NIS2 Board & Management Training
This training provides a complete overview of the NIS2 Directive and its obligations, aimed specifically at directors and managers.
NIS2 Board & Management Training: demonstrably in control in a session
The Cybersecurity Act makes cybersecurity a management duty, which includes a statutory training obligation and personal liability for the management board. In our NIS2 Board & Management Training, we fully brief your directors and management in one day: from obligations and sanctions to a practical approach to risk management.
✓“The NIS2 deadlines are approaching, and we do not yet comply with the management board's obligation.â€
✓“What does personal liability mean concretely for me as a director?â€
✓“Our IT professionals are asking for decisions. We want to make those decisions with informed knowledge.â€
Find out why 500+ Companies trust Nestor Security for IT security and compliance
Why this training
The Cybersecurity Act makes cybersecurity a matter for senior management
On April 15, 2026, the House of Representatives adopted the Cyber Security Act, the Dutch implementation of the NIS2 Directive. On July 7, 2026, the Senate also approved it, and the law will enter into force on August 15, 2026. It explicitly places the ultimate responsibility for cybersecurity with the management board. NIS2 is therefore no longer a guideline, but an obligation with teeth.
âš–
Personal liability
In cases of gross negligence, not only the organization, but also the director themselves can be held liable. Ignorance does not serve as an excuse.
🎓
Statutory training obligation
Executive directors of essential and important entities must be demonstrably trained within two years of entry into force and keep that knowledge up to date.
â—†
Approve and supervise
The management board must approve security measures itself and oversee their implementation. This requires substantive understanding, not a rubber stamp.
âš
Fines and supervision
Regulators can impose fines of up to €10 million or 2% of global annual revenue, and, in extreme cases, temporarily suspend directors.
18
sectors under the Cybersecurity Act
± 8,000
organizations under direct supervision
50.000+
businesses affected through the supply chain
2 years
deadline for the training obligation
What you get out of it
After the training, your board will know what it is saying yes to
No technical lecture, but a governance training: focused on the decisions you need to make, the questions you need to ask your organization, and the evidence you must be able to present.
✓
You know the law and what it means for you
You know what requirements the NIS2 Directive and the Cyber Security Act set and what the consequences are for your own organization.
✓
You know what the board is responsible for
The responsibilities of the board of directors in the field of cybersecurity are clear and you know how to assign them.
✓
You know the risks of non-compliance
Sanctions, fines, and liabilities for non-compliance were discussed so that you know the risks you face and how to prevent them.
✓
You have a practical approach to risk management
You recognize, analyze, and manage risks and know which response measures align with the statutory duty of care.
📜
Certificate in accordance with the Cyber Security Decree
After completion, each participant will receive a certificate of participation detailing which topics were covered, exactly as prescribed by the Cybersecurity Decree. This allows you to demonstrate the training you have completed to the supervisory authority.
Available in Dutch or English.
The programs
Two programs, one goal: a board in control
Does your board already have some familiarity with cybersecurity? Then the compact morning program will suffice. If you want to be fully prepared without any prior knowledge, the day program is the better choice. Are you in doubt? We are happy to think along with you.
NIS2 Board & Management Training: half-day
Fully up to speed in a single morning. For participants who know the basics and want to dive deeper into obligations, liability, and risk management.
For whom: board members, executives, and managers with some cybersecurity experienceDuration: half day (09:00 – 12:30)Maximum 8 participantsIncludes certificate of participation
09:00 – 09:15
Opening, introduction and setup of the training
09:15 – 09:45
What is NIS2?
Purpose of the Directive and the Cybersecurity ActCore principles of information securityDuty of care and duty of notificationOversight and Enforcement
09:45 – 10:00
Coffee Break
10:00 - 11:00
The NIS2 obligations at a glance
Policy and risk managementIncident proceduresBusiness continuitySupply chain securitySecurity of network and information systemsCyber hygiene and trainingCryptographyPersonnel managementLogical and physical access policiesAsset managementNotices and advice from industry associationsEvaluation of control measures
11:00 - 12:00
Risk management in practice
Identify and analyze risksMapping the consequences of risksSelect and implement control measuresEvaluate control measures
12:00 - 12:30
Questions, in-depth discussion and conclusion
We offer both programs in-house, at your location or ours, and tailor them in advance to your industry and current issues.
Next steps and deadlines
From bill to oversight: this is the timeline
The main milestones surrounding the Cyber Security Act at a glance and what they mean for your management board.
📅
April 15, 2026Completed
House of Representatives passes the bill
The House of Representatives adopted the bill with a broad majority.
📅
July 7, 2026Completed
Senate passes the bill
The Senate also approved. The law will enter into force on August 15, 2026. From that moment on, the duty of care, reporting obligation, and registration obligation will apply immediately, without a transitional period.
📅
Immediately upon entry into force
Registration in the entity register
Your organization registers via Mijn.NCSC.nl. Changes must then be communicated within two weeks. Voluntary registration is already possible now.
📅
August 15, 2028
Deadline training obligation for directors
No later than two years after entry into force, executive directors must be demonstrably trained and subsequently keep that knowledge up to date.
âš¡
Do not wait for the formal deadline. In the event of an incident or an inspection, your executive board must already be able to show that it knows the risks and is consciously in control. Regulators expect demonstrable preparation, even before deadlines expire.
Scope
Does your organization fall under the Cyber Security Act?
The law applies to considerably more organizations than its predecessor. Whether it applies to you depends on your sector, your size, and your role in the supply chain.
Active in one of the 18 sectors
The law applies to essential and important sectors, such as energy, transport, healthcare, digital infrastructure, ICT service provision, the manufacturing industry, chemicals, food, postal services, and waste management.
50+ employees or €10 million+
Within those sectors, the law applies to organizations with at least 50 employees and/or an annual turnover and balance sheet total of more than €10 million.
Sometimes regardless of the scale
Some organizations always fall under the law, for example, providers of public communications networks, trust services, and DNS service providers. An organization can also be designated because it is critical to society or the economy.
Indirectly, through the supply chain
Do you supply to organizations subject to the law? If so, through their chain responsibility, you will almost certainly be subject to security requirements. This is estimated to affect tens of thousands of Dutch companies.
Quick check
Answer three questions
A first indication, not legal advice. If in doubt, we will review it for you free of charge.
Is your organization active in one of the 18 essential or important sectors?
Do you have 50 or more employees, or an annual turnover and balance sheet total above € 10 million?
Do you supply services or products to organizations that (likely) fall under the law?
Why Nestor Security
A training of people who implement it themselves
More than 500 organizations in the Netherlands rely on Nestor Security for IT security and compliance. Our trainers bring that practical experience directly into the boardroom.
ðŸ§
Trainers from practice
No hired speakers, but consultants who guide NIS2 and ISO 27001 projects every day. Every question gets a practical answer.
ðŸ¢
In-house and customized
At your location or ours, with cases from your own sector. This way, the conversation is about your risks, not an average company.
👥
Small groups
Maximum of 8 (half day) or 15 (full day) participants, so that every driver gets a turn and no question remains unanswered.
🔗
Beyond the training
Do you want to follow through after that? We support risk analyses, ISO 27001 implementation, and the further fulfillment of the duty of care.
Plan your NIS2 Board Training in
Meet Nestor Security
Your questions answered
FAQs
Which program fits our organization?
We offer two variants. The half-day program (09:00 – 12:30, maximum 8 participants) is intended for directors, board members, and managers who already have some experience with cybersecurity. The full-day program (09:00 – 17:00, maximum 15 participants) is for participants without experience in implementing security and offers extra room for practical examples, deeper exploration, and discussion. Are you in doubt? Please contact us, and we will be happy to advise you without obligation.
Does our organization actually fall under the law?
The Cybersecurity Act applies to organizations in 18 essential and important sectors that have at least 50 employees and/or an annual turnover and balance sheet total of more than €10 million. Some organizations fall under the law regardless of their size, and suppliers also encounter requirements through the supply chain responsibility of their clients. Not sure? Take the quick check on this page or have us evaluate it free of charge.
Can the training take place at our own location?
Certainly. We provide both programs in-company: at your location or at our office. In advance, we tailor the content to your sector and current issues, so that the examples and discussions directly concern your own organization.
Is the NIS2 Board & Management Training legally required?
Yes, essentially so. The Cybersecurity Act contains a training obligation for executive management of essential and important entities. Within two years of the law entering into force, they must demonstrably possess the knowledge and skills to assess cyber risks and control measures, and subsequently keep that knowledge up to date. Our training is designed to fulfill that exact requirement, including the corresponding certificate.
When does the Cybersecurity Act (Cbw) actually enter into force?
The House of Representatives passed the bill on April 15, 2026, and the Senate approved it on July 7, 2026. The law will take effect on August 15, 2026. Important to note: there is no transition period. As soon as the law enters into force, the duty of care, reporting obligation, and registration obligation will apply immediately.