NIS-2 Training for Management: What the New BSI Curriculum Sets Out

Since 6 December 2025, Section 38(3) of the German BSI Act (BSIG) has required the management of important and essential entities to attend training on a regular basis. What that training has to cover, the law left open. In April 2026 the BSI published guidance on the training obligation. On 28 October 2026, at it-sa, it followed up with a far more concrete document: a sample curriculum for NIS-2 management training, developed together with Bitkom, DIHK, VDMA, ZDH, ZVEI, VOICE and the German Informatics Society (GI).

The 24-page curriculum is explicitly not binding. The BSI and the associations describe it as "one possible implementation of Section 38 BSIG". Because it pins down duration, content, audience and evidence in such detail, however, it will become the yardstick against which training offerings and internal programmes are measured. This article summarises what it contains and what management should take from it.

What NIS-2 Management Training Is Meant to Achieve

The curriculum ties every unit to the three capabilities in Section 38(3) BSIG and Article 20(2) of the NIS-2 Directive: identifying and assessing risks, understanding risk management practices, and judging their impact on the services the entity provides. The goal is sound judgement, not technical training. Management should be able to ask the right questions, provide resources, assign responsibilities, consciously accept or reject residual risk and effectively oversee implementation.

The key statement sits in Module 2: operational implementation can be delegated, but responsibility and the duty to oversee cannot. Delegation is only acceptable with clear roles, reporting lines, escalation paths and controls. Decisions have to be informed, documented and risk-based; the curriculum calls this business judgement in a cyber context.

Who Has to Attend

Attendance is mandatory for every natural person who manages and represents the entity under law, articles of association or partnership agreement. The curriculum also recommends including others who make or prepare risk management decisions, such as the CISO or information security officer, CIO, CFO, COO, legal and compliance, OT and production leads, or authorised officers.

The line it draws is unambiguous: training only IT leadership, information security officers, data protection or compliance "does not replace the training of management". Anyone who has sent the security officer to a course and considered the matter closed has not met the obligation on this reading. A special rule applies only to management in the IT and telecoms sector that is already informed in a way appropriate to its role. There, the capability can also be built and documented through existing reporting lines and specialist functions.

Four Hours in Six Modules

Without exercises, the sample agenda comes to 240 minutes:

Module	Content	Duration
1	BSIG, NIS-2 and scope: services, IT/OT, group structures	30 min
2	Section 38 BSIG: duties, liability, limits of delegation	40 min
3	Cyber risks as business risks: protection goals, types of damage, residual risk	40 min
4	Section 30 BSIG as a management system: minimum measures in six clusters	75 min
5	Registration, reporting and notification under Sections 32 to 35 BSIG	35 min
6	Governance, evidence and transfer: reporting, KPIs/KRIs, resolutions	20 min

A shortened version of around 180 minutes is provided for. It only remains complete in the sense of Section 38 if a pre-read of roughly ten pages is mandatory and documented. That pre-read covers the entity's own scope, the services it provides, the organisation chart, the status of the Section 30 measures, the incident process and a risk overview. This also makes clear that generic training with no reference to the company does not meet the curriculum.

Deliberately excluded are exercises, simulations, tabletops and red or blue team formats, technical deep dives, staff awareness training and case-specific legal advice. These are to be planned separately, for example crisis team exercises as a format of their own after the initial training.

Module 4: Effectiveness Over Documents

The longest module translates the minimum measures under Section 30 BSIG into six clusters for the board level: risk analysis and ISMS, incident handling and recovery, supply chain, procurement and vulnerability management, effectiveness review, and personnel, access, cryptography and MFA. For each cluster the curriculum describes what management decides and which evidence is typical.

For the cluster on effectiveness, control, audit and metrics, management's task reads: it "demands evidence of effectiveness, not merely compliance with plans and policies". One of the guiding questions for Module 4 asks accordingly how effectiveness is verified, "not just the existence of documents". The accompanying checklist from the German Informatics Society goes one step further. As training content it lists keeping management informed through regular reports based on security assessments, and management's responsibility for promptly remediating the findings those reports contain.

From our penetration testing practice, this is where paper and security part ways. A register of measures shows what is planned. Whether MFA really protects every access path, whether patch management reaches the exposed systems or whether a supplier's remote access is segmented, only a test can show. For management, the number of findings matters less than which of them threaten critical services, who fixes them by when, and whether a retest confirms the fix. Which measures are missing in the first place is shown by a NIS-2 gap analysis.

After the Training: Evidence and Resolutions

The curriculum stresses that a certificate of attendance is not enough on its own. What matters is that management then takes a traceable part in risk management decisions. The recommended documentation package includes a training record with date, duration, provider, participants and topics covered with reference to Section 38(3), a signed list of participants, and lists of resolutions and measures.

For the management follow-up, the BSI lists decisions that should ideally be addressed within two to six weeks:

1. Confirming or correcting the NIS-2 scope, including subsidiaries, group IT and critical service providers
2. Setting up the governance structure with the reporting line of the security officer or CISO and escalation paths
3. Approving a Section 30 register of measures with priorities, owners, deadlines, budget and evidence
4. Rules for accepting residual risk and escalation thresholds
5. Approving the reporting and crisis process with its 24 and 72 hour deadlines
6. Resolving on a regular cyber risk report to management
7. Planning follow-up training and separate practical formats

Anyone who has not yet settled whether they fall under NIS-2 will already stumble at the first point.

How to Assess a Training Offering

The curriculum is explicitly also aimed at organisations that design, buy or provide training. When buying, a few questions help. Does the training cover all six modules, and does it realistically plan three to four hours? Is management itself in the room, not just a stand-in from IT? Does it work with the company's own scope, services and actual state of measures, or with slides that look the same for every client? Does it end with a list of resolutions and a record that can be presented on request? The GI checklist is the right tool for this, as it checks the curriculum's content point by point.

Conclusion

What is new about the training obligation is not the obligation but the benchmark. With the curriculum, the BSI and the business associations have put forward a concrete picture of what NIS-2 management training looks like: four hours, six modules, management itself at the table and concrete resolutions afterwards. Management should compare its existing training against it, add missing evidence and, above all, decide how it will demonstrate the effectiveness of its measures from now on. The training explains why testing is necessary. It does not replace the test.