NIS2 Management Training under § 38 BSIG (with Template)

Management must attend NIS2 training itself; the IT manager cannot attend on its behalf. § 38(3) BSIG requires the management of every essential and important entity to attend training regularly, so that it can recognise and assess risks and judge their impact on the company's services.

This article explains who has to attend, how often and how long, what the BSI says about content and format, and how to document attendance. At the end you will find a 90-minute agenda for a first session. The overview of all NIS2 duties is in our NIS2 guide for SMBs.

Tasks can be delegated; responsibility remains

Management must implement and monitor the measures under § 38(1) BSIG. It can assign tasks to specialists, but retains ultimate responsibility (BT-Drs. 21/1501, p. 154). Managers who culpably breach these duties are liable to the company under the corporate law rules of its legal form (§ 38(2)). Its own training is the one duty it cannot assign to anyone.

Who has to attend

The management, meaning the people who run and represent the company by law, its articles or its partnership agreement (§ 2 no. 13 BSIG): the managing directors of a GmbH, the executive board of an AG. In a company with three managing directors, all three attend. The information security officer can prepare and deliver the training, but cannot attend in management's place. The BSI also recommends training the people who prepare management's decisions on risk management.

The duty generally applies to both essential and important entities; sector-specific exemptions under § 28(5) and (6) BSIG must be checked. Whether your company is one of them is covered in the NIS2 scope check.

How often and how long

The law says "regularly". According to the explanatory memorandum to the bill (BT-Drs. 21/1501), training counts as regular if it is offered at least every three years. The BSI guidance adds that the BSIG makes no concrete requirements beyond the term "regularly" and recommends intervals that match the company's risk; a three-year interval will rarely be enough.

Our recommendation for SMBs: a full session at the start, then a short annual refresher, and an extra session after a significant incident or a major change in the company.

The law sets no duration either. The explanatory memorandum assumes an average of four hours. According to the BSI FAQ, this is an assumption, not a recommendation: in most cases four hours will not be enough, and the training can be split into several sessions.

What the training covers

The BSI guidance structures the content along the three competence areas of § 38(3) BSIG:

A training session that only presents general statistics on cybercrime misses the point. What counts is the link to your own company: your services, your systems, your suppliers.

Internal or external

Both are permitted. The BSI guidance names external training providers as well as internal specialist functions, and gives a quarterly format with the information security officer as an example. At the same time, the BSI warns that purely internal training can lead to structural knowledge gaps and recommends bringing in external expertise. A practical middle way: the information security officer delivers the training with company-specific content, and an external perspective is added at regular intervals.

An exam is not required.

How to document attendance

The documentation stays inside the company and must be presented on request. The BSI points out that it proves regular attendance, not that sufficient knowledge has been acquired. That is why it is worth recording the content as well as the attendance. Our recommendation for the record:

• Date and duration
• Participants (all members of management) and the trainer
• Agenda and the three competence areas covered
• Training materials used
• Decisions or follow-up tasks from the session
• Confirmation of attendance by each participant
• Date of the next planned training

Template: a first session in 90 minutes

This is our suggestion for an SMB: a first session that applies the three competence areas to your company. It is one building block, not the whole training; plan further sessions so that the total clearly matches the BSI's expectations above. Bring the risk register, measures status and incident procedure.

1. NIS2 and the BSIG in 10 minutes. Why the company is in scope, the core duties, management's role and liability under § 38.
2. Threat landscape for our company (20 minutes). Typical attacks in the sector, realistic scenarios such as ransomware, a compromised supplier or a phishing attack on management.
3. Our measures under § 30 (20 minutes). Status of the ten areas, known gaps, owners and deadlines. Background: the ten NIS2 measures.
4. Impact on our services (15 minutes). What happens if the main system fails for three days? Which customers are affected, what do contracts say?
5. Reporting duties (15 minutes). What counts as significant, the deadlines of 24 hours, 72 hours and one month, who decides and who reports. Details in NIS2 incident reporting.
6. Decisions and next steps (10 minutes). Budget, priorities, date of the next session. Record each decision with an owner and a due date.

Preparing training with Valiido

Valiido includes two NIS2 training templates, one for management and one for employees, which you adapt to your company and store with the attendance record. The template supports preparation; management remains responsible for attending and acquiring the required knowledge. See Valiido for NIS2.

Frequently Asked Questions

Do employees need NIS2 training too?

Yes, but under a different rule: § 30(2) no. 7 BSIG requires basic cyber hygiene and security training for staff. A phishing-awareness session of that kind does not replace management training, because it does not cover assessing risk management practices and their impact on services.

How can we check whether the session was useful without an exam?

As a practical check, ask each participant to explain a major company risk, assess a proposed measure and describe the impact on a service. Record unresolved questions and assign follow-up work. This is our recommendation, not a mandatory test.