Security Awareness: Annual Plan for Training and Awareness

For essential and important entities, training is mandatory: management bodies must attend cybersecurity training designed specifically for them, and entities must offer similar training to their employees on a regular basis (§ 31 para. 2 NISG 2026, implementing Art. 20(2) of the NIS 2 Directive). Failing to provide for this is an administrative offense (§ 45 para. 1 nos. 1 and 2 NISG 2026); for public administration bodies, § 46 applies instead. For all other companies, the BSI and NIST describe what a good program looks like.

The topics, formats and annual rhythm in this template are TOMORIS recommendations. For entities subject to NIS2, the legal requirements are the content of § 31 NISG 2026 and Annex no. 8 of the Implementing Regulation cited above; they do not prescribe a specific frequency in months.

NIST divides participants into three overlapping groups: all users, holders of privileged accounts and persons with significant cybersecurity or privacy responsibilities (SP 800-50 Rev. 1, Section 2.5). The BSI recommends an audience analysis and a program tailored to it (standard requirement ORP.3.A4).

Phishing exercises are learning opportunities: NIST recommends first determining the baseline click rate per group and stresses that such exercises should not be punitive and that no one should be singled out for their response (Section 2.7.2). Clear simulations with the works council and data protection in advance.

The topics are a TOMORIS proposal and cover the content listed in Annex point 8.1.2(c) of the Implementing Regulation: cyber threats, existing measures, points of contact and cyber hygiene practices. Adapt the order and topics to your risks, incidents and tools, and enter dates and responsible persons.

October is European Cybersecurity Month, an annual EU campaign supported by ENISA together with the European Commission. Your own activities during this month combine well with public materials.

The management bodies of essential and important entities must ensure and oversee compliance with the risk management measures (§ 31 para. 1 NISG 2026). Training under § 31 para. 2 should enable them to do so. The BSI also requires that top management be sufficiently sensitized and that its support be obtained before a program starts (ORP.3.A1). Content, TOMORIS recommendation:

• Management obligations: ensure and oversee (§ 31 para. 1), attend training personally (§ 31 para. 2).
• An overview of the minimum content of the risk management measures under § 32 para. 4 lit. a to j NISG 2026, from risk analysis to multi-factor authentication.
• Reporting obligations for significant incidents: early warning within 24 hours, notification within 72 hours, final report no later than one month afterward (§ 34 para. 2 NISG 2026).
• Self-declaration and evidence of measures to the cybersecurity authority (§ 33 NISG 2026).
• Penalty ranges: for essential entities up to €10 million or 2% of worldwide annual turnover, for important entities up to €7 million or 1.4%, whichever is higher (§ 45 paras. 2 and 3 NISG 2026); for public administration bodies, a declaratory administrative decision instead of a fine (§ 46).
• The current threat landscape and the risks of your own company (Implementing Regulation point 8.1.3).
• Your own role in an emergency: decisions, availability, communication.
• Leading by example: managers implement security requirements and remind their employees to comply (ORP.3.A1).

Participation figures alone are not enough: NIST requires measuring, beyond mere compliance, the impact on skills, attitudes and behavior (Section 2.4.1). The BSI recommends measuring learning success quantitatively and qualitatively for each audience and incorporating the results into the offering (ORP.3.A8).

• Participation documented per person: date, topic, format, duration, confirmation.
• Materials of each training archived with version date, so it is traceable what was taught.
• New employees instructed before first access, and this documented (TOMORIS recommendation, cf. NIST 3.1.2.2; the program must reach new employees, Implementing Regulation point 8.1.2(a)).
• Effectiveness measured, e.g. quiz with pass mark, practical test, click rate in phishing exercises (NIST 2.7.2 and 3.2, ORP.3.A8).
• Results discussed with HR and data protection (ORP.3.A8).
• Program updated at planned intervals (Implementing Regulation points 8.1.3, 8.2.5; ORP.3.A4), and additionally after incidents (NIST 2.5.1).
• For entities subject to NIS2: evidence of management body training readily available.

• Only one mandatory session per year. NIST describes awareness as an ongoing activity throughout the year (Section 2.7.1).
• Management is missing. According to the BSI, a program should not even start without its support (ORP.3.A1); management bodies subject to NIS2 must attend themselves.
• Everyone gets the same thing. Administrators and security roles need additional, role-based training (NIST 2.5.2, 2.5.3; Implementing Regulation point 8.2).
• Phishing exercises turn into public shaming. NIST expressly advises a non-punitive approach that does not single anyone out (Section 2.7.2).
• Only the participation rate is measured, not the impact on behavior (NIST 2.4.1, ORP.3.A8).
• New employees and external parties are forgotten (Implementing Regulation point 8.1.2, ORP.3.A3).