution, alongside the Seveso safety management system, using Implementing Regulation (EU) 2024/2690 only as a reference
- Manage the security of a chemical undertaking's direct suppliers and service providers under articles 21(2)(d) and 21(3), from control-system vendors and toll manufacturers to logistics and data platforms
- Run the article 23 reporting chain in a chemical incident alongside the Seveso duties after a major accident, deciding for one event which regime it triggers
- Identify the kinds of authority that supervise a chemical undertaking under NIS2, Seveso III and REACH, the supervisory regime its class entails, and the evidence they will ask for
Annex II, point 7; Art. 6(41), 2(5)(b) NIS2 for Research Organisations — certification
Research organisations under NIS2: the Annex II row and the definition of article 6(41) with its exclusion of educational institutions, the member-state option for education institutions, size including university and public shareholders, class, research data and the GDPR, open collaboration and shared infrastructures in the ten measures, incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 34 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 75, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Place an organisation in Annex II, point 7, by quoting the annex row and the article 6(41) definition word for word, testing each element strictly as worded and declaring open what the text leaves open
- Apply the size rule of article 2(1) and Recommendation 2003/361/EC, including its investor rule for universities and non-profit research centres and the disapplied public-body rule, the size-independent routes of articles 2(2) and 2(3), the option of article 2(5)(b), and article 3 to classify a research organisation
- Explain what the GDPR requires for personal research data, including articles 9(2)(j) and 89, and how the CER Directive and Implementing Regulation 2024/2690 relate to a research organisation, without inventing a lex specialis
- Describe, qualitatively and from the texts, the threats a research organisation faces, from industrial espionage to the compromise of shared infrastructures, and why its operating model exposes it
- Apply the ten measures of article 21(2) to research operating reality: open collaboration, guest researchers and federated identities, shared infrastructures, research data and intellectual property
- Manage the supply chain and collaboration risks specific to research under articles 21(2)(d) and 21(3): infrastructure providers, instrument and software suppliers, and research partners
- Run NIS2 incident reporting for a research organisation alongside GDPR personal data breach notification and the information owed to partners and recipients of services
- Identify the kinds of authority that supervise a research organisation, prepare for ex post supervision under article 33, and find national details through the transposition tracker
Annex II, point 4; Art. 2(3), 21, 23 NIS2 for the Food Sector — certification
Food businesses engaged in wholesale distribution and industrial production and processing under NIS2: the Annex II row and the General Food Law definitions it borrows, the questions it leaves open, size and class, the CER food row and critical entities, traceability, withdrawal and the rapid alert system beside NIS2, production lines and cold chain in the ten measures, incident reporting and supervision.
- 9 lessons across 4 modules, about 1 h 38 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 78, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Decide whether an undertaking is a food business of the Annex II, point 4, type, reading the row word for word with the definitions of Regulation (EC) No 178/2002 it relies on, and record the questions the text leaves open
- Apply the article 2(1) size rule and Recommendation 2003/361/EC to food businesses, identify the size-independent routes of articles 2(2) and 2(3), compare the food row of the CER Directive, and derive the class under article 3
- Explain what the General Food Law requires on traceability, withdrawal, recall and the rapid alert system, what the CER Directive requires of food critical entities, and why neither displaces NIS2 under article 4
- Describe, qualitatively, the threats a food business faces and the features of its operating model that expose it, under the all-hazards approach
- Apply the ten measures of article 21(2) to production lines, cold-chain monitoring, warehouse and transport systems, using Implementing Regulation (EU) 2024/2690 only as a reference
- Manage the security of a food business's direct suppliers and service providers under articles 21(2)(d) and 21(3), from automation integrators to logistics, software and data-interchange providers
- Run the article 23 reporting chain in a food incident alongside the General Food Law, CER and GDPR obligations it may trigger
- Identify the kinds of authority that supervise a food business, the supervisory regime its class entails, and the evidence they will ask for
Annex II, point 5; Art. 21, 23 NIS2 for Manufacturing — certification
Manufacturers of medical devices, computer, electronic and optical products, electrical equipment, machinery, motor vehicles and other transport equipment under NIS2: the six Annex II sub-sectors and the NACE divisions they cite, size and class, the Cyber Resilience Act on the product side and where it meets NIS2, production OT and engineering data in the ten measures, incident and vulnerability reporting, and supervision.
- 9 lessons across 4 modules, about 1 h 30 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 72, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Place a manufacturer in Annex II, point 5, by quoting its subsector and type of entity word for word, read NACE Rev. 2 divisions 26 to 30 as Regulation (EC) No 1893/2006 sets them out, and state what the directive leaves open for undertakings whose manufacturing activity is not their main one
- Apply the size rule of article 2(1) and Recommendation 2003/361/EC, the size-independent routes of articles 2(2) and 2(3), and article 3 to classify a manufacturer, and separate Annex II device makers from the Annex I health entry
- Distinguish the Cyber Resilience Act, which governs products with digital elements placed on the market, from NIS2, which governs the entity's own network and information systems, including the exclusions of article 2 of the Regulation and its application dates, without treating either as a substitute for the other
- Describe the threats a manufacturer faces and apply the ten measures of article 21(2) to production systems, robots, engineering data and supplier portals
- Manage the supply chain risks specific to manufacturing: component suppliers, machine builders and integrators with remote access, logistics and supplier portals, and the manufacturer's own position as a supplier
- Run NIS2 incident reporting in a production environment, including the notification of downstream customers, alongside the reports the Cyber Resilience Act requires of manufacturers
- Identify the kinds of authority that supervise a manufacturer, prepare for ex post supervision under article 33, and find national details through the transposition tracker
Art. 21(2) NIS2 National Transposition — certification
The certification our transposition data hub uniquely supports: how the 27 member states turn article 21(2) into national law, the national assessment frameworks in use, and how to run one security programme across several jurisdictions.
- 9 lessons across 4 modules, about 1 h 37 min of study
- Server-graded final assessment: 20 questions drawn from a bank of 75, 70% to pass, 3 attempts
- A certificate with a public verification page, revocable on refund
- Explain why a directive binds the member state rather than the entity, and separate what NIS2 fixes at Union level from what it leaves to national law
- State the transposition status of the 27 member states as recorded in the data hub, and tell a law in force from a law published, a law the Commission accepts as complete, and a published assessment framework
- Classify the national assessment frameworks by kind of object (certifiable scheme, binding legal text, standard named in law, maturity self-assessment or recommendation) and read each one's caveat and scope first
- Describe CyberFundamentals accurately: its owners, levels, control counts, key measures, maturity thresholds, how the level is determined, and which Belgian dates bind which class of entity
- Locate the national provision carrying the article 21(2) measures, and identify where a member state adds to them or delegates them to decrees, determinations or regulations
- Identify the registration channel, the dated obligations with the class of entity they apply to, and the authority and CSIRT for a member state, and say when a fact is not recorded yet
- Design one control set against article 21(2) and one dated national mapping row per jurisdiction, and sequence a multi-country programme by its binding dates
- Reuse an ISO/IEC 27001 or NIST SP 800-53 programme as evidence through a crosswalk without mistaking a mapping for applicability, equivalence or compliance