NIS2 training for management: obligation, French transposition

NIS2 training for management is an obligation of Directive (EU) 2022/2555, relevant to US companies operating in the EU. Its article 20 requires Member States to demand cybersecurity training for members of the management bodies of essential and important entities. The directive also asks for similar training for employees to be encouraged. In France, the transposition law had not yet been definitively adopted at the date of this article.

Here is what the European text says, where French transposition stands, and how to organize training that serves decision-making rather than the certificate.

What article 20 of the NIS2 directive says

Article 20 deals with governance. Its first paragraph asks management bodies to approve risk management measures, oversee their implementation and be held accountable for infringements. Executives therefore cannot delegate cybersecurity without following it.

Paragraph 2 draws the consequence for training. Members of management bodies must follow training. Entities must be encouraged to offer similar training regularly to their employees. The aim is to acquire enough knowledge to identify risks. It is also to assess risk management practices and their impact on the services provided by the entity.

The obligation is firm for executives, and encouraged for employees. This is an important difference from DORA, which requires modules for all staff. Our article on DORA training compares the two texts.

Staff training: article 21

Article 21(2) lists the minimum risk management measures. Point (g) covers basic cyber hygiene practices and cybersecurity training. Staff awareness is therefore part of the foundation, even if article 20 only makes it encouraged.

In practical terms, an entity that does not train its teams will find it hard to show that its measures are “appropriate and proportionate”.

Who is affected by NIS2?

The directive distinguishes essential entities and important entities. They fall under several sectors: energy, transport, health, banks and financial market infrastructures, among others. According to the French Senate, French transposition would raise the number of regulated sectors from 6 to 18.

Banks and financial infrastructures also fall under DORA, which applies as a priority to ICT risk in the financial sector. An entity must therefore check which text applies to it, and not run two programs where one is enough.

Local governments come within the scope envisaged by the French bill. For them, the training of elected officials and senior management becomes a subject in its own right. Our article on awareness training in local governments and hospitals covers it.

Where does French transposition stand?

The directive had to be transposed before October 17, 2024. The French “résilience” bill was presented to the Council of Ministers on October 15, 2024. Its full title is: resilience of critical infrastructure and strengthening of cybersecurity. It transposes NIS2, the directive on the resilience of critical entities and the part of DORA that concerns the financial sector.

The Senate adopted the text in March 2025. The National Assembly's special committee voted it in September 2025. Examination in public session had not been completed at the time of writing, according to the specialist press.

In early July 2026, the European Commission decided to refer France and other States to the Court of Justice of the European Union for failure to transpose. The MonEspaceNIS2 platform of the French cybersecurity agency ANSSI specifies that NIS2 will come into force in France once the law, decrees and orders have been published. Not all requirements will apply on the same day.

According to the Senate, the text would concern about 15,000 essential and important entities, as well as nearly 1,500 local governments.

What does the bill provide on training?

In its initial version, the bill provided for steering of information system security. This steering included cybersecurity training for members of management bodies. The Senate considered that this wording transposed article 20 too little and extended training to people exposed to cyber risks.

The text may still change until its final adoption. Before building a plan, check the version in force on Légifrance and on the ANSSI website.

Why not wait? Because the gap between the adoption of the law and its application leaves little time, and the directive's expectations are already known.

A four-step training plan for management

1. Identify the people concerned. Members of the board or management board, executive committee, and the assistants who screen calls and requests.
2. Set decision objectives. What must an executive be able to decide on the day of an incident, and what must they refuse on the day of a fraudulent call?
3. Alternate presentation and practice. A short input on the legal framework, then a role-play on a crisis or fraud scenario.
4. Document and review. A record per person, and an annual review of the content.

Common mistakes

• Delegating training to the CISO alone. Article 20 places responsibility on the management body itself.
• Waiting for the law before acting. The directive's expectations have been public since December 2022.
• Training without assessing. Presence in the room says nothing about what was understood.
• Forgetting the executive's circle. Executive assistants receive the calls that attackers target first.

Training executives: what works

An executive does not need to understand encryption. They need to know how to ask the right questions, decide between security and continuity, and not give in when an attack goes through them.

Three useful contents

• Risk in business language: what a service interruption costs, what must be notified, and to whom.
• Crisis decisions: pay or not, cut or maintain a service, inform customers.
• Attacks that target executives: fake orders, fake suppliers, impersonation by phone.

The last point is often neglected. Executives and the people around them are prime targets of fake order fraud. Our article on CEO fraud describes the mechanism.

Why role-play suits executive committees

Executives have little time and little patience for generic modules. They retain a lived situation better: a call, a decision to take within minutes, a financial stake.

Imagine a finance director who receives a call from a person claiming to be authorized by the chair for a confidential operation. They ask for an urgent transfer and insist on discretion. The right answers are simple sentences:

• “I’m noting your request and I’ll call the chair back on his usual number.”
• “No transfer is executed outside dual approval.”
• “Confidentiality does not rule out the procedure.”

Face Up lets a trainer create this role-play from their real cases. The executive talks with a persona played by an AI. They then receive a debrief: strengths, points to improve, quotes of their own words. They can play again to hold their position.

Proving management training

The directive requires training, and the regulator will want to see it. Keep the date, the content, the list of participants and an assessment. The debriefs of practice sessions show what the executive can do, not just that they were present. We detail these records in the article on proof of training in front of the auditor.

Frequently asked questions

Is executive training already mandatory in France?

The directive imposes it on Member States, but the obligation will only apply to French entities once the transposition law has been adopted and promulgated. Preparing remains useful right now.

Should employees be trained too?

The directive asks for it to be encouraged, and article 21 places cyber hygiene and training among the minimum measures. The French bill, in its Senate version, extends training to exposed people.

How long should the training be?

The text gives no precise duration or frequency. It asks for training sufficient to identify risks and assess the entity's practices.

How does this relate to vishing awareness?

Executives and their teams are targeted by calls that imitate the hierarchy or a supplier. Our guide on security awareness training and vishing offers a method to train for it.

To prepare for NIS2 without waiting for the law, schedule a practice session with your executive committee and its assistants. Our overview of mandatory training helps place it within all your obligations. To see a role-play on an executive decision, book a demo.