Cybersecurity for Boards (Non-Technical)

No — the training is deliberately designed without technical jargon, for people responsible for strategic oversight, not technical execution. We focus on decisions, control questions, and legal accountability, not on system configuration or attack details.

The national NIS2 implementation law requires the management body to approve and oversee cybersecurity risk management measures and to undergo regular training on the topic. Failing to exercise this oversight can result in personal liability for board members, separate from administrative penalties imposed on the company itself. In the training we cover the exact scope of this accountability and how to document that it has been met.

We teach the board to ask specific control questions: when was the plan last tested (not just updated), who has a clearly assigned decision-making role in the first hours of an incident, and what lessons were learned from the last exercise or actual event. Vague answers to these questions are a red flag that requires no technical knowledge to spot.

Our other NIS2 trainings (for boards and IT staff together, general organizational preparation) combine a board perspective with technical implementation elements or involve a broader team. This training is designed exclusively for the decision-making level — no implementation or technical modules — focused on what the board needs to know and decide, not on operational implementation.

The key decisions in the first hours are: activating the crisis management plan with clearly assigned roles, deciding whether to bring in external forensics experts and legal counsel, establishing a single external communication channel (avoiding conflicting messages), and assessing regulatory notification obligations within statutory deadlines. In the training we practice this decision-making process using a realistic scenario.