Article 20(2) NIS2 management body cybersecurity training

What NIS2 Article 20(2) requires management bodies to train on

Under NIS2, members of the management body must follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess the risk-management practices in place and how those practices affect the entity's services. This is a duty on the individuals sitting on the board or equivalent body, not a general staff awareness obligation. The training has to equip the people who approve the Article 21 measures and oversee them to ask useful questions about the entity's systems, suppliers, incident handling and the services it delivers, and to judge whether the answers are credible. Article 20(2) sets the outcome, which is competence to assess, not a course title or a certificate of attendance.

The Directive sets no minimum number of hours and no required frequency for management body training, and it does not name a provider, a format or a topic list. Member States must encourage essential and important entities to offer similar training to their employees on a regular basis, but for staff that is only an encouragement. The gap between the two is where most of the difficulty sits. The mandatory duty for board members is outcome based and open to interpretation, while the staff training is optional at the EU level. Confirm with your national competent authority and transposition law how it expects this duty to be evidenced, and agree internally what counts as sufficient competence before you buy or design any course.

Implementing Regulation (EU) 2024/2690 closes part of that gap. Its awareness program must reach employees, including members of management bodies, and be scheduled so that activities repeat and cover new joiners. Its role requirements also call for mechanisms that ensure management body members understand and act in line with their responsibilities and authorities for network and information system security. For a practical start, record each member's training, the date, the topics covered and the decisions they were then expected to make, and schedule a refresh whenever threats, systems or services change materially. Learning platforms such as Moodle can hold these records, and its activity completion feature (see the Moodle activity completion documentation) can show whether a learner viewed, was graded on, or ticked off an activity, which is useful evidence only if the completion conditions match what you claim the training proves.

Which members, entities and training records fall under Article 20(2)

Article 20(2) reaches the members of the management body of every essential and important entity in scope, so the first job is confirming which entities are in scope and who sits on their management bodies. The cards below cover the scoping decisions that change who must be trained and what proof the entity should keep.

Management body membership

The duty attaches to the members of the management body, which is the body that approves and oversees the entity's cybersecurity measures under Article 20. Check the articles of association, board charter and national law to identify who holds that role, including members who sit on a committee acting for the board. Record each member by name and role so the training population is fixed and auditable.

Non-executive directors

Non-executive and independent directors are members of the management body and are generally within the training duty, even though they do not run daily operations. Their role is to oversee risk, so the training should cover how to judge cybersecurity risk-management practice and its effect on services. Ask counsel to confirm how the national transposition law treats each director category.

Group subsidiaries and parent boards

Where a subsidiary is itself an in-scope entity, its own management body must be trained, even if the group board or parent company provides the security function. Decide whether the parent board's training covers subsidiary boards or whether each entity keeps separate records. Keep the group scope and the entity-level training roster consistent.

Deputies and alternates

A deputy who regularly attends or votes in place of a member may be treated as a management body member under the national law and the entity's rules. Confirm whether alternates must complete the same training before they act on the board's behalf. Record deputy appointments and their training dates so that a member who steps in is not untrained at the moment of decision.

Member State differences

NIS2 is a directive, so the exact training obligation, its format and its evidence standard come from the national transposition law of the Member State with jurisdiction over the entity. Confirm the competent authority and the national text before fixing a curriculum. Entities operating in several Member States should map each national requirement to one training record.

Training records and employee awareness

Keep a dated record for each management body member showing the course, the content covered and the completion status, separate from general staff awareness. Implementing Regulation 2024/2690 expects awareness activity to reach management body members and to repeat, so a learning platform's completion data can support this evidence if its settings are configured to show it. Confirm with the assessor which records they will accept.

How an assessor tests management body training

This table sets out the steps an assessor or national authority would take to test Article 20(2) training, with the evidence each step needs and the findings that usually come up. Read it as a test script: each row is a question the entity should be able to answer with records before an inspection starts. NIS2 creates no certificate, so the result is a finding or a clean report from the supervisor, not a pass mark.

Test step	What the assessor checks	Evidence that passes or common finding
Confirm the obligation applies	The entity is essential or important, and the people tested sit on its management body or act as its legal representatives	Passes with a current member list and role mapping. Finding: a board list that is out of date or omits co-opted members
Request training records	Dated records of training for each named management body member	Passes with attendance or completion records per person. Finding: no records at all, or records that cover only the leadership team
Check the content	Whether the course builds ability to identify cybersecurity risks and assess the entity's risk-management practices	Passes with a syllabus that covers risk identification and assessment. Finding: training that stops at general awareness
Test the link to the entity	Whether the training refers to the entity's own services, systems, suppliers and incident history	Passes with examples drawn from the entity's own environment. Finding: generic slides that could apply to any organization
Check timing for new members	Whether members who joined after the first course were trained before or soon after taking their seat	Passes with onboarding records tied to appointment dates. Finding: members who were never trained after joining
Check follow-up	Whether training is refreshed as threats, systems and services change	Passes with a documented refresh schedule and a record of what changed. Finding: one course delivered years earlier and never repeated
Review the supervisory route	How the authority can request evidence, since NIS2 sets no certificate	Expect inspections, security audits, information requests and possible administrative fines under Articles 32 to 34, so keep records ready before any request arrives

Steps to put a management training program in place

This sequence turns the Article 20(2) duty into a documented program: who must be trained, what they must be able to do, how training is delivered and repeated, and whether it changed anything. Each step produces an artifact an assessor or supervisor can inspect.

Map the management body members
Start by listing every person who sits on the management body or acts as a legal representative of the entity, using the entity's governance records and board or executive minutes. Confirm the list with the company secretary or legal team, and record any members who join or leave during the year. The output is a roster that names each member, their role, and the date they were confirmed, so you can show a supervisor exactly who the training covers.
Define learning outcomes from the risk measures
Work from the entity's Article 21 risk-management measures and its current risk assessment to decide what each member must be able to do. Outcomes should cover identifying cyber risks, judging whether the risk-management practices are adequate, and understanding how those risks affect the services the entity provides. Have the CISO or security lead draft the outcomes and the management body or its chair approve them. The output is a short outcomes document that links each outcome to a measure or risk area.
Select or build course content
Decide whether to buy external management courses, build internal material, or combine both, then check that the content addresses the outcomes in the previous step. Content should use the entity's own risk register, incident history and service map where possible, so members review real decisions rather than generic theory. Ask any provider to show how the course maps to the outcomes and who authored it. The output is a course or module set with a documented match to each outcome.
Schedule initial and repeat sessions
Set a calendar that covers each member's first session and a repeat cycle, with the cycle length chosen and approved by the management body. The Directive sets no minimum duration or frequency, so the schedule should reflect the entity's risk profile and changes in its environment, and you should be able to explain that choice to a supervisor. Include sessions for new members as they join. The output is an approved schedule with owners and dates for each session.
Run sessions and record completions
Deliver the sessions, then record attendance and completion for each member against the roster. If you deliver through a learning management system, configure each activity so that completion is recorded under conditions you can defend, such as viewing the material, passing a graded check, or a documented manual sign-off. Keep the records with the session date, content version and facilitator. The output is a completion log that shows which members finished which module and when.
Confirm understanding of roles and responsibilities
Implementing Regulation 2024/2690 expects mechanisms that show management members understand and act within their role, responsibilities and authorities for network and information system security. Test this with a short assessment, a tabletop discussion of a decision the board must make, or a review of how members used the training in a risk acceptance or policy approval. Record the result and any follow-up actions. The output is a role-understanding record for each member.
Review effectiveness against incidents and findings
At each cycle, compare the training outcomes with real evidence: incidents, near misses, audit findings, risk acceptances and decisions the management body took. If incidents or findings show gaps in judgment or oversight, update the outcomes and content and schedule targeted sessions. Document the review, who conducted it and what changed. The output is a dated effectiveness review that feeds the next roster, outcomes document and schedule, closing the loop.

How the implementing regulation extends training to roles and awareness

Article 20(2) sets the training duty for management body members, but Implementing Regulation (EU) 2024/2690 turns a single course into a program that has to keep running. Its awareness requirements in the Annex (points 8.1.1 and 8.1.2) require the awareness program to reach employees, and expressly include members of management bodies, and to be scheduled so that activities repeat and cover new employees. For a board, that means the training cannot be a one-time onboarding event for directors. The entity needs a documented calendar, an owner for it, and a way to enroll anyone who joins the management body or the workforce later. Before signing off on a training plan, ask the provider how the schedule repeats, who is enrolled automatically, and where attendance is recorded.

Point 10.1.2(c) of the Annex goes further and asks for mechanisms that ensure management body members understand and act in line with their role, responsibilities and authorities for network and information system security. Knowing the subject matter is not enough under this requirement. Practical evidence includes role-specific modules for directors and executives, records showing which decisions they approved after training, and a check that the training content matches the authorities written into their terms of reference or board charter. A useful internal test is whether a director can explain, in the entity's own terms, which Article 21 measures they approved and who reports to them on each one. Confirm with your legal and governance team how these responsibilities are documented before the first session.

Treat the Article 20(2) training record and the implementing regulation's awareness and role evidence as one file. The same completion data can show that a director completed the baseline course, attended the refresher on the schedule, and acted on the role mechanism. Learning platforms can record completion, but a checkbox alone rarely proves understanding. Moodle, for example, marks an activity complete when a learner views it, receives a grade or ticks it manually, depending on how the activity is configured in the Moodle activity completion documentation, so the reader should decide in advance which condition counts as evidence for management members. Whichever system you use, agree the evidence standard with your auditor or competent authority contact early, since the Directive sets no minimum duration or frequency for management training.

Which training evidence satisfies a supervisor

A supervisor will not accept a statement that management attended training. It will look for records that name the people, describe what was taught, prove completion and show the training was tied to the entity's risk decisions. The cards below cover the artifacts that do this and how to keep them current between audits.

Named training roster

A roster lists every current member of the management body and legal representative, with the date each person joined and the role they hold. It is the baseline the supervisor checks against: if a member appears on the board register but not on the roster, the gap is visible at once. Reconcile the roster against the company register and board minutes each quarter, and record who owns the reconciliation.

Course content and learning outcomes

Keep the syllabus, slides or module outline for each course, along with the stated learning outcomes. Article 20(2) asks that members gain enough knowledge and skills to identify cybersecurity risks and assess risk-management practices and their effect on the entity's services, so outcomes should map to those abilities. A supervisor will ask whether the content was tailored to the entity's services or was a generic overview, so note any customization.

Dated completion records

Completion records show who finished which module and when. Where the training runs on a learning platform, the platform's completion settings decide what counts as done: viewing a resource, receiving a grade or ticking a box can each mark it complete. Choose a rule that proves the member engaged with the material, and export the completion report with timestamps rather than relying on screenshots.

Assessment results

A short assessment at the end of each course shows that knowledge was tested, not just delivered. Keep the questions, the pass threshold and each member's score and attempt history. Low scores should trigger follow-up training or a documented decision, because a supervisor reviewing a record of repeated failures without action will question whether the training had any effect.

Board minutes showing review

Training is more credible when the management body reviews it. Minutes should record that the training programme was presented, that gaps in members' knowledge were discussed, and what was decided. This links Article 20(2) to the approval and oversight duties in Article 20(1), so the minutes also show the body acted on what it learned.

Records for new members

Each time a new member joins the management body, record when the onboarding training was completed relative to their start date. Gaps appear most often here, because appointments happen outside the normal training calendar. A checklist that blocks formal sign-off of the appointment until the training is recorded prevents the gap from forming.

Refresher schedule and records

Article 20(2) sets no minimum frequency, so the schedule is the entity's own decision and must be defensible. Document the interval, the trigger for extra sessions (for example, a major incident or a new service), and the completion of each refresher. Confirm with counsel or the competent authority how the interval will be justified, since the Directive itself does not set one.

What management training costs in money and effort

This table breaks down the cost components of meeting Article 20(2) training for management body members, showing who is paid, what is one-time or recurring, and what drives cost up or down. Use it to build a quote request and to separate spend you can avoid from spend you cannot. No figures are given because the directive sets no duration or frequency and no price data was supplied.

Cost component	Who is paid or who spends time	One-time or recurring	What drives it and what to ask for in a quote
Course design or content licensing	Content developer, or a vendor that licenses ready-made modules	Mostly one-time, with recurring updates	Depth of technical content and whether it covers your sector. Ask whether content is licensed per user, per year, or bought outright, and who updates it when rules change.
Member delivery time	Management body members and their support staff	Recurring, every training cycle	Number of members and the depth needed to assess risk and its impact on services. Ask the provider how long each module takes and how completion is recorded.
Learning platform and hosting	Internal platform team, or a hosting provider if the platform is managed	Setup is one-time, hosting and upkeep recur	Whether the platform is hosted in your own environment or a vendor's, and who patches it. Self-hosted open-source platforms such as Moodle (GPL-3.0-or-later) remove license fees but keep hosting and upgrade effort.
Records and completion tracking	Compliance lead or HR, with platform support	Recurring	Retention period for training records and the evidence format an assessor would expect. Confirm the platform can show who completed which module and when.
External trainer or consultant fees	Outside trainer or NIS2 consultant	Recurring if used every cycle, one-time if used to set up	Whether the trainer is needed for live sessions or only for initial content. Ask for a fixed-scope quote naming the sessions, audience size and deliverables.
Review by an outside party	Independent reviewer or auditor, if engaged	Periodic	Who decides the scope of review. Only an independent auditor or assessor can issue a formal opinion, so ask whether the quote covers readiness review or formal assessment.
Refresher and new member onboarding	Compliance lead and members	Recurring	Frequency of refreshers, membership turnover, and changes to services or threats. Ask how new members are onboarded before they take decisions on cybersecurity risk.

Who owns management training and who can help

Your management body owns the training duty. Members of the management body of an essential or important entity must follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess the risk-management practices and their effect on the entity's services. The management body decides what the training covers, who attends, how often members return to it, and whether the content reflects the entity's own risks, systems and suppliers. These decisions stay with the organization even when external trainers deliver the sessions.

Training scope: Decide which risks, services and Article 21 measures the curriculum must explain, based on the entity's own risk assessment.
Attendance: Name each management body member and record who completed which module and when.
Frequency: Set a repeat cycle in writing, since the Directive sets no minimum duration or frequency.
Role clarity: Confirm that members understand their responsibilities and authorities for network and information system security.
Accountability: Management keeps accountability for the training program and cannot outsource that accountability to a provider.

Check that the board minutes approve the training plan and that a named executive owns it.

Where management training programs usually fall short

Most management training programs exist on paper but would not show an assessor that Article 20(2) was met. The gaps below share one root cause: the training is not tied to named individuals, to the entity's own services, or to what has happened since the last session.

Generic employee course reused

A standard awareness module built for all staff is often assigned to board members without change. It rarely explains how the entity's services depend on networks and systems, or how a board member should challenge the risk-management measures. Check whether the content addresses the decisions management actually makes, such as risk acceptance, budget and supplier choices. Closing action: write a management module with its own learning objectives and have the management body approve it.

No records tied to named members

Completion data often lives in a learning platform as an anonymous enrollment list, or as a signed attendance sheet filed away from the governance records. An assessor will ask who the members of the management body were on a given date and what each one completed. Keep a register that lists each member, their role, the training taken and the date. Closing action: reconcile the training log against the current board membership at every meeting cycle.

New members without training

Members who join after the course, through appointment, election or a change of legal representative, frequently never receive it. The gap is invisible until someone reviews the roster against the training log. Confirm how onboarding for a new board member works and whether it includes the cybersecurity training before their first vote on risk matters. Closing action: add the training to the written onboarding checklist for every management body appointment.

Content unlinked to services

Training that stays at the level of general threats does not let members assess whether the entity's risk-management practices fit its services and its impact on them. Members need to see which services depend on which systems and what a disruption would mean for customers. Ask whether the course uses the entity's own service map, asset inventory and past risk assessment results. Closing action: build each module around one service the entity provides and its main failure scenarios.

No review after incidents

When a significant incident occurs, the training is seldom updated to reflect what members learned from it. The same weaknesses then appear again in board discussions, and the training record shows nothing about it. Check whether post-incident reviews feed into the next training cycle and whether members can show they understood the root causes. Closing action: make the training review a fixed agenda item after each significant incident and record the changes made.

Questions buyers ask about Article 20(2) training

How long does NIS2 management body training have to be?

The Directive does not set a minimum duration for management body training. Article 20(2) requires members to follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess the risk-management practices of the entity and their impact on its services. The right length is the length needed to meet that test for your sector, size and risk profile. Ask the training provider to map each module to the risks your board must understand, and ask your national competent authority or sector regulator whether it has published any expectation on duration. The test is outcome-based, so a short session with no assessment may be harder to defend than a longer one that shows what members learned.

How often should board members repeat cybersecurity training?

Article 20(2) does not set a repeat interval, so the frequency is a judgment your organization must document and defend. Most programs refresh content when the threat landscape, systems, regulatory guidance or the entity's risk profile changes, and when new members join the management body. Implementing Regulation (EU) 2024/2690 expects awareness activities to repeat and to cover new staff, and it requires that members of management bodies understand and act in line with their role. Set a schedule in the training policy, record each cycle, and explain any change to it in board minutes.

Can a board member self-certify that they completed the training?

A self-declaration alone is weak evidence. A signed statement shows intent, but it does not show that the member gained the knowledge and skills Article 20(2) describes. Stronger records include course attendance, completion records from a learning platform, a short assessment with a recorded result, and minutes showing the board discussed the material. A learning platform such as Moodle can record activity completion, which marks an activity complete when a learner views it, receives a grade from it, or ticks it manually, depending on the conditions you set. Configure those conditions so that completion means the member engaged with the content, not only that they opened a page.

What drives the cost of management body cybersecurity training?

Cost depends on the content, the delivery model and the people who build and run it. The main components are content design tied to your sector and systems, instructor or provider time, the hours each board member spends, assessment design, hosting and administration of the learning records, and updates when risks or systems change. Costs rise with bespoke content, live sessions for small groups, multiple languages across Member States, and frequent refresh cycles. Costs fall when you reuse modules and schedule short refreshers. Ask any provider for a written quote that separates one-time build costs from recurring delivery and update costs, and that states what evidence the package produces.

Can we run management body training ourselves?

Yes, provided the content is accurate, the training is documented, and the board can show that members gained the required knowledge. Many organizations use internal security leads to design modules and host them on their own learning platform. The obligation remains with the management body, so internal ownership of the training policy, the schedule and the records is essential. Outside help is most useful for building the sector-specific content, designing assessments, or checking that the program covers risk identification and the assessment of risk-management practices. DeployOpen can plan, implement and host a self-hosted learning environment in your own infrastructure and prepare the records, but it does not certify that members are trained.

What evidence does a regulator ask for to prove management training?

Regulators oversee compliance through inspections, information requests and security audits rather than a certificate, so you should expect to produce documents on request. Keep a training policy that names the management body as in scope, a curriculum that maps to the risks the board must understand, a schedule, attendance and completion records for each member, assessment results, and board minutes showing that members acted on what they learned. Keep records of new members and the training they received on joining. Store these in a system that preserves dates and audit trails. Confirm the exact evidence expectations with your national competent authority, since transposition laws differ between Member States.

Does NIS2 training for employees have to match the board's training?

No. Article 20(2) requires management body members to follow training, and it asks Member States to encourage essential and important entities to offer similar training to employees on a regular basis. The encouragement is not a fixed duty with a set length. Implementing Regulation (EU) 2024/2690 separately requires an awareness program that reaches employees, including members of management bodies, and that is scheduled so activities repeat and cover new employees. A single learning platform can serve both audiences, but the board curriculum should go deeper into governance, risk acceptance and oversight.

How DeployOpen prepares training systems and evidence for this requirement

DeployOpen starts with a written scope that names the audience, the course content, the completion rule and the evidence the entity expects to keep. For Article 20(2), the audience is the members of the management body, and the scope should also state whether the same platform will serve the regular training the Member State is asked to encourage for employees. Because the Directive sets no minimum duration or frequency, the scope should record the entity's own training plan and who signed it off. Deliverables, the hosting location and the handover owner are agreed before work begins, so the entity knows what it will hold at the end and who is responsible for each part.

DeployOpen then deploys a self-hosted learning platform inside the client's own cloud account, data center or air-gapped network, so training records stay under the entity's control. Moodle, licensed under GPL-3.0-or-later, is one option that can be configured this way. The work covers hardening, access control tied to the entity's identity provider, backups and the course content itself. Completion tracking needs deliberate setup: Moodle's activity completion can mark an item complete when a learner views it, when they receive a grade, or when they tick it manually, so the scope must pick one rule per course and test it with a sample learner before anyone relies on the records.

The evidence pack is assembled from the platform and the approved plan: the training policy, the course outlines, the enrolment and completion reports per member, the dates of each session, and the record of who reviewed the content. DeployOpen does not issue audit reports or certificates. The entity owns its training obligation, and an independent auditor or certification body is the party that tests the evidence and reports on it. Before signing a scope, ask the provider to confirm how records are exported, how long they are retained, and whether the completion rule will be explained to an assessor in writing.

Article 20(2) Management body cybersecurity training