Is security awareness training mandatory for ICT service providers under NIS2?
The NIS2 Directive explicitly names awareness and training as one of the measures that Article 21 requires organisations to implement to manage cyber risks. For an essential or important entity, this is therefore not optional guidance but part of the duty of care, alongside for example access controls and incident recording. For an ICT service provider that does not itself fall under NIS2 but is assessed as a supplier, the question often recurs in a security questionnaire: do you provide training, to whom, and how often.
Important to distinguish: alongside this measure, the Directive also contains a separate provision that specifically concerns the governing body itself. That is a different obligation, with a different purpose and a different target group. Those who conflate the two often underestimate what is expected of the rest of the organisation, or conversely what is specifically required of the governing body.
What the duty of care requires of the organisation
The ten measures in Article 21 are formulated on a risk-based approach: the Directive does not prescribe how many hours of training, at what frequency or with which provider. What does matter is that employees recognise the risks that are relevant to their function. For an ICT service provider, that often concerns phishing, password practices, handling access to customer environments and recognising an incident. Supervisors examine whether the measure has demonstrably been implemented, not whether a set minimum number of training hours are documented.
This makes it one of the measures where an SME supplier can relatively quickly set up something meaningful: a short training session, an assessment, a certificate of participation. The question 'who participated and when' is precisely what a customer often wants to see in a questionnaire, and precisely what a living register can easily demonstrate.
The difference from the training obligation for the governing body
The Directive furthermore places a separate responsibility on the governing body of an essential or important entity. That provision is intended to ensure that those in governing positions themselves have sufficient insight into cyber risks to be able to approve the duty of care measures and to oversee them. This is therefore not training for the entire organisation, but an obligation that rests on the governing body itself and is separate from the general awareness measure for employees.
For an ICT service provider that is not itself subject to the obligations, this governing body provision does not apply directly. But in practice, a subject organisation sometimes also enquires further: not only whether employees are trained, but also whether management is sufficiently involved in the security policy. That then forms part of the assessment of the supplier, not a statutory obligation of that supplier.
What this means if you are affected through the supply chain
If your organisation does not itself fall under NIS2 but does supply services to an entity that does, that customer may, in the course of its duty of care, ask about your training approach. This usually happens through a questionnaire or contractual clause, not through a statutory obligation that directly binds you. The difference is more than a technicality: it determines whether you are obligated, or whether you make a choice to meet the requirement of your customer to retain the contract. read the explanation per topic shows how that distinction also recurs in other measures.
Whether your organisation is affected through the supply chain, and which of the ten measures are relevant in that case, can be determined with a few questions. see in a few questions whether and how this affects your organisation provides a first indication for this without you needing an account.
Document training as evidence
What makes a training valuable for a dossier is not just its content, but the registration: who participated, when, and with what result. A certificate of attendance per employee, linked to a status and an owner, is precisely the kind of evidence that is requested in a security questionnaire and that saves rework upon repetition. see where this information comes from explains how such a dossier is structured and how it is maintained.
For the exact wording of the directive on this point, and for the national implementation applicable to your situation, the official text is authoritative. If you are uncertain whether a specific requirement in a questionnaire goes beyond what the duty of care reasonably demands, that is a question for a legal advisor or, if there is doubt about your own status, for the competent supervisory authority.
Do you want to know if and how your organization is affected by these requirements through the supply chain? Take the free NIS2 check or browse through the answers to frequently asked questions for an initial orientation.