An employee reports a suspicious login to the company email system. The IT provider investigates. Management has to decide whether to restrict access to the service and activate the crisis response procedure. Each person needs different knowledge. Sending the entire organization to the same webinar does not address that difference.
NIS2 and KSC training should be built around participants’ responsibilities, not a single presentation. Management needs to understand decisions, oversight and obligations. Employees need to recognize threats, respond safely and report concerns. Technical teams need to apply procedures in the systems they operate.
This guide explains how to separate those needs, prepare a training program and keep records that show who participated, what was covered and how the organization followed up on the findings.
Legal position as of 8 October 2026. This article focuses on organizations operating in Poland and Poland’s National Cybersecurity System Act, referred to below as the KSC Act. Polish requirements and deadlines should not be assumed to apply in other EU Member States. The Polish legislation and ministry guidance linked below are in Polish.
Is your organization covered by NIS2 and the KSC Act?
Not every organization has the same obligations. Before commissioning training, assess the activities your organization actually performs, its size and any special criteria that bring it within the legislation. A registered business activity code, a particular headcount or a contract with a large customer is not enough on its own to establish the answer.
Start with Article 5 and the annexes to the KSC Act. These cover specified activities in sectors such as energy, transport, healthcare, digital services and manufacturing, as well as specified public entities. The Polish government’s overview of essential and important entities explains the classification framework. It cannot be reduced to a rule that every business with more than 50 employees is covered.
Keep supplier requirements separate from direct statutory obligations. A customer subject to the KSC Act may impose contractual requirements for safeguards, training or evidence. That does not, by itself, make the supplier an essential or important entity. This distinction follows from the separate provisions on scope and supply chain security in NIS2, including Article 21.
For public entities and organizations subject to sector-specific rules, confirm the classification and applicable obligations with your legal adviser. Use that assessment to decide which requirements the training program needs to support.
What training obligations arise under NIS2 and Polish law?
NIS2: management competence and cyber hygiene
Article 20 of NIS2 requires Member States to ensure that members of management bodies of essential and important entities undergo training. Its purpose is to support their understanding of risk and its impact on services. Article 21(2)(g) includes cyber hygiene and training among cybersecurity risk-management measures. For organizations in Poland, the national requirements are set out in the amended KSC Act.
KSC: annual management training and documented participation
Article 8e of the KSC Act requires training in every calendar year for the head of an essential or important entity and anyone entrusted with that head’s cybersecurity duties. It covers the obligations referenced in the provision, and participation must be documented. See Article 8e(1)-(3) of the KSC Act.
Identify the participants using the statutory definition of the entity’s head, known in Polish as kierownik podmiotu, rather than job titles alone. Training an IT administrator does not replace training the people covered by this obligation.
KSC: ongoing education for staff
Employee education is not something to omit once management has attended a course. In answer 3.8 of its KSC guidance, Poland’s Ministry of Digital Affairs explains that staff education should be ongoing and reflect their responsibilities, internal procedures and relevant threats. This does not establish an identical training timetable for every role.
When do the requirements have to be implemented?
The amendment implementing NIS2 entered into force on 3 April 2026. Entities that already met the criteria on that date generally have until 3 April 2027 to implement the Chapter 3 obligations, subject to specific provisions and exceptions. The Ministry of Digital Affairs explains the timetable in its guidance on obligations for essential and important entities. Do not automatically apply that date to an organization that met the criteria later.
The initial implementation deadline and the frequency of subsequent training are different questions. Your plan should account for both the first applicable deadline and the continuing training cycle.
What should management and employee training cover?
The following structure separates training by role. It is a suggested approach to adapt to your activities and risks, not a universal syllabus prescribed for every organization.
Boards and management: decisions, resources and oversight
Start with a practical question: what decisions should participants be able to make after the session? Build the agenda around risk assessment, allocation of responsibilities, oversight of the information security management system, or ISMS, funding for safeguards and decisions during an incident.
One useful exercise is reviewing a sample board report. Does it identify which services are exposed? Does it explain the consequences of an outage? Can management see which actions are overdue, who owns them and what decisions are needed? A vulnerability count alone is not a sufficient basis for deciding where to invest.
Do not let the incident scenario crowd out less visible responsibilities. Include a review of registration and updates to the KSC register, designated contacts, applicable personnel checks, documentation and relevant audit obligations. Before booking, ask the provider to map the agenda to the full set of duties referenced in Article 8e(2), not just to the course title.
This is the focus of StartCyber’s NIS2 and KSC training for boards and management. It covers responsibilities, decisions about security, incidents and suppliers, and documented participation. The scope and materials are adapted to the organization.
Employees: recognizing a threat and responding safely
Use situations employees encounter in their work: a message changing a supplier’s bank details, a request to share documents, an unexpected login approval prompt or a call from someone claiming to be IT support. Topics such as account protection, multifactor authentication, remote working and secure file sharing should lead to specific actions.
Do not expect the person reporting a suspicious event to determine its legal classification. Design the session so that employees know when to raise a concern, which channel to use and what information to provide. Leave investigation and external reporting to the roles designated in the organization’s procedures.
Phishing and cybersecurity awareness training for employees develops these skills. Combine it with a demonstration of the actual reporting process. An instruction to simply “contact IT” leaves too much unresolved.
IT, security and process owners: putting procedures into practice
Plan separate development for people who configure systems, grant access, manage suppliers or maintain business continuity. An administrator might work through the response to a suspected account compromise. Procurement staff could review a supplier’s obligations. A process owner could practice deciding when to switch to a business continuity workaround.
Do not try to fit all these tasks into one awareness session. A shared module can explain reporting and responsibilities, while specialist work needs its own scope.
A training exercise: an incident just before the weekend
Training scenario: at 3:40 p.m. on Friday, an employee receives an urgent request to change the bank details for a payment. After opening the attachment, they notice unusual behavior on their computer. The usual IT contact is unavailable. Nobody yet knows whether a security breach has occurred.
The employee group must identify the reporting channel and prepare a short account of what happened, when it happened, which device was involved and what actions they have already taken. The trainer checks whether participants can use the relevant instructions, not merely repeat the definition of an incident.
Management receives another question: who can authorize restricting system access when that decision could stop order processing? The technical team determines how to investigate and preserve relevant information. The person responsible for communications identifies who needs to be informed and how to communicate if email cannot be trusted.
Record specific findings after the exercise. Examples might include a missing backup contact, unclear decision-making authority or a procedure that cannot be accessed without a working computer. Assign an owner and deadline to each action. Before the next exercise, check whether the agreed changes have been made.
How should NIS2 and KSC training be documented?
A certificate of participation is not a certificate of organizational compliance with NIS2. It records something much narrower. In its guidance on documentation, the Ministry of Digital Affairs emphasizes that paperwork cannot replace safeguards and procedures that operate in practice.
For internal oversight, we recommend the following records. This is a suggested evidence package, not a statutory template that every organization must reproduce in the same form.
| Record | What to capture |
|---|---|
| Training program | Topics, objectives, intended audience and links to the organization’s obligations and procedures. |
| Delivery details | Date, duration, format, trainer and version of the materials used. |
| Evidence of participation | A named attendance list or reliable online participation record, with enough information to identify each participant’s role. |
| Assessment of learning | Findings from an exercise, a structured discussion or a test, depending on the method selected. |
| Follow-up actions | Gaps to address, responsible owners, deadlines and confirmation that agreed actions have been completed. |
Separate attendance from competence. An attendance record shows who took part. An exercise helps assess whether someone can perform a task. Sending an invitation or distributing a slide deck does not establish either.
Decide who maintains the records and who can access them. Use an organizational repository rather than the organizer’s personal inbox. Agree the data collected and retention period with the people responsible for records management and data protection.
How often should training take place, and how can you assess results?
Put the management training cycle into the annual calendar. For other staff, combine security onboarding with periodic refreshers and targeted updates when tools, responsibilities or procedures change.
For example, introducing a new login approval method is a good opportunity to practice responding to unexpected authentication prompts. After changing the payment process, rehearse how to verify a request to amend bank details. Do not leave these topics until the next large presentation.
Assess the program using a few practical questions. What proportion of the intended audience completed it? Who needs a catch-up session? Can participants report an event correctly? Were the actions identified during exercises completed? When using phishing simulations, do not assess the whole program solely by the click rate. Consider reporting behavior and the conditions of the exercise as well.
These are suggested management measures, not statutory pass marks. Use them to improve the process rather than publicly rank or embarrass employees.
What should you check before booking training?
Instead of starting with the number of slides, ask the provider four questions:
- Scope: how does the program address the obligations relevant to our organization and the roles of the participants?
- Practice: which decisions or actions will we rehearse, and will we use our own procedures?
- Trainer: what practical experience does the trainer have in the subjects being covered?
- Documentation: how will participation be recorded, what materials will we receive and how will identified gaps be followed up?
Agree how absences will be handled and how much customization is included. A short briefing for experienced participants may serve a different purpose from a first session for the entire management team. Compare offers with similar scope, not just the hourly price.
When training forms part of a wider security improvement program, our guide to securing a business or institution explains how to connect education with responsibilities, risk assessment, procedures and technical safeguards.
NIS2 and KSC training: frequently asked questions
Does training have to last a specified number of hours?
Article 8e of the KSC Act does not prescribe a universal minimum duration. Assess the agenda against the required scope and any additional rules relevant to your organization. Duration alone does not demonstrate that the requirements have been addressed.
Can NIS2 and KSC training be delivered online?
Article 8e does not require in-person delivery. For online training, establish participant identification, attendance evidence and completion criteria. Access to a recording is not proof of completion. Check additional organizational or procurement requirements before choosing the format.
Do all employees need the same course as management?
Do not make the program identical merely to simplify administration. Management needs preparation for oversight and its own responsibilities. Employees need knowledge suited to their work and procedures. Some content can be shared, but objectives and exercises should reflect participants’ roles.
Does completing training make an organization NIS2 compliant?
No. Training supports part of the wider obligations. It does not replace risk management, safeguards, incident handling or oversight, as the scope of Article 21 of NIS2 makes clear. A participation document does not establish organizational compliance.
How StartCyber supports businesses and institutions
StartCyber delivers cybersecurity training for businesses and institutions online and in person. We adapt the scope to the sector, participants’ roles, tools and the organization’s incident reporting process.
Before delivery, we agree the objectives and agenda. Depending on the selected program, deliverables may include participation records, participant materials, an initial responsibility map, recommendations and a follow-up action plan. The proposal specifies what is included.
Planning training for your organization? Tell us your sector or type of institution, participants’ roles, approximate group size, preferred format and timing. Explain whether your priority is preparing management for KSC obligations, employee awareness or a broader skills development program.
Request a training program and quote for your business or institution. You do not need a completed agenda to start the conversation.
This article is educational and does not replace legal advice on the obligations of a particular organization. Adapt the suggested program, exercises and documentation to applicable legislation, risk and internal requirements.
