NexGenio
Home Academy Insights Contact

NIS2 names training as a security measure, not an extra.

Article 21(2)(g) lists cybersecurity training among the risk-management measures an essential or important entity must have in place. Certified training for the people who implement and run those measures, delivered live-online with the PECB examination included.

Article 21(2)(g) PECB certified Live-online Exam included 31 CPD credits
See the courses
The obligation

A staff duty the management body answers for

NIS2 places the training requirement in two places, and they do different work. Article 21(2)(g) requires the entity to adopt “basic cyber hygiene practices and cybersecurity training” as one of its risk-management measures. That is a duty about the people who build, run and secure the systems.

Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article. Article 20(1), Directive (EU) 2022/2555

Article 20(1) then puts approval of those measures, and oversight of their implementation, on the management body itself, with liability attached. The board does not attend the courses on this page. It is the body that has to be able to show its staff are trained to the tasks they hold.

Source: Articles 20 and 21 of Directive (EU) 2022/2555 on EUR-Lex. Your operative obligation sits in your own country's transposing law, in the Netherlands the Cyberbeveiligingswet.

The courses

Two certifications that carry the measure

One course builds the information security management system the NIS2 security measures are implemented through. The other builds the NIS2 implementation programme itself. Both are PECB certifications, delivered live-online by a PECB Platinum Trainer, with the examination and certificate included in the seat price. The prices shown are launch prices and apply to the 2026 cohorts.

Next cohort confirmed

ISO/IEC 27001 Lead Implementer

Live-online · 5 days · English
02.11. – 06.11.2026
€2,222
per seat, excl. VAT
  • Implementing and managing an information security management system
  • The ISMS the NIS2 security measures are operated through
  • Risk assessment, Annex A controls and the statement of applicability
  • Internal audit, management review and certification readiness
  • PECB examination included, 3 hours across 7 competency domains
  • One free exam retake within 12 months if unsuccessful
  • 31 CPD credits awarded on completion
Reserve a seat
Next cohort confirmed

NIS 2 Directive Lead Implementer

Live-online · 5 days · English
23.11. – 27.11.2026
€2,222
per seat, excl. VAT
  • Implementing and managing a cybersecurity programme aligned with NIS2
  • Governance, asset management and risk management
  • Cybersecurity controls, incident handling and crisis management
  • Business continuity, testing, monitoring and continual improvement
  • PECB examination included, 3 hours across 6 competency domains
  • One free exam retake within 12 months if unsuccessful
  • 31 CPD credits awarded on completion
Reserve a seat

Both certifications, one delegate

The information security management system is built first on 02.11. – 06.11.2026, then the NIS2 implementation programme runs on 23.11. – 27.11.2026, in the order the work is done. Both PECB examinations, one free retake each and 62 CPD credits, on a single invoice and a single delegate record.

€4,444per delegate for both courses, excl. VAT
Reserve the bundle

Several seats in one organisation

Article 21(2)(g) is satisfied across a function, so a team is quoted on the number of people, the course and the dates. Self-paced seats carry the same PECB certification from €699.

Request a quotation See the self-paced seat

The two sit together because the NIS2 security measures and the ISO/IEC 27001 controls cover much of the same ground. See the mapping between Article 21 and Annex A.

More than one seat

Training a team

Article 21(2)(g) is satisfied across a function. Where several people need the same training, the arrangement is quoted on what you are putting through it.

Several live-online seats

Multiple seats in a scheduled cohort, or a cohort arranged on dates that suit your team. Contact us with the number of people and the course, and you receive a quotation.

  • Same trainer, same certification
  • Scheduled or arranged dates
  • Quoted on seat count

Self-paced for a wider group

The self-paced catalogue covers the same PECB certifications and suits a larger group working to its own schedule. Volume arrangements are quoted on request.

  • Learn at individual pace
  • Exam and certificate included
  • Quoted on licence count

Board training

Article 20(2) places a separate training duty on the members of the management body. NexGenio provides a NIS2 board training with which the management body meets that obligation. Contact us to discuss it.

  • A duty on the individuals
  • Distinct from staff training
  • Scoped on a short call
Request a quotation Read about board training
What a seat includes

Delivered live, certified on completion

Questions

Frequently asked

Does NIS2 require staff cybersecurity training?
Article 21(2)(g) of Directive (EU) 2022/2555 lists “basic cyber hygiene practices and cybersecurity training” among the cybersecurity risk-management measures that essential and important entities must take. It is written as a measure the entity adopts, so it is evidenced at the level of the function.
Is this the same as the board training duty?
No, and they are satisfied separately. Article 20(2) requires members of the management body themselves to follow training. Article 21(2)(g) is the measure that covers the staff who implement and run the security programme. Article 20(1) connects them: the management body approves the Article 21 measures and oversees their implementation, so it is the body that has to be able to show the staff training is in place. The board duty has its own page, NIS2 board training.
Why offer ISO/IEC 27001 alongside the NIS2 course?
The NIS2 security measures in Article 21 are implemented and evidenced through a management system, and ISO/IEC 27001 is the standard that defines one. The two overlap across risk assessment, access control, supplier security, incident handling and business continuity. The Article 21 to Annex A mapping sets out where.
When does the next ISO/IEC 27001 live-online cohort run?
ISO/IEC 27001 Lead Implementer runs live-online from 2 to 6 November 2026, five days with a PECB Platinum Trainer, at €2,222 per seat excluding VAT with the examination included. The same certification is available immediately in self-paced format at €699 for Self-Study and €839 for eLearning, each with the examination and certificate included.
We need to train several people. How is that priced?
Several seats in one organisation are quoted, because the arrangement depends on the number of people, the format and whether you want a cohort on your own dates. Contact us with the course and the headcount and you receive a quotation.
Is the examination included in the seat price?
Yes. Each seat includes the PECB certification examination, three hours in length, one free retake within 12 months if unsuccessful, the official course materials, the certificate issued by PECB on passing, and 31 CPD credits on completion.

This page is reviewed against the directive and its national transpositions. Last reviewed 11 October 2026.

Put the training measure in place

Both November cohorts take bookings directly. For a team, arrange a short call to settle seat numbers, format and dates.

27001 seat, 2 to 6 November NIS2 seat, 23.11. – 27.11.