SecurityLearn® NIS2 Expert - eLearning (Exam Included)

Course timeline

1. Introduction

   Lesson 01

   • Understand the purpose and context of the NIS2 Directive.
   • Scope and objectives: purpose, evolution, and strategic goals.
   • Key changes from NIS1 and implications.
   • Facts and fables: misconceptions vs. reality.
   • Drivers for implementation: regulatory, reputational, operational.
   • Essential vs. Important Entities; sector coverage (Annex I & II).

2. Terminology and Requirements

   Lesson 02

   • Familiarize with NIS2 terminology and key requirements.
   • Definitions: incident, CSIRT, risk management, cybersecurity measures.
   • Articles 20–23 overview: duties of care, notification, information.
   • Understanding proportionate and risk-based approaches.

3. Governance and Management Responsibility

   Lesson 03

   • Leadership accountability under Article 20.
   • Governance frameworks: roles, RACI matrix, oversight.
   • Policy management and compliance documentation.
   • Executive training and awareness obligations.
   • Coordination with legal, compliance, and risk functions.

4. Risk Management and Security Measures

   Lesson 04

   • Learn the 10 baseline security measures (Article 21).
   • Policies on risk analysis, incident handling, BCP/DR, supply chain, vulnerability handling, auditing, encryption, HR security, MFA.
   • Integration with ISO/IEC 27001 controls and TOMs.

5. Incident Handling and Notification

   Lesson 05

   • Reporting requirements and coordination with CSIRTs.
   • Incident classification and thresholds.
   • Reporting timeline: 24h early warning, 72h notification, 1-month final report.
   • EU-CyCLONe and post-incident learning.

6. Business Continuity, Crisis Management, and BCP/DR

   Lesson 06

   • Understand resilience and continuity requirements.
   • Conducting BIA and DRP planning.
   • Crisis management roles and communication plans.
   • Testing and maintaining continuity plans.
   • Alignment with ISO/IEC 22301.

7. Training and Awareness

   Lesson 07

   • Human factors and culture of cybersecurity.
   • Program design and periodicity.
   • Training topics: phishing, MFA, insider threats, cloud security.
   • Documenting and tracking training compliance.

8. National Transposition and Authorities

   Lesson 08

   • National competent authorities and CSIRTs.
   • Inspection powers and cooperation.
   • Administrative fines and penalties (up to 2% turnover).
   • Reporting and remediation obligations.
   • Examples of national implementations (Germany, Netherlands, Italy).

9. Relationships with Other Frameworks

   Lesson 09

   • Integration with related frameworks and standards:
   • CIS Controls, ISO/IEC 27001, ISO/IEC 22301, NIST CSF.
   • ENISA hygiene, GDPR, DORA, CER Directive.
   • Mapping NIS2 vs ISO 27001 Annex A controls.

10. Implementation Basics

    Lesson 10

    • Conducting a NIS2 gap assessment.
    • Developing an implementation roadmap.
    • Stakeholder engagement and communication.
    • Critical success factors and common pitfalls.
    • Continuous improvement and monitoring.