Article 21(2)(g) NIS2 cyber hygiene and training

What Article 21(2)(g) NIS2 asks for in cyber hygiene and training

Article 21(2)(g) asks entities in scope to practice basic cyber hygiene and to run cybersecurity training, and it reaches beyond the security team to staff, management and, where appropriate, suppliers. The duty has two layers. The first is everyday hygiene: Recital 89 names practices such as zero-trust principles, software updates, device configuration, network segmentation, identity and access management and user awareness. The second is structured training: Implementing Regulation (EU) 2024/2690 requires an awareness program for employees and management body members, repeated over time and covering new joiners, plus regular job-relevant training for people in roles that need security skills. The first layer addresses ordinary mistakes, such as a user approving a fake login prompt, a administrator leaving a default setting in place, or a laptop running months without patches. The second addresses phishing and social engineering aimed at the whole workforce.

For an entity in scope, the practical decision is who owns each layer. Hygiene settings usually sit with IT and platform teams, who can enforce them in configuration and then report on them. Awareness content, role mapping and training records usually sit with HR, the security function and the management body. Ask early which roles in your organization need security skills, which suppliers must complete training, and which systems will hold the training records. Confirm these choices against your national transposition law and your supervisor's expectations, because the scope of the training duty can vary in detail between Member States.

Delivering training is usually the easier part. Proving that it happened, that it reached the right people and that it changed behavior is harder. A supervisor will expect completion records, dates, content versions, test or simulation results and evidence that training effectiveness was assessed, not only a slide deck. Plan the evidence before the first session: decide which platform records completion, how long records are kept, and how role changes trigger new training. Self-hosted learning platforms and endpoint configuration tools can produce much of this evidence, but you must confirm each capability in your own environment before you rely on it in an assessment.

Who must run the awareness program and which roles need role-based training

Article 21(2)(g) splits training into two tracks: a general awareness program for everyone who touches the organization's systems, and deeper role-based training for people whose jobs need security skills. The cards below set out who falls into each group and the scoping decisions that change the workload.

All employees and new joiners

The awareness program has to reach every employee, and it has to repeat over time and cover people who join later, not only the staff present at launch. Build joiner training into onboarding so new starters complete it before or soon after getting system access. Check that your HR system and learning platform share the same roster, because a new hire missing from the course list is a gap an assessor will find quickly.

Management body members

The implementing regulation puts management body members inside the awareness program, so board members and executives cannot be excluded because they sit above the training population. Their training should cover the decisions they approve and oversee, such as risk treatment, budget and incident escalation. Record attendance separately so you can show it to a supervisor, since the management body carries personal responsibility under Article 20.

Contractors and temporary staff

Contractors with accounts on your systems are not automatically outside the program. Decide whether they are treated as employees for training purposes, and write that rule into the contract or onboarding standard. Contractors who never receive a login to your environment may fall outside the scope, but confirm this with your counsel and your national competent authority's guidance before relying on it.

Direct suppliers and service providers

The implementing regulation requires training for direct suppliers and service providers where appropriate, so the duty is risk-based rather than universal. Use a simple test: does the supplier hold privileged access, operate in your environment, or handle regulated data? If yes, include them, and ask for evidence such as completion records in the contract. Confirm which suppliers fall in this group before you draft the clause.

Roles that need security skills

Staff in roles that require security skills need regular, job-relevant training on secure configuration and operation, known threats, and behavior during security events. Typical candidates include system administrators, network engineers, developers and incident responders, but the list should come from a role review rather than job titles alone. Assess whether the training works, for example through practical exercises, and keep the results.

Staff transferring into security roles

Anyone who moves into a role needing security skills must receive that role-based training on transfer, not at the next annual cycle. This is easy to miss in internal mobility, because the access rights often move before the training record does. Tie the training trigger to the access change in your identity workflow so the two cannot drift apart.

How an assessor tests cyber hygiene and training

This table compares each training element an assessor reviews under Article 21(2)(g), the evidence usually requested and the findings that appear most often. Read it as a checklist of what to have ready before a supervisory inspection or security audit, and note where completion records alone will not satisfy the test.

Element	Evidence requested	Common findings
Awareness program for all staff	Written program scope, annual or periodic training calendar, content outline covering phishing and social engineering, attendance records	Completion records exist but content is not shown, or topics are generic and not tied to the organization's threats
Repetition over time	Evidence of recurring sessions and refresher content across the review period, not a single launch event	One-time onboarding module with no evidence of repetition
Coverage of new employees	Onboarding checklist, dated training records for recent joiners, sample of starters with completion timestamps	Joiners from recent months with no awareness record before system access was granted
Management body training	Attendance or completion records for board and executive members, agenda or materials covering cyber risk and Article 21 measures	Management members excluded from the program or training limited to a short briefing with no record
Suppliers and service providers	Where the entity decided training applies, the decision and rationale, plus the awareness content or attestation given to direct suppliers	No documented decision either way, so the assessor cannot tell whether the question was considered
Role-based training for security-skilled staff	Role inventory identifying security-skilled roles, training plan per role covering secure configuration, known threats and conduct during security events, dated completion	Roles with privileged access not identified, or training that is generic and not job-relevant
Effectiveness assessment	Tests, quizzes, simulated phishing results, or review of security events before and after training, with recorded follow-up actions	Completion rates reported as the only measure, with no check that behavior or knowledge changed
Training on role transfer	Procedure triggering training when staff move into security-skilled roles, dated records for recent movers	Movers who took on administrative or security duties and never received role training

How to build the awareness and role-based training program step by step

This sequence turns the Article 21(2)(g) duty into a working program: a defined audience, a hygiene baseline, a repeating awareness curriculum, role-based training for security-skilled staff, effectiveness checks and transfer training, each with a record that a supervisor could inspect.

Map the audience and security-skilled roles
Start by listing everyone the program must reach: employees, members of the management body, and, where appropriate, direct suppliers and service providers with access to your systems. Then separate roles that need security skills (for example, system administrators, network engineers, developers of internet-facing services and staff who respond to incidents) from general staff. Record the owner of each role and the date the list was last reviewed. The output is an audience register that the awareness program and the role-based curricula both draw from. Confirm with your national competent authority or sector guidance how it expects supplier coverage to be scoped, since the implementing regulation applies that duty only where appropriate.
Define the cyber hygiene baseline
Write down the basic hygiene practices every in-scope person and system must meet. Recital 89 of NIS2 names zero-trust principles, software updates, device configuration, network segmentation, identity and access management and user awareness as the core areas. Translate each into a short, testable statement for your environment, such as which devices must receive updates, which configuration baseline applies to laptops and which accounts need strong authentication. Staff do not need the technical depth of administrators, but they must understand why segmentation and identity rules exist. The output is a one-page hygiene baseline approved by the management body and linked to the policies that enforce it.
Build the awareness curriculum on phishing and social engineering
Design the core awareness course around the threats that recital 89 names: phishing, social engineering and the handling of suspicious requests. Use your own environment where possible, covering how to report a suspicious message, how to verify a payment or credential request by a second channel and what to do after a suspected compromise. Management and new staff should receive the same core topics, with examples aimed at their decisions. Host the course on a learning platform you control, such as Moodle, which is open source under GPL-3.0-or-later. The output is a published course with module content, a reporting route and a version number that records what changed.
Set the repetition and new-joiner schedule
The implementing regulation expects the awareness program to be repeated over time and to cover new employees, including members of the management body. Set a recurring cycle for every audience and a fixed onboarding step that every new joiner completes before they receive production access. Decide how refresher content is triggered, for example after an incident, after a significant change to a system or when the phishing threat picture shifts. Ask your platform team to confirm how the learning system records completion so the schedule can be evidenced. The output is a written schedule with owners, a completion rule for onboarding and an assignment process in your learning platform.
Define role-based curricula for security-skilled roles
For each security-skilled role in the register, write a curriculum that is regular, job-relevant and covers three areas: secure configuration and operation of the systems the person touches, the known threats to those systems and how the person should behave during a security event. The implementing regulation requires this training for employees in these roles. Map each course to the tasks in the role description so that a reviewer can see why the content matters. Where a platform such as Wazuh or Fleet is used to check configuration, include its outputs in the training so staff learn to read the failing controls they are expected to fix. The output is a set of curricula, one per role family, with the schedule on which each runs.
Add effectiveness checks
The implementing regulation requires the effectiveness of role-based training to be assessed. Choose measures that show whether people apply the training, not only whether they finished it. Examples include simulated phishing results tracked over time, the share of devices passing configuration policies in each team, and the number of suspicious messages reported correctly. Set a review step where the results are discussed with the owner of each role and the management body, and where a weak result leads to changed content or a targeted follow-up. Ask your assessor which measures they expect to see in evidence. The output is a metrics sheet with definitions, data sources, owners and a dated record of each review and the actions it produced.
Set up transfer training for staff changing roles
Staff who move into a role that requires security skills must receive the role-based training on transfer, before or as they take on those duties. Add a transfer step to your internal mobility process, so that the HR or line manager request triggers the assignment of the relevant curricula and the access change waits for completion where your policy requires it. Check that the skills record for each employee is updated when the role changes. The output is a documented transfer workflow, a link from the HR system to the learning platform, and a completion record for each transfer that an auditor can sample.

Which training records and technical results pass an assessment

An assessor testing Article 21(2)(g) looks for a documented awareness program, proof that people completed it, proof that role-based training changed behavior, and technical results that show basic hygiene holds on real devices. The cards below cover each artifact and how to keep it current between audits.

Awareness program document and curriculum

The awareness program is the written plan that sets out who must be trained, on which topics, how often, and who approves it. Keep the document under version control so that each revision shows the date, the approver and the reason for the change. The curriculum should cover phishing, social engineering, credential hygiene, software updates and device configuration, since these are the basic practices the recitals name. Confirm that the plan covers new employees and, where appropriate, direct suppliers, because the implementing regulation expects both.

Per-person completion and attendance records

Completion records prove that each named employee received training, not just that a course was published. Export records from the learning platform with the learner identity, module, completion date and version of the content taken. If you use Moodle, activity completion can be set to mark an activity complete when a learner views it, receives a grade, or ticks it manually. Choose the condition deliberately, because a viewed-only condition proves less than a graded one.

Management body training records

Members of the management body must receive the awareness program like every other employee, and the records must name them. Keep a separate register that lists each board or executive member, the training content, the date and the trainer or provider. Assessors will compare this register with the board membership list, so update it whenever a director joins or leaves. Ask your implementation partner or provider to confirm that the register matches the sessions actually delivered.

Role matrix for security-skilled staff

A role matrix maps each job title to the security skills it needs and the training that builds them, such as secure configuration for system administrators or incident behavior for on-call engineers. The implementing regulation expects regular job-relevant training for these roles, covering secure configuration and operation, known threats and conduct during security events. Review the matrix when roles change, and record the date of the last review so the assessor can see it is maintained.

Effectiveness results and transfer training

Completion alone does not show that training works. Keep assessment scores for role-based courses and the outcomes of phishing simulations, including click and report rates over time, with the follow-up training given to people who failed. The implementing regulation requires effectiveness assessment for security-skilled roles. Transfer training is equally important: when someone moves into a security-skilled role, the transfer training should be logged with its date and content, so the record shows the gap was closed before the new duties began.

Endpoint configuration compliance results

Endpoint checks show whether cyber hygiene holds on devices, not just in training slides. Wazuh Security Configuration Assessment scans monitored endpoints for misconfigurations using YAML policies, mostly based on CIS benchmarks, and recommends remediation. Fleet policies ask yes or no questions of devices and show which devices pass or fail each policy. Export pass and fail results on a set schedule, keep the policy versions used, and record how failures were remediated. Confirm the check frequency and retention with the tool vendor and your own environment.

What meeting Article 21(2)(g) costs in money and effort

This table breaks the cost of cyber hygiene and training into components, showing who is paid, whether each cost is one-time or recurring, and what pushes it up or down. Use it to build a quote request, since no supplied figures exist for these costs and every amount depends on your own headcount, roles and supplier population.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it up or down
Course content development or licensing	Content authors, internal security staff, or a training vendor	One-time build, recurring refresh	Number of role families, languages, and how often threats and policies change
Learning platform hosting or licenses	Software vendor or internal platform team	Recurring (licenses) or recurring (hosting staff time)	Headcount enrolled, and whether a self-hosted LMS such as Moodle removes per-seat license spend
Internal time for designers and security staff	Your own staff, who are not invoiced separately	One-time setup, recurring updates	Depth of role-based content and how much tailoring is done in-house
Delivery time for managers	Line managers and management body members	Recurring, per training cycle	Size of management team and frequency of the repeated awareness program
Effectiveness testing	Security team, or an external provider running phishing or knowledge checks	Recurring	Required by Annex 8.2.3 for security-skilled roles; scope of testing and number of cohorts
Evidence upkeep	Compliance lead and system owners retaining completion and assessment records	Recurring	Audit frequency, retention rules, and whether completion data is exported automatically
Training on transfer and new hires	HR and security staff onboarding people into security-skilled roles	Recurring, tied to staff movement	Staff turnover and the number of internal transfers into security-skilled roles
External review of curriculum or assessments	Independent reviewer or consultant	Periodic, optional or as scoped	Need for outside validation of role content; confirm scope and deliverables in writing before work starts

How self-hosted tools can produce the training and hygiene evidence

Self-hosted open-source tools can generate much of the raw evidence behind Article 21(2)(g), but each one proves a different thing. Moodle records training activity, Wazuh and Fleet record the state of devices. Neither replaces a decision by management about what the organization expects of staff, and neither should be presented to a supervisor as proof of competence on its own. Before you build anything, confirm with your own team which roles need security skills, which devices and endpoints count as in scope, and whether the platforms can run inside your own cloud account, data center or air-gapped network. In Moodle, the activity completion feature can mark an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for the activity. That gives you a per-learner record of who took the awareness module, the phishing exercise or the role-based course, and when. Completion alone, however, does not show effectiveness. A learner can open a page without reading it, and a tick box shows attendance, not understanding. Where the implementing regulation asks for effectiveness to be assessed for roles that need security skills, pair completion with graded assessments, scenario results and follow-up checks, and confirm with your assessor which of these they will accept. Confirm the license terms of Moodle (GPL-3.0-or-later) with your legal team before you modify or redistribute the platform. For hygiene practices such as configuration and updates, Wazuh Security Configuration Assessment (SCA) checks monitored endpoints for misconfigurations using YAML policies, most of them based on CIS benchmarks and extendable with custom policies. It inspects files, directories, registry keys and running processes, and it recommends remediation. Fleet complements this with policies written as yes or no osquery questions, such as whether disk encryption is enabled or automatic updates are on, and its policies page shows which devices in each fleet are passing or failing. Use the results to show trend and coverage, and decide with your team how failing devices are remediated and recorded. Wazuh is licensed under GPL-2.0-only and Fleet under MIT, so check both license terms with your legal team, and confirm with each vendor's documentation whether a given check matches your own baseline.

Who does what for training: your team, a partner and the auditor

Your organization owns the cyber hygiene and training program. Article 21(2)(g) is a duty on the entity, so the awareness program, the decisions about what management must learn, the assignment of people to security-skill roles and the training records all sit with your management body and security function. Outsourcing can supply content and systems, but it does not move accountability.

Program ownership: Name an accountable owner for the awareness program and set its scope across employees, management body members and, where appropriate, direct suppliers.
Management training decisions: Decide which training the management body receives, how often, and who signs off that it took place.
Role assignments: Identify which staff roles need security skills and move people into or out of them, including triggering training on transfer.
Records and effectiveness: Keep attendance, completion, assessment results and the reasons for any exception, and review whether the training changed behavior.
Quotes and scope: When you buy help, specify in writing who writes the curriculum, who administers the platform and who keeps the records.

Before relying on any partner output, check that your own named owner can explain the program, its schedule and its gaps without referring to the vendor.

Where organizations fall short on training and how to close each gap

Most NIS2 training programs fail in the records, not the slides. The gaps below recur across organizations, and each one has a practical fix that an assessor can check against Article 21(2)(g) and the awareness and role-based training requirements of Implementing Regulation (EU) 2024/2690.

Training delivered but not recorded per person

Sessions run and slides get filed, but no record ties a named employee to a completed module and a date. A supervisor asking who completed the phishing course cannot get an answer from a shared attendance sheet. Fix this by assigning each course to named accounts in a learning platform that stores completion per learner and exports it on request. For example, Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions you set. Confirm which condition matches your awareness content before you rely on it.

No link between completion and effectiveness

Completion rates show who clicked through, not whether staff can spot a credential-harvesting email. The implementing regulation expects the effectiveness of role-based training to be assessed, so completion alone will not satisfy it. Add short knowledge checks tied to the threats named in the program, such as phishing and social engineering, and track results by team over time. Repeat the simulated test after the training and compare outcomes, so the report shows a change in behavior rather than attendance.

Management members left out

Board and executive members are often excluded from awareness programs because their schedules are full. The implementing regulation includes management body members in the awareness program, and management carries personal responsibility for approving the Article 21 measures. Schedule a separate briefing for the management body that covers risk decisions, reporting duties and how incidents reach them, then record attendance in the same system used for staff.

Movers and new joiners missed

New employees often receive a generic orientation and never get the awareness program repeated, while staff who move into roles that need security skills keep their old training profile. The regulation requires training for new employees and role-based training on transfer. Connect onboarding and HR role changes to the learning platform, so each new account and each change of job code triggers the right course assignments automatically.

Suppliers never addressed

Contractors with privileged access, managed service staff and key suppliers often operate outside the awareness program. The regulation asks for awareness coverage of direct suppliers and service providers where appropriate, so the question is which suppliers need it. Decide that scope from the supplier's access and data handling, put the requirement into contract clauses, and keep evidence that each supplier's staff completed the training you specified.

Endpoint hygiene not measured

Basic cyber hygiene covers updates, device configuration, segmentation and identity controls, yet many organizations check these only during audits. Recital 89 names these practices as basic hygiene, so they belong in the measurement loop. Use a configuration assessment tool such as Wazuh, which scans endpoints against YAML policies, mostly based on CIS benchmarks, and recommends remediation. Fleet's policies page shows which devices pass or fail each yes or no check, which gives you a per-device view to report on.

What buyers ask about training effort, cost and outside help

How much staff time does a NIS2 cyber hygiene and training program take?

The effort depends on headcount, how many people hold security-relevant roles, and how often the awareness program repeats. Implementing Regulation (EU) 2024/2690 expects an awareness program for all employees, including management body members, that is repeated over time and covers new joiners, so the recurring cost is the main thing to plan for. Role-based training for staff with security duties is a separate track that must be regular, job-relevant and assessed for effectiveness. Ask your team to estimate hours per person per year for each track, then multiply by headcount. Ask any partner to show that estimate in the written scope so you can test its assumptions.

How long does it take to build a training program?

No researched duration is available for this, so treat any date you are given as a planning assumption until it is written into a scope. The critical path usually includes agreeing the role inventory, drafting the curriculum, setting completion tracking and running a first cycle to test effectiveness. Your own deadlines matter too, since national transposition laws and supervisors set the timing for when evidence must exist. Confirm with your national competent authority and your compliance lead which dates apply to your entity, and ask any partner to break its plan into dated milestones with named owners.

Can we run NIS2 cybersecurity training in-house?

Yes, many organizations run the awareness program internally, provided someone owns the curriculum, the schedule and the evidence. The harder parts are role-based training for engineers and administrators, which needs technical depth on secure configuration, known threats and behavior during security events, and the effectiveness assessment that proves the training worked. An internal team can cover these if it has the skills and time. Otherwise, a fixed-scope engagement can prepare the materials, learning paths and tracking, while your staff keep ownership of decisions and records.

What does management need to do for the training obligation?

Management body members are part of the awareness program under the implementing regulation, so they cannot be exempted from it. In practice, leadership must approve the training approach, attend the sessions assigned to them, and review results such as completion rates and assessment outcomes. Article 20 of NIS2 places oversight duties on the management body, and the training is one of the ways it shows that oversight. Ask who on the executive team will sign off the program and who will receive the results each reporting cycle.

Do our suppliers and service providers have to be trained?

The implementing regulation says the awareness program covers, where appropriate, direct suppliers and service providers. Whether it applies to a given supplier depends on the access they have to your systems and data and on the risk they create. Start by listing suppliers with privileged access or access to sensitive systems, then decide which of them need awareness content and how you will confirm they completed it. Contract clauses are often the practical route. Your supply chain measure and contracts should describe what training is required and how evidence is returned to you.

What cost drivers should we expect for training and outside help?

DeployOpen does not publish prices, and no researched cost figure is supplied for training programs. The main cost drivers are headcount, the number of role-based tracks, the depth of technical content, the platform used to deliver and track training, how often content is refreshed, and how much assessment work is needed. Costs fall into one-time items such as curriculum design and platform setup, and recurring items such as delivery, updates and evidence collection. Ask any provider to split its quote into these categories and to state what is included in each.

What should a written training scope include before we hire a partner?

A written scope should list the audiences (all staff, management, role-based groups, and any suppliers in scope), the curriculum topics, the delivery and tracking platform, and how completion and effectiveness will be measured. It should name deliverables such as materials, learning paths, completion reports and the evidence pack, with owners and dates. It should also state what the partner will not do, such as issuing any compliance report, and who keeps the records. Finally, it should name your responsibilities, including approvals, access to systems and staff time for sessions.

Which open-source tools can record training completion and show it works?

Moodle can track activity completion, which marks a learner's activity complete when they view it, receive a grade, or tick it manually, depending on the conditions you set. That gives you per-person completion records for the awareness program. For role-based staff, you still need an assessment of effectiveness, which Moodle can support through graded activities. Confirm with your partner how these records will be exported and retained. Tooling produces evidence, but it does not decide whether your training is adequate, which remains your responsibility.

How DeployOpen works on this

DeployOpen plans, implements and documents the training and awareness platform for Article 21(2)(g) inside your own infrastructure, using self-hosted open-source tools. We prepare the courses, completion records and effectiveness evidence that your organization owns, and an independent assessor or your national competent authority decides whether they meet your obligations.

How we scope

Engagements are fixed-scope, with the audience groups, courses and platforms agreed in writing before work starts.
The written scope names management body members, staff in security-skill roles, new joiners and any direct suppliers included.
We confirm which hygiene practices, such as updates, device configuration and identity controls, the training and checks must cover.

How we build

We deploy the learning platform in your environment and configure activity completion rules so each learner's completion is recorded.
We set up configuration checks with Wazuh and device policies with Fleet to show whether endpoints meet the hygiene baseline.
We build role-based course paths for security-skill roles, covering secure configuration, known threats and behavior during security events.

How we hand over

We document the awareness program, repeat schedule, onboarding steps and role-based training paths for your compliance file.
We deliver exportable completion reports, effectiveness assessment records and policy check results that your assessors can review.
Your staff are trained to run the platform, and your organization keeps ownership of the content, records and decisions.

How we support

Ongoing support, course updates and platform upgrades are available as a retainer after handover.
Retainers can cover periodic refresh of phishing and social engineering content as threats change.
Ask us to confirm which evidence formats your auditor or supervisor expects before the scope is signed.