NIS2 and KSC Act training
The NIS2 directive and the national cybersecurity system act cover essential and important entities in designated sectors of the economy, along with part of their supply chains. They call for risk management, incident handling and — the part most often overlooked — competence on the management side, not only in the IT department.
One course will therefore not serve a whole organisation. Below are eight programmes, grouped by who they are meant to train.
Not sure which programme fits?
Tell us what your organisation does and who you want to train. We will reply with which of the programmes below make sense in your situation and in what order, together with a quote for a specific number of participants.
Request a quote
Who these courses are for
Each track addresses a different role in the organisation. The programmes complement rather than repeat one another — the board needs something different from the team that keeps the infrastructure running.
All employees
Baseline threat awareness for the whole team — the usual entry point when an organisation is only starting to get its house in order.
Board and senior management
Management accountability, risk governance and the decisions the directive expects from leadership rather than from the IT department.
The team implementing compliance
Turning requirements into procedures, roles and documentation — for the people running the implementation.
Technical teams
The technical layer: controls, monitoring and incident handling on the infrastructure side.
Critical infrastructure
The specifics of energy, water and transport, where an outage has consequences beyond the organisation itself.
Certification track
The broadest programme in the cluster, for people who will lead an end-to-end implementation and certify their competence.
NIS2 training for the board
Article 20(1) of the NIS2 directive requires Member States to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities and oversee their implementation. Article 20(2) requires Member States to ensure that the members of those management bodies are required to follow training, so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.
In Poland, the directive has been transposed into national law through an amendment to the act on the national cybersecurity system. Under its Article 8e, the head of an essential or important entity, and the person entrusted with the head's cybersecurity duties, completes training once every calendar year, and participation is documented. The training covers the entity's statutory obligations, including the information security management system and incident handling. Whether a particular organisation is an essential or important entity has to be assessed case by case.
Board-level programmes in our catalogue
- Training for the head of an essential or important entity (Article 8e of the Polish National Cybersecurity System Act)
- NIS2/KSC for executives: legal liability, risk management and cyber security strategy
- NIS2 — Directive and the KSC Act: compliance for management and IT
- Cybersecurity for Boards (Non-Technical)
A closed course for the whole board
Each of these programmes can be ordered as a closed course for the entire board and supervisory board, with scope and format tailored to the management body — remotely or on site, on dates agreed with you. The course can be scheduled as a fixed annual edition, with the scope agreed for each year. Every participant receives a certificate of completion, which lets the organisation document board members' attendance at successive editions.
Group quotes are prepared individually — they depend on the number of participants, the chosen programme and the format. Describe the composition of your board in the form above and we will reply with a proposed programme and a quote.
Funding
EITT is listed in the Development Services Database with the subsidy-eligible marking, which is a condition for settling training costs from public funds. We describe the instruments, their conditions and who to apply to separately: subsidised training and the Development Services Database.
Questions and answers
Who does the NIS2 directive apply to?
The directive covers essential and important entities operating in designated sectors of the economy, among them energy, transport, banking, healthcare, water supply, digital infrastructure and public administration. Its scope also reaches part of those entities supply chains. Whether a particular organisation falls under the rules depends on its sector, the scale of its operations and its role in the supply chain — an assessment worth making before choosing a course.
Is training enough to meet the requirements?
No. Training is one element alongside risk analysis, procedures, technical controls and incident handling. The directive does, however, place clear emphasis on the competence of management, because it is management that approves and supervises risk-management measures. That is why separate programmes in our catalogue address senior management, the implementation team and technical teams.
Which course should we start with?
It depends who needs training. When an organisation is only starting out, the usual beginning is threat awareness for the whole team together with a programme for the board, because that is where decisions on budget and scope are made. The implementation team and technical teams join at the next stage. If you are unsure what fits your situation, describe it in the form and we will tell you what makes sense, and in what order.
Can the training be subsidised?
Yes. EITT is listed in the Development Services Database with the subsidy-eligible marking, which is a condition for settling training costs from public funds. We describe the instruments and their conditions separately on our subsidised training page.
Can we order NIS2 training for the whole board?
Yes. We run the senior-management programmes as closed courses for the board of a single organisation, with scope and format tailored to the management body, and also on a recurring basis. Group quotes are prepared individually, based on the number of participants, the programme and the format — just describe the composition of your board in the form on this page.
In what format do you run these courses?
We run them as closed courses for the team of a single organisation, either remotely or on site. Scope and dates are agreed individually, because a programme for the board looks different from one for a technical team, and the duration depends on the level you choose.