Security awareness training in software development is not a separate chapter in the regulation, but follows from the duty of care: the obligation to take appropriate technical and organisational measures against risks to network and information systems. Employee awareness is one of the measures that fall under this obligation, because a large part of incidents begin with human error: a phishing email that is opened, a password that is shared, a misconfigured access that nobody notices.
In addition, the directive contains a second, separate obligation that is not about employees but about the manager themselves: they must also train, and must oversee the establishment of cybersecurity within the organisation. This is a different obligation from the training requirement for staff, with a different purpose and a different owner. For a software company that falls under the duty of care, or that faces NIS2 requirements through a client, the distinction between these two layers is precisely where much confusion arises.
What the duty of care requires of the organisation
The duty of care does not prescribe a fixed training programme with a minimum number of hours or a mandatory provider. What the directive does require is that an organisation can demonstrate that it pays attention to security awareness as part of its risk management. In practice, this means: employees who work with code, customer data or production environments must know what social engineering is, how to recognise a suspicious request, and what to do if they are in doubt.
At a software company, the emphasis is often on a few specific risks that do not apply to every SME: access to source code, secrets in configuration files, and the temptation to secure test environments less rigorously than production. An awareness programme that only warns against phishing emails, but says nothing about sharing an API key in a chat message, misses precisely the risk that most often goes wrong in the development pipeline. For those who want to document this systematically, you will find in the overview of topics by sector how other measures from the duty of care connect to this, such as access control and incident registration.
The separate obligation for the manager
In addition to the training obligation for staff, the directive imposes its own responsibility on the manager: they must have sufficient knowledge to be able to assess the measures taken, and must be able to estimate the risks associated with the organisation. This is not a supplement to staff training but an independent obligation, directed at the person who is ultimately responsible.
That distinction is relevant because it is often overlooked: a company arranges an e-learning for all employees and thinks that satisfies the management obligation as well. Or the director of a software company assumes that their own technical background is sufficient, without anything being documented. Both situations reveal a gap between what actually happens and what is demonstrably organised. For the precise interpretation of this obligation, and for what is specifically laid down in the national transposition, the official text of the directive is the appropriate starting point; we keep track in the knowledge bank of which publications we have seen and when.
What that means for a software company in practice
A software company that falls under the duty of care itself, or that receives a security questionnaire from a client that does, typically faces two types of questions at once: whether there is an awareness program for employees, and whether management itself has completed or organized training activities. If you can only demonstrate the first, you are leaving unanswered on paper an obligation that the questionnaire is clearly asking about.
To determine whether, and in what role, this is relevant for your organization, it helps to first map out the sector, size and position in the supply chain. That is exactly what the free NIS2 check starts with: in a few questions it becomes clear whether an organization is itself obligated, is only affected through a customer, or neither.
Document: evidence and owner
A training obligation that exists only in people's heads is not demonstrable during an inspection or questionnaire. What does work is to document, for each obligation, a status, evidence and an owner: when which group of employees completed which training, and was there a separate moment when the executive was informed about the measures taken and the organization's risks. Both belong in a file, not in two separate emails.
Frequent questions about what exactly falls under the training obligation, and how it relates to other measures from the duty of care, are worked out in the frequently asked questions. There you will also read how secria.eu maintains sources and when a page was last reviewed, which can be found via the explanation of how the information is built up.
Do you first want to know whether this topic is relevant for your organization, or only reaches you through a client? Do the free NIS2 check or browse through the topics; both can be consulted without an account and provide an immediate next step.