NIS2 Is in Force: What the Training Mandate Means Now

NIS2 is in force. In Austria, the implementing law has applied since 1 October 2026. The question is no longer whether the requirements are coming, but whether your organization already meets them. One obligation is underestimated time and again: the duty to train employees, and management itself, in cybersecurity on a regular basis. This article looks at who falls under NIS2, what the directive actually says about training, and where to start.

Who NIS2 applies to

NIS2 distinguishes two groups: “essential” and “important” entities. Essential entities include sectors such as energy, transport, banking, healthcare, drinking water and digital infrastructure. Important entities cover areas like postal and courier services, waste management, chemicals, food, manufacturing and certain digital services. Both groups face largely the same obligations. The main differences lie in supervision and sanctions.

As a rule, medium-sized and large companies in these sectors are in scope: roughly speaking, from 50 employees or more than ten million euros in annual turnover. Some entities are covered regardless of size. And even organizations that fall outside the formal scope often feel NIS2 through the supply chain, because in-scope companies must assess the security of their suppliers and pass requirements on contractually.

What Articles 20 and 21 mean for training

Two parts of the directive make awareness training binding:

• Article 20 (Governance): Management bodies must approve the cybersecurity risk-management measures and oversee their implementation. They are also required to follow training themselves and are expected to offer similar training to their employees on a regular basis.
• Article 21 (Risk management): The catalog of minimum measures explicitly lists basic cyber hygiene practices and cybersecurity training, on a par with topics such as backup management, access control and supply chain security.

Awareness training is therefore part of the legally required set of measures, not a nice-to-have. A one-off briefing at onboarding clearly does not satisfy “regular”: what is meant is an ongoing program that reaches the entire workforce and whose delivery can be evidenced.

Management liability: diligence, not panic

Article 20 provides that management bodies can be held liable for infringements of the risk-management obligations. How that liability plays out in a specific case is a matter of national law and individual circumstances. This article is expressly not legal advice. For an assessment of your own situation, consult a lawyer.

What can be said with confidence: the training obligation is one of the few points where NIS2 addresses management personally. An organization that can demonstrate leadership participation and a documented program for its workforce is in a far better position than one without any evidence.

Concrete first steps

1. Clarify whether you are in scope: Check your sector and company size, and whether customers in regulated industries are passing requirements on to you.
2. Take stock: What training has taken place so far, who participated, and what is documented? Gaps tend to become visible quickly here.
3. Set up a recurring program: Combine e-learning courses with regular phishing simulations. That turns a compliance duty into a measurable security gain.
4. Involve management: Plan leadership participation in from the start. It is explicitly required.
5. Secure the evidence: Participation rates, completions and simulation results should be cleanly documented so you can answer to authorities and customers alike.

Start now instead of retrofitting

NIS2 is the law in force, and the training obligation can be met with manageable effort, provided you start in a structured way. Our NIS2 overview shows how Protectly supports organizations here, from ready-made awareness courses to participation reporting. Or see the platform for yourself and book a demo, no strings attached and tailored to your industry.