NIS2 training for directors and supervisors
Prepare your organisation for NIS2
In today’s digital world, cybersecurity is no longer an option but a necessity. NIS2 imposes stricter cybersecurity requirements and applies to sectors that were not previously regulated in this area.
In the Netherlands, NIS2 is implemented through the Cybersecurity Act (Cbw), which entered into force on 15 August 2026. This means that organizations must comply with its requirements from that date onwards. Directors are given a direct legal responsibility to ensure that cyber risks are identified and addressed, and that the organization complies with the NIS2 requirements.
To make informed decisions and effectively lead their organizations in the field of cybersecurity, directors and supervisory board members must have sufficient knowledge of the NIS2 Directive and the fundamental principles of cybersecurity. This NIS2 training provides the knowledge and skills needed to meet these challenges.
Content of the learning program
Online modules
Duration: 1 hour
You will get access to our learning platform and complete the following online modules at your own pace:
- Digital legislation and regulatory landscape
- Introduction to the NIS2 Directive
- Cybersecurity Act: scoping, requirements, supervision
- Role and liability of directors
These modules cover topics that we will explore further during the classroom session. We expect the modules to be completed before the classroom session so you can participate optimally.
Classroom session
Duration: 4 hours
We will focus on practical applications. Under the guidance of our cybersecurity experts, you will translate theory into practice. Our experts will dive deeper into the following topics with you:
- Application of the NIS2 Directive
- Risk analysis (BIA, threat actors, attack methods)
- Appropriate and proportionate measures
- Integration into governance and risk management
- Third Party Risk Management
- Role of directors and supervisory board members
- (Anti-)patterns of good cybersecurity
About this course
- After the training
- For whom?
- Trainers
After the training
you understand the essence of NIS2 and its impact on your organisation;
you understand how to perform a risk analysis and select appropriate measures;
you know how to integrate risk management into existing governance;
you learn how to manage third-party risks;
you understand the main principles of organizational and managerial liability.
For whom?
This training is specifically designed for directors and supervisors of organisations, but also available to anyone with affinity with the subject.
The training is at an HBO level.
Trainers
Our trainers are experienced professionals in the field of cybersecurity and risk management. They have extensive knowledge of the NIS2 and CER directives and their application in various sectors.
Program
| Time | Subject |
| 09:00 - 09:10 | Opening |
| 09:10 - 09:30 | NIS2 and Cybersecurity Act |
| 09:30 - 10:00 | Risk Management (Part 1) |
| 10:00 - 10:10 | Break |
| 10:10 - 11:00 | Risk Management (Part 2) |
| 11:00 - 12:00 | Cybersecurity Measures |
| 12:00 - 12:10 | Break |
| 12:10 - 12:30 | Third Party Risk Management |
| 12:30 - 12:45 | Cybersecurity: pitfalls, do’s and don’ts |
| 12:45 - 13:00 | Closing |
*This program is subject to change.
PE-Portfolio accountants (AA and RA)
You can include this training course as a learning activity in your PE portfolio. After the training course, you will receive a certificate of participation (number of hours of training included).
PE points register controllers (RC)
At the end of the training course you will receive a certificate of participation from us with the number of hours of training followed. You can register this yourself on the VRC website.
Note: NIS2 requires, in accordance with Article 20 (included in Article 26 of the Cyberbeveiligingswet), that directors and supervisors must undergo training. The Netherlands still needs to determine the specific requirements that this prescribed training must meet. Therefore, the underlying training cannot yet be considered as proof of compliance with the requirement of Article 26.
Contact us
