NIS2 Security Awareness: Content for a Curriculum

A NIS2-oriented security awareness curriculum should empower employees to recognize risks in their actual workflows, take appropriate action, and report security incidents quickly. A standard annual video about suspicious links is not enough. The program needs a basic module for everyone, role-specific in-depth training, regular exercises, and a documented assessment of its effectiveness.

The curriculum must align with the company’s risk profile. A manufacturing facility, a cloud provider, and a healthcare provider all need the same fundamentals but different case studies, systems, and escalation procedures.

The Legal Framework

Article 21(2)(g) of the NIS2 Directive establishes basic cyber hygiene procedures and cybersecurity training as part of the catalog of risk management measures.

For Germany, the BSI describes basic training and awareness-raising measures for internal and external users. It specifies awareness training, regular awareness campaigns, clear security policies, secure use of the systems in place, and the continuous review and refinement of the program.

However, NIS 2 does not provide a ready-made set of slides. Companies must develop a suitable curriculum based on risks, target groups, and workflows.

Three Levels of an Effective Curriculum

1. Fundamentals for All Users

Every person with relevant access requires a common security foundation. This includes established reporting channels, secure handling of identities, information, and devices, as well as the ability to recognize typical deception attempts.

2. Role-Based Specialization

Risks arise in specific processes. Finance authorizes payments, HR processes application and employee data, Support resets accounts, and IT manages privileged access. Training should reflect these differences.

3. Exercises and Continuous Learning

Knowledge only becomes robust when applied in a work context. Short exercises, simulations, feedback, and situation-specific updates bridge the gap between course completion and actual behavior.

Key Content of the Basic Module

Phishing and Social Engineering

The training should not merely explain obvious spelling mistakes. Modern deception attempts use plausible business contexts, well-known services, QR codes, text messages, collaboration platforms, and unexpected MFA requests.

Employees should learn to:

Evaluate the sender, context, and plausibility together
Not confuse urgency with legitimacy
Treat links, QR codes, and approval requests with caution
Verify sensitive requests via a known secondary channel
Report suspicious messages through the designated channel

Phishing simulations can help employees safely practice making these decisions. They should not collect real passwords, MFA codes, or sensitive data.

Identities, Passwords, and MFA

Cybersecurity hygiene involves more than just password length. The module should explain the use of approved password managers, unique passwords, and multi-factor authentication.

It is particularly important to know how to respond to unexpected MFA push notifications, device changes, recovery requests, and purported support contacts. Employees must understand that even a technically legitimate login page can be part of a fraudulent scheme.

Reporting Channels and Initial Response

Awareness often fails not because of recognition, but because of the next step. The curriculum should provide concrete answers:

Which button, form, or phone number should be used?
What should you do after clicking?
What should you do after entering your login credentials?
What information helps the security team?
Why is reporting an incident quickly more important than assigning blame?

Reporting an incident must be easier than keeping it secret.

Handling Information

Employees need clear rules for classifying, authorizing, storing, and sharing information. This also includes cloud storage, collaboration tools, mobile devices, and the use of generative AI, if it is used within the company.

The training should align with company policies and not attempt to replace them with general security tips.

Devices, Remote Work, and Physical Security

The basic module also includes:

Do not unnecessarily delay updates and reboots
Lock devices and report loss immediately
Handle public networks and third-party charging or storage devices properly
Be aware of people looking over your shoulder, visitors, and physical access points
Separate personal and business use according to policy

Here, too, training must reflect the systems and work models actually in use.

Secure Collaboration with Service Providers

Supply chain risks often begin with everyday communication. Employees in procurement, project management, and line organizations should know how to verify new contacts, updated bank details, file shares, and urgent access requests.

Role-Based In-Depth Training

Finance and Procurement

Key topics include payment changes, invoice fraud, approval chains, new supplier accounts, and verification through known contacts. The learning objective is not “never click,” but rather “do not make any decisions with significant consequences outside the approved approval process.”

HR

HR needs examples involving job applications, payroll and bank information, identity documents, purported requests from management, and the protection of sensitive employee data.

IT and Help Desk

Key topics here include identity verification, password and MFA resets, privileged access, remote support, OAuth authorizations, and social engineering targeting support processes.

Executive Management and Executive Assistants

In addition to the separate NIS2 training for executive management, practical topics such as payment approvals, confidential documents, travel and schedule changes, and fake communication channels are relevant.

Production and Operational Departments

Training here must be concise, accessible, and closely aligned with the systems. Topics may include removable storage media, remote maintenance, unusual system alerts, shared accounts, and the escalation process for operational disruptions.

Which Formats Complement Each Other

A good program combines different formats rather than cramming everything into a single long annual course:

Basic module: common rules and reporting procedures
Microlearning: brief refresher on specific decisions
Phishing simulation: controlled practice and assessment
Tabletop exercise: Roles and decisions during an incident
Poster or intranet campaign: Reminder of specific behaviors
Role-based module: In-depth training for high-risk groups
Event-Based Update: Response to new systems, incidents, or threats

Creating your own SCORM content can be useful if a learning management system or industry-specific courses already exist. The key is ensuring that assignment, version, and completion status are traceable.

From Phishing Tests to Targeted Follow-Up Training

A simulation is particularly valuable when it tests a specific learning decision and triggers an appropriate follow-up if necessary.

Examples:

Anyone who confirms an unexpected MFA request receives a short module on MFA fatigue.
Anyone who fails to verify a payment change through the established process receives finance-specific training.
If many users cannot find the reporting channel, the solution is not just individual retraining: The process itself must be improved.

The AutoPhish Training Platform supports automatic assignments following simulations, progress tracking, custom SCORM courses, and tailored modules. This allows the curriculum to be aligned more closely with observed learning needs.

How Effectiveness Is Measured

Course completions indicate reach, but do not yet indicate a change in behavior. A balanced set of metrics may include:

Coverage of target groups
On-time completion rate
Results of short knowledge quizzes
Reporting rate during simulations
Time to first qualified report
Recurring risk topics
Progress following targeted refresher training
Qualitative feedback from employees
Improvements to processes and policies

The evaluation should not be based on a public ranking of individual employees. The goal is to improve the system and the safety culture.

Checklist for the Curriculum

Before approval, the company should be able to answer the following questions:

Are all relevant internal and external users included?
Is there a basic module and role-specific supplements?
Are internal reporting and approval processes correctly represented?
Are new employees trained early on?
Do new systems or risks trigger an update?
Are the version, assignment, and completion documented?
Are exercises conducted securely and in compliance with data protection regulations?
Is effectiveness regularly reviewed?
Are concrete improvements derived from the results?

FAQ

What NIS2 training content is mandatory?

NIS2 identifies cyber hygiene and cybersecurity training as risk management measures but does not prescribe a universal curriculum. Content must be derived from risks, roles, systems, and national implementation.

Is phishing a mandatory part of the curriculum?

Phishing and social engineering are key risks for many organizations and are also identified by the BSI as relevant threats. The specific emphasis should align with the organization’s risk profile.

Is one e-learning module per year sufficient?

One module per year can serve as a foundation. For lasting impact, onboarding, short refresher courses, role-specific content, exercises, and event-driven updates are recommended.

Should failed simulations automatically trigger training?

Yes, provided the assignment is technically appropriate and proportionate. Recurring patterns should also trigger a review of processes, communication, and technical controls.

Can in-house courses be used?

Yes. SCORM-compatible content can be integrated into suitable training platforms. Key considerations include version control, assignment, proof of completion, and regular updates.

Conclusion

A good NIS2 awareness curriculum combines fundamentals, role-specific knowledge, and exercises. It not only explains risks but also trains participants in making specific decisions and following reporting procedures. The results are used to develop targeted refresher training and make improvements to the system.

With the AutoPhish Training Platform, you can assign training courses, integrate your own content, track progress, and combine phishing simulations with appropriate follow-up.