why do I need a certificate of participation for a cybersecurity training

Evidence that cyber hygiene and training are in place

A certificate of participation serves as evidence that staff training has actually taken place, and that is precisely what both internal records and a customer's security questionnaire require. Cybersecurity is not only about technology, but also about people who know how to recognise phishing, manage passwords, and report incidents. Training is therefore one of the recurring components within the due care obligations, and a certificate of participation is the tangible result with which that training can be demonstrated — not only to a supervisory authority, but also to a client who requests substantiation.

For organisations subject to obligations, a certificate of participation is part of the evidence document to be submitted per security measurenot the measure itself ("we train personnel") but the concrete proof that it has actually been carried out, with name, date and subject. For supply chain-affected SME suppliers who are not themselves subject to the law, it is equally relevant: who has to fill in a security questionnaire from a client often receives this particular question, because a client needs to be able to demonstrate that the supply chain is also sufficiently resilient. Without a certificate of attendance, "we train our staff" remains an unsupported claim, and that is usually not sufficient.

Where this follows from the duty of care

Article 21(2) of the NIS2 Directive lists basic cyber hygiene and cybersecurity training among the ten mandatory measures as part of the duty of care, which is adopted in the Dutch Cybersecurity Act as the national transposition. ISO/IEC 27001 elaborates on this in Annex A as a control measure regarding awareness and staff training, where demonstrability — that is, a record of who received which training when — is a recurring element. The NCSC emphasises in its guidance on the duty of care that measures must not only be taken but also be demonstrable.