Open source LMS for NIS2 cybersecurity training

Open source LMS for NIS2 cybersecurity training: what the Directive asks your organization to prove

If your organization is an essential or important entity under NIS2, you must be able to show that your management body and your staff have been trained. NIS2 sets this duty in two places: Article 20(2) asks members of management bodies to follow training that gives them enough knowledge to identify cybersecurity risks and assess the risk-management measures and their effect on the entity's services, and Article 21(2)(g) requires basic cyber hygiene practices and cybersecurity training. The Directive sets no minimum hours and no minimum frequency for management training, and it creates no certificate of compliance. Regulators check compliance through inspections, audits, scans and information requests, so the evidence is what you build. An LMS supplies the course design and the completion records that answer those questions.

The detailed expectations sit in Commission Implementing Regulation (EU) 2024/2690, which applies to a defined set of digital and cloud providers. Its awareness program requirements in points 8.1.1 and 8.1.2 cover employees, including management body members, and call for activities that repeat over time and reach new joiners. Staff in security-relevant roles also need regular job-relevant training, and its effectiveness must be assessed. The first decision for your team is therefore to map each audience to a course, a repeat cycle and a recorded assessment result. Ask your LMS partner to show how role-based enrollment, scheduled reassignment and completion reports will produce that map from the platform itself. Confirm with your competent authority which requirements apply to your sector, since the Regulation's technical scope is narrower than the Directive's.

NIS2 is a directive, so the binding detail comes from national transposition laws, and these differ between Member States. Some Member States may set stricter rules under Article 5, so confirm the exact wording and any hour or frequency expectations with your national authority before you fix a schedule. The Commission's proposal COM(2026) 13, published on 20 January 2026, would amend NIS2 with a new small mid-cap category, but it still needs approval by the European Parliament and the Council, so do not treat it as current law. ENISA's June 2025 technical implementation guidance gives examples of evidence and framework mappings that help you define what a completion record should contain. Build the training design around the obligations in force today and plan for amendments as they are adopted.

Which NIS2 training requirements the LMS must meet, and how to configure it

This table maps each NIS2 and Implementing Regulation 2024/2690 training requirement to what the function must do and how to configure Moodle or Open edX to produce the evidence. Read each row as a requirement, a configuration to build, and the record an assessor would expect to see.

Requirement	What the function must do	Moodle or Open edX configuration and evidence
Article 20(2): management body training	Members of management bodies follow training so they can identify cyber risks and judge the entity's risk-management practices and their effect on services. The Directive sets no minimum duration or frequency.	Create a management course set in Moodle with a cohort based on board and executive roles. Assign it manually or through a role-based sync. Keep the course content focused on risk decisions, supplier exposure and incident reporting. Export completion dates and quiz results as the record of attendance.
Article 21(2)(g): basic cyber hygiene and cybersecurity training	Provide basic cyber hygiene practices and cybersecurity training to the workforce, covering the topics listed in Recital 89.	Build a core course with modules on phishing and social engineering, identity and access management, software updates, device configuration, network segmentation and zero-trust principles. Use activity completion and mandatory quizzes so each module leaves a timestamped record.
Article 20(2): regular staff training	Encourage the entity to offer similar training to employees on a regular basis, so the schedule must be defined and followed.	Set a recurrence rule in the course, using enrollment duration or a scheduled re-enrollment process, and confirm how the platform handles re-enrollment and reset of completion. Confirm the intervals with your compliance lead, since the Directive does not set them.
Implementing Regulation 2024/2690, points 8.1.1 and 8.1.2: awareness program	Run an awareness program that reaches employees, including management body members, and where appropriate direct suppliers and service providers. Activities must repeat over time and cover new employees.	Use a cohort or enrollment method that matches all active accounts. For joiners, configure automatic enrollment on account creation or a sync from HR or identity systems, with the enrollment date as the start of the mandatory window. Track coverage with a report of enrolled versus completed users per cohort.
Implementing Regulation 2024/2690, point 8.1.2: new joiners	Cover new employees within the program, so joiners cannot run long without training after they start.	Set a deadline relative to enrollment date rather than a fixed calendar date. Use a scheduled report or notification to alert managers when a joiner has an open mandatory course past its deadline. Keep the timestamp of enrollment and completion.
Implementing Regulation 2024/2690, points 8.2.1 and 8.2.3: role-based job training	Give employees in security-relevant roles regular job-relevant training on secure configuration and operation, known threats, and behavior during security events.	Create separate role courses for administrators, developers and incident responders. Enroll by role or group membership, and align course content to the systems each role operates. Require a pass grade before completion is recorded.
Implementing Regulation 2024/2690, point 8.2.3: effectiveness assessment	Assess whether the training is effective, not only whether it was attended.	Use graded quizzes with a pass mark, question banks that change between attempts, and phishing simulations linked to course content. Review item-level results to find weak topics, and record the review decision. Confirm the assessment method with your assessor.
Completion reports and evidence retention	Show who was trained, on what, when, and with what result, for each period under review.	Use the completion report and course reports in Moodle, with exports of user, course, completion date and grade. Store exports with the policy version. For Open edX, confirm the completion and grade reporting available in your Studio and LMS release before committing to it.

Moodle or Open edX: which platform fits which NIS2 training program

Most NIS2 training obligations start with a broad program: management body members must follow training, and employees need a repeated awareness program that covers new joiners. When enrollment is driven by HR and directory data, Moodle is usually the simpler fit because it ships with a wide range of authentication plugins in core, so accounts, groups and role changes can flow from existing systems without custom code.

Identity sources: Core authentication covers manual accounts, email self-registration, external database, LDAP, LTI, OAuth 2, Shibboleth and web services, which map to most corporate directories and HR feeds.
Standard reporting: Completion and course reports are built in, which helps produce dated records for management body members and staff.
Plugin ecosystem: Moodle has a large plugin marketplace, including SAML 2.0 single sign-on, so identity needs beyond core can often be met without rewriting the platform.
Release cadence: Major releases arrive in April and October, and the long-term support line gives a longer window between upgrades, which suits a program that must run unchanged for years.
Hosting baseline: Moodle 5.3 requires 64-bit PHP 8.3 or later, PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and upgrades from Moodle 4.4 or later.

Confirm with your identity team which protocols your directory supports, and confirm that your current Moodle version is on a supported branch before planning the move.

Both platforms are self-hosted, so the NIS2 evidence sits in your environment, and the operating burden is similar in kind but different in size. Moodle has a well-established installation path, while Open edX is more involved to run, and its operating model reflects that. Decide the hosting model before you choose the course engine, because it sets the upgrade calendar and who carries patching.

Moodle web root: From Moodle 5.1, the web server document root must point to the public directory rather than the main Moodle folder, or the site may show directory listings or errors.
Moodle upgrade path: Sites must be on Moodle 4.2.3 or later to upgrade to Moodle 5.1, so older instances need a staged plan.
Open edX deployment: Tutor is the official Docker-based distribution for production and supports Kubernetes, which matters if your platform team already runs container clusters.
Support boundaries: Tutor is maintained by Edly, which offers professional support, while Moodle has managed options through MoodleCloud or Moodle Partners.
Upgrade planning: Moodle 5.3 is the next LTS with security support until 1 October 2029, so an LTS track can be planned around it, while Open edX requires moving to each new named release.

Confirm your container and database standards, your patching windows and whether your partner will own upgrades or only deploy them.

Which open-source platforms fit NIS2 training and why

NIS2 training duties are about records and repetition as much as content, so the platform has to keep completion evidence, support role-based assignment and stay on a supported release. The three candidates below differ mainly in license, release support and how much operational work sits with your team.

Moodle as the default candidate

Moodle is licensed under GPL-3.0 and its code is maintained by Moodle HQ (Moodle Pty Ltd). Its course completion tracking and reporting fit management briefings, staff modules and repeat cycles, and its core ships authentication plugins for LDAP, OAuth 2, SAML-based SSO through plugins and web services. Check that your identity provider is covered by core or a maintained plugin before you commit.

Moodle 5.3 as the next LTS

Moodle 5.3 is designated the next long-term support release, with bug fixes until 4 October 2027 and security fixes until 1 October 2029. Moodle 5.1 general support ends on 5 October 2026, so sites on that line need a planned upgrade path. Confirm the PHP, PostgreSQL or MySQL versions your hosting team must support before scheduling the move.

Managed Moodle options

You can self-host Moodle or run it as managed hosting through MoodleCloud or Moodle Partners. The choice shifts cost between hosting staff and a provider's service levels, so ask each option for its data location, backup and restore commitments and upgrade responsibilities in writing. Managed hosting does not remove your duty to keep completion records as evidence.

Open edX with Tutor for production

Open edX is licensed under AGPL-3.0 and suits organizations that want a modular platform with strong authoring tools. The maintainers recommend production deployments through a service provider or with Tutor, the official Docker-based distribution. Bare-metal installs receive limited community support, so budget for container operations and plan on Kubernetes skills if you need them.

Open edX release cadence

Open edX supports only the latest named release, and it cannot support more than one at a time. Verawood is the current release, published on 30 July 2026, with Willow planned for December 2026 and Xylon for June 2027. Every upgrade is a full platform move, so ask how the partner will test course content and integrations against each new release.

Canvas LMS as a candidate to confirm

Canvas LMS by Instructure is licensed under AGPL-3.0, so the source is open, but its operating model and feature set differ from Moodle and Open edX. Confirm which edition, deployment path and support arrangement fits your environment, and check whether the reporting you need for completion evidence is available without custom work. Treat it as a shortlist entry until those checks are complete.

How the NIS2 training program is built and repeated

The sequence turns NIS2 training duties into a scoped, role-based program on Moodle that runs on its own schedule, enrolls people automatically, and leaves dated records that management and assessors can review.

Confirm entity scope and management body membership
Legal, compliance and IT leads confirm whether the organization is an essential or important entity under the national law that applies to it, then list who sits on the management body and who holds roles that need security skills. The output is a signed scope note that names each audience group and the basis for including it. Confirm the classification with counsel or the national competent authority, because the Directive itself leaves the detailed transposition to each Member State.
Define role-based curricula for each audience
The program owner maps each audience to its own curriculum. Management body members need content on identifying cyber risk and judging the risk-management measures and their effect on services. General staff need basic cyber hygiene, including updates, device configuration, identity and access, and phishing and social engineering. Technical roles need job-relevant secure operation and incident behavior content. The output is a curriculum matrix that ties each course to its audience and to the policy it supports.
Configure enrollment from identity and HR data
Engineers connect Moodle to the directory or identity provider using the authentication methods the platform supports, such as LDAP, SAML or OAuth 2, and link role attributes from HR data to cohorts. New joiners, movers and leavers then enroll or unenroll without manual lists. The output is a tested cohort mapping, with a sample of accounts checked against their expected courses. Confirm the source of truth for management body membership, since board changes often arrive late in HR records.
Publish and version the course content
The content owner builds or imports the courses, sets completion rules, and records the version of each course and assessment. Policy acknowledgments and quizzes are included where the program needs them. The output is a published course catalog with version history, so a later reviewer can see which material each person was shown on which date. Confirm the rights to any third-party material and the accessibility state of the content before publication.
Run the first training cycle
The program owner opens the first enrollment wave to each audience group and tracks progress in the Moodle reports. Reminders go out to anyone who has not started, and exceptions are logged with a reason and an owner. The output is a closed first cycle with completion status for every enrolled member of the management body and staff. Keep the first cycle's reports as the baseline for later comparisons.
Set the recurrence and joiner enrollment rules
Because the Implementing Regulation requires the awareness program to repeat and to cover new employees, the team sets the repeat schedule in writing, configures recurring enrollments, and confirms that new hires receive the baseline course on arrival. Suppliers and service providers are added where the risk assessment calls for it. The output is a documented schedule and a tested joiner path that the auditors can trace from HR event to course completion.
Assess effectiveness for roles that need security skills
For staff in security-relevant roles, the team adds short assessments or scenario exercises that test secure configuration, known threats and behavior during a security event, and records the results. The output is a set of effectiveness measures per role, with a note on the actions taken for people who fall short. Agree the assessment design with the security function so that the results can be explained to a regulator.
Produce reports for management review
The program owner pulls completion, assessment and exception reports from Moodle on a set cadence and presents them to the management body and the risk committee. Reports show who completed which course, when, the version studied, and the open exceptions. The output is a dated review pack and minutes that record the decisions taken. Confirm with the compliance team which fields the review pack must carry and how long the records are kept.

What auditors and supervisors ask to see, and which LMS component produces it

This table maps each evidence type a national authority or assessor is likely to ask for against the Moodle component that produces it. Use it to plan which reports, logs and exports to schedule before an inspection. The main takeaway is that completion data alone rarely satisfies the effectiveness and recurrence questions, so assessments and dated schedules must be recorded too.

Evidence type	Moodle component that produces it	What to confirm before relying on it
Training policy and curriculum for management and staff	Course pages, course descriptions and a versioned policy document stored as a resource or in a policy repository linked from the course	Whether the authority expects the policy as a signed document, a course outline or both
Enrollment lists by role for management body members and staff	Cohort or role-based enrollment, exported through the course participants report and the enrollment methods in use	How roles are mapped from HR or identity records and how the mapping is evidenced over time
Completion dates per learner	Course completion report and activity completion report, with completion dates retained in the course completion data	The retention period your national authority expects and whether exported CSV or PDF copies are accepted
Assessment results showing effectiveness	Quiz attempt reports, grade reports and the gradebook, showing scores and attempt history for each learner	The pass threshold you set and whether the authority asks for assessment of effectiveness on a defined scale
Recurrence schedule for repeated awareness activities	Scheduled course resets or re-enrollment rules, plus a documented calendar kept outside the LMS	How often the authority expects repetition and how the calendar is signed off by management
Evidence that new joiners were enrolled	Automatic enrollment rules triggered by identity or HR feeds, and logs showing enrollment timestamps against start dates	Whether onboarding enrollment must occur within a set period under your internal policy or national rules
Access and activity logs supporting completion claims	Standard logs and the event log report, which record course views, quiz submissions and completion events	Log retention settings, who can export logs and how log integrity is protected
Supplier and service provider training, where applicable	A separate course or cohort for suppliers with its own enrollments and completion records	Whether Article 21 measures require supplier training in your sector and how supplier access is scoped

What the LMS does not settle for NIS2 compliance

Does a Moodle course count as sufficient management body training under NIS2?

A course on its own does not settle this. Whether training is sufficient is a judgment the entity makes and the national competent authority may later test. Article 20(2) requires members of management bodies to follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess risk-management practices and their effect on the entity's services. The Directive sets no minimum duration or frequency. The LMS can deliver the content, record who finished it and when, and store the material you used. The content must still match your actual risks, services and governance decisions, and a board member who completes a module without being able to discuss the organization's exposure may not meet the standard. Confirm the expectations of your national transposition law and your competent authority before you set the curriculum.

How do you assess whether NIS2 cybersecurity training is effective?

Completion alone does not show effectiveness. Implementing Regulation (EU) 2024/2690 requires that employees in security-relevant roles receive regular, job-relevant training and that its effectiveness is assessed (Annex, points 8.2.1 and 8.2.3). In practice this means pairing Moodle quizzes and scenario questions with evidence of change, such as phishing simulation results, incident reporting quality, or access review outcomes. Keep the assessment design, pass thresholds, question banks and the decisions taken after weak results. DeployOpen can design and build the assessment components, but the assessment criteria are the entity's to define and approve. Ask your security lead which measures they will accept as proof that training changed behavior.

Should NIS2 training records be kept outside the LMS?

Keeping records in the LMS is workable, but it is a design decision, not a requirement of the Directive. The LMS holds completion dates, scores, enrollment history and course versions, which together serve as the awareness evidence most auditors ask for. Some organizations export records nightly to a GRC system or a document store so that evidence survives an LMS upgrade or migration. If you export, decide which fields are the system of record, how timestamps are kept consistent, and how long records are retained under your national law and internal policy. Confirm retention periods with legal counsel. Whatever the location, the records must be retrievable, complete and tied to named individuals.

How do national NIS2 transposition differences change the training requirements?

The requirements depend on the national law that applies to your entity, because NIS2 is a directive. Article 5 allows Member States to adopt or keep rules that set a higher level of cybersecurity, and transposition measures had to be published by 17 October 2024 (Article 41). Two entities operating in different countries may face different authorities, different reporting routes and different expectations about training content or evidence. Multinational groups should map each establishment to its competent authority and collect each national guidance document before building a single curriculum. A common core course can be extended with country-specific modules, with the LMS assigning each module by location and role. Your legal team must confirm which national rules apply.

Could the proposed COM(2026) 13 amendments change who must train staff?

They could change scope, but they are not law yet. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13), including a new small mid-cap category. The proposal needs approval by the European Parliament and the Council, and Commission pages updated through July 2026 still describe it as a proposal. If adopted, an entity's classification could shift, which would change which obligations apply, including training duties. Plan the LMS so that course assignment is driven by role, legal entity and classification fields rather than hard-coded lists. Track the legislative progress with your legal counsel and revisit the assignment rules when the text is final.

Does DeployOpen certify that our NIS2 training meets the law?

No. DeployOpen does not issue certificates, attestations or audit reports, and NIS2 does not create a certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines (Articles 32 to 34). DeployOpen can plan, implement and document a self-hosted Moodle deployment, build course and assessment structures, configure completion reporting and prepare the evidence your assessors will review. Judgments about sufficiency belong to your organization, its advisers and the relevant authority. Ask any implementation partner to state in the written scope exactly which deliverables are included and which decisions remain yours.

Can our own team run the NIS2 training program without a partner?

Yes, a capable internal team can run the program, provided it has the skills to operate Moodle and the time to keep it current. Work that recurs includes applying platform updates, tracking the LTS release cycle, maintaining course content as threats change and producing evidence on a schedule. Moodle 5.3 requires PHP 8.3 or later and PostgreSQL 17, MySQL 8.4 or MariaDB 11.4 or SQL Server 2019 or later, and sites must run Moodle 4.4 or later to upgrade. Those are operating obligations you would own. Decide early which parts you will run yourself, which you will buy as a fixed-scope project and which you will retain as ongoing support, and ask a partner for the written scope of each.

Where tooling alone falls short of NIS2 training duties

Moodle can host, assign, track and report training, but NIS2 training duties depend on content, policy and decisions the platform cannot make for you. The cards below mark the gaps an implementation partner and your compliance team need to close before a completion report counts as evidence.

Course content is not supplied

Moodle ships with no NIS2 courses. Your entity must source or write the material for management body members and staff, covering risk identification, cyber hygiene and threats such as phishing and social engineering. Check who approves the content, which language versions you need, and whether a vendor's course can be edited and retained under your control.

Policies and procedures still required

Completion records show that people were trained, not that the entity has a governed programme. You still need a written awareness programme, a training policy, and procedures that say who is enrolled, what is assigned, and how gaps are escalated. Auditors and competent authorities will ask for these documents alongside the LMS reports.

Management body scope and frequency

The Directive sets no minimum duration or frequency for management body training, so the entity must decide both. Define which board and executive roles are in scope, what topics each must cover, and how often training repeats. Record the decision and the rationale so the LMS assignment rules match a documented position.

Cyber hygiene controls sit outside the LMS

Article 21 requires basic cyber hygiene practices, including software updates, device configuration, network segmentation and identity and access management. An LMS can record that staff learned these topics, but it does not patch systems, segment networks or enforce access rules. Map each control to its owning team and system so training evidence is not mistaken for control evidence.

Moodle 5.1 document root and upgrades

From Moodle 5.1 the web server document root must point to the new /public directory, or the site may show directory listings or errors. Sites must be on Moodle 4.2.3 or later to upgrade to 5.1, and Moodle 5.3 requires PHP 8.3 or later and PostgreSQL 17. Plan the web server change, database versions and upgrade path before the first training cycle, and confirm which release your long-term support window covers.

Effectiveness needs human review

Staff in roles that need security skills must receive job-relevant training, and its effectiveness must be assessed. Quiz scores and completion rates are only inputs. Someone accountable must review results against incidents, phishing test outcomes and behavior, and record the conclusions and the changes made. Confirm who performs this review and how the findings feed the next training cycle.

How much work does an NIS2 training LMS take, and what do we need to do ourselves?

What drives the cost of a self-hosted NIS2 training LMS?

The main cost drivers are hosting, initial setup and theming, identity integration, course content creation, upgrades and ongoing support. Moodle is licensed under GPL-3.0, so there is no license fee for the software itself. You pay for infrastructure, for the people who build and run the platform, and for the course content your staff completes. Hosting costs recur every month, while setup and content build are largely one-time. Ask any implementation partner for a quote that separates these components, states who pays for each, and shows which items recur after go-live.

How long does it take to set up an NIS2 training LMS?

Duration depends on scope, not on a fixed template. The timeline is shaped by how many integrations are needed (identity provider, HR records, role lists), how much content must be written or adapted, and how many people must be trained before the first reporting cycle. DeployOpen agrees a fixed scope, deliverables and timeline in writing before work starts, so the duration appears in that written scope rather than in a general estimate. Ask for the schedule to show when content, integrations and testing are complete.

What must our internal team provide before an implementation starts?

Your team sets the boundaries that the platform cannot infer on its own. Expect to provide:

A written scope covering which entities, sites and business units are in the NIS2 program.
Current role lists, including management body members and staff with security-relevant roles.
A named policy owner who approves the awareness content and the completion requirements.
Access to your identity provider and HR source of truth for enrollment rules.

Without these inputs, course assignment and completion reporting will rest on assumptions that an auditor or supervisor may question.

Can our own team build and run an NIS2 training LMS without a partner?

Yes, if your team has the skills to install, configure, secure and upgrade Moodle, and the capacity to maintain it. Moodle can be self-hosted or run as managed hosting through MoodleCloud or Moodle Partners. The hard parts are usually not the installation but the ongoing work: keeping the platform on a supported release, meeting the server requirements of each version, and maintaining integrations and course content. Moodle 5.3 requires PostgreSQL 17, MySQL 8.4, MariaDB 11.4 or SQL Server 2019 or later, and sites must run Moodle 4.4 or later to upgrade. Assess these requirements honestly against your team's capacity before deciding.

How does a quote follow from the written scope?

DeployOpen does not publish a price list. Most engagements are fixed-scope, so a quote follows from the written scope: the platform components, integrations, content work, hardening, backup, documentation and support you ask for. Each item in the scope maps to a deliverable, and the quote reflects that work. If your scope changes after signing, the change should be documented and priced as a change to the agreed scope. Ask for the written scope and the quote side by side so you can match each line to a deliverable.

What does the NIS2 Directive not set for management body training?

The Directive itself sets no minimum duration or frequency for management body training. Article 20(2) requires members of management bodies to follow training that gives them enough knowledge and skills to identify risks and assess cybersecurity risk-management practices. Implementing Regulation (EU) 2024/2690 adds that awareness activities must repeat over time and cover new employees, but the exact cadence is for you to define and justify. Confirm with your national competent authority how it reads these provisions, because national transposition laws may add their own requirements.

What ongoing costs should we expect after go-live?

Recurring costs typically include hosting, security patching, Moodle upgrades on the supported release cycle, backups, monitoring, support, and updates to course content when policies or threats change. Moodle ships major releases every six months and minor point releases every two months, so plan for regular maintenance windows. Retainers for ongoing support, upgrades and continuous testing are available from DeployOpen. Ask any partner to list which recurring items are included in its support scope and which are charged separately.

Primary sources for NIS2 training requirements

Start with the legal text itself. Directive (EU) 2022/2555 (NIS2) is the source for what must happen, and its training duties sit in two places: Article 20(2) requires members of management bodies to follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess risk-management practices, and Article 21(2)(g) requires basic cyber hygiene practices and cybersecurity training. Read the Article 20 governance text on EUR-Lex and the Article 21 risk-management measures on EUR-Lex side by side, because the board training and the staff training obligations are written in different articles. The Directive sets no minimum course length or frequency, so the schedule you build will be your own decision that you must be able to defend.

Next, read the implementing rules that turn those duties into testable requirements. Commission Implementing Regulation (EU) 2024/2690 sets the technical and methodological requirements of the Article 21(2) measures, and its annex requires an awareness program that reaches employees, including management body members, repeats over time and covers new joiners. It also requires job-relevant training for staff in security roles and an assessment of whether that training worked. Note that the regulation applies to specific sectors such as cloud, data center, managed service and online platform providers, so confirm with your national competent authority or legal counsel whether it applies to your entity directly or serves as a benchmark for your sector. Pull the Implementing Regulation 2024/2690 on EUR-Lex into your evidence checklist.

Two supporting sources help translate the text into evidence. The ENISA NIS2 technical implementation guidance, published in June 2025, is non-binding but includes examples of evidence and mappings to frameworks such as ISO/IEC 27001:2022 and NIST CSF 2.0, which helps you decide what a completion report should prove. The European Commission NIS2 policy page gives the policy context and the current status of national transposition. Because the Commission has proposed amendments (COM(2026) 13) that still need Parliament and Council approval, check the current position before you fix the scope of your training program.

How DeployOpen scopes, delivers and supports NIS2 training on a self-hosted LMS

DeployOpen plans, implements, customizes, hardens, documents and supports self-hosted open-source learning platforms inside your own infrastructure. For NIS2 cybersecurity training, that means a written scope covering management body courses, staff awareness content, completion reporting and the evidence it produces, delivered on a Moodle platform that your organization controls.

How we scope

Confirm which entities and roles fall under management body training, staff awareness and job-relevant security training.
Map course topics to the cyber hygiene and threat areas your national transposition law and your risk assessment call for.
Record in the written scope who owns course content, who approves completion rules and how often each audience repeats training.

How we build

Install Moodle in your cloud account, data center or air-gapped network, with the web server pointed at the /public directory.
Configure role-based enrollment, your identity provider integration and completion rules that record dates for each learner.
Test course flows, completion reports and access controls, then document the configuration for your compliance team.

How we hand over

Deliver written runbooks covering enrollment, course updates, report export and retention of completion records.
Train your administrators on managing courses, assessments and reporting so that your team can maintain the platform.
Provide a handover record listing the configuration, plugins, versions and evidence locations agreed in the scope.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
Plan Moodle upgrades around the release and security support windows published for each version.
Confirm with your team which support tiers, response expectations and upgrade cadence apply before the scope is signed.

Open source LMS for NIS2 cybersecurity training