Board Cyber Security Training Guide: NIS2 and DORA

Laws and governance codes now expect directors to understand cyber risk well enough to approve and challenge it, yet most board training is still a generic annual awareness video that would not help a director question a risk appetite or lead an incident decision. NIS2 Article 20(2) requires members of management bodies of in-scope entities to follow training, DORA requires the management body to keep its ICT risk knowledge current, and the UK Cyber Governance Code of Practice asks each director to improve their own cyber literacy. None of these texts sets a curriculum. This guide turns the obligations into one: what directors need to learn, how to deliver it to a busy board, how often, what evidence to keep, and how to tell whether it worked. It is written for company secretaries, CISOs, general counsel and board chairs who own director development. It does not repeat how to report cyber risk to the board, which is covered in the Board Cyber Risk Reporting Guide.

Key takeaways

Training is a legal duty for many boards, not a courtesy. NIS2 Article 20(2) requires management body members of essential and important entities to follow training; national laws such as Germany's BSIG section 38(3) restate it as regular training.
The purpose is defined, the content is not. NIS2 frames the goal as enough knowledge and skills to identify risks and assess risk-management practices and their impact on services. Build the curriculum backwards from those decisions.
Directors need governance skills, not technical skills. The target is a director who can read a risk appetite, challenge a metric, approve a budget trade-off and make an incident call, not one who can configure a firewall.
Exercises teach more than slides. A board-level incident scenario tests decision rights, disclosure duties and communications in a way that no presentation does. The UK Code asks for the incident plan to be exercised at least annually.
Keep evidence that would satisfy a regulator. Record who attended what, when, the learning outcomes and how the board used them. Under NIS2 and DORA, the question after an incident will be whether the management body was equipped to oversee the measures it approved.

What the rules require

The obligations differ in wording and legal force. Status and dates below are as stated on the official sources, checked in November 2026; national transpositions and amendments change, so confirm the rules for your jurisdiction.

Source	Who it applies to	Training or knowledge requirement	Related duty
NIS2 Directive (EU) 2022/2555, Article 20	Management bodies of essential and important entities, through national law	Members must follow training to gain sufficient knowledge and skills to identify risks and assess cyber security risk-management practices and their impact on services; entities are encouraged to offer similar training to employees regularly	Approve the Article 21 measures, oversee implementation, and can be held liable for infringements
Germany, BSIG section 38	Management of essential and important entities	Must regularly attend training ("regelmäßig an Schulungen teilnehmen"); no fixed interval stated	Implement and monitor measures; liability to the entity under company law
DORA Regulation (EU) 2022/2554, Articles 5 and 13	Financial entities in scope	The management body "shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk" (Article 5(4)); entities must run awareness programmes and digital operational resilience training "as compulsory modules" (Article 13(6))	The management body defines, approves, oversees and is accountable for ICT risk management (Article 5(2))
UK Cyber Governance Code of Practice (DSIT and NCSC, April 2025)	Boards and directors of UK organisations; voluntary	Action C3: train to improve your own cyber literacy; action C4: confirm the organisation runs an effective training programme, using metrics	Actions E1 (director-level cyber ownership), E2 (formal reporting at least quarterly), E5 (understand regulatory obligations)
UK Corporate Governance Code 2024 (FRC)	Companies that report against it on a comply-or-explain basis	No cyber-specific training provision; the FRC notes cyber is among the material risks for many companies	Provision 29 declaration on material controls for financial years from 1 January 2026
US SEC rules (adopted 26 July 2023)	SEC registrants	No training mandate; Regulation S-K Item 106 requires disclosure of board oversight and of management's role and expertise	Form 8-K Item 1.05: material incidents, generally within four business days of the materiality determination

Three points follow. First, under NIS2 and DORA the duty sits with each member of the management body, so a briefing for the risk committee alone does not cover the full board. Second, the stated purpose, being able to assess risk-management practices and their impact on services, gives you the test for content. Third, liability provisions (NIS2 Article 20(1) and, for essential entities, Article 32(6)) make training records part of the board's own defence. See the NIS2 Management Liability Executive Briefing and the Board and Director Cyber Liability Guide.

A curriculum built from board decisions

Start from the decisions the board actually takes on cyber risk, then teach only what a director needs to take them well. The modules below map to those decisions and to the five principles of the UK Code, which also works as a neutral structure for boards outside the UK.

Module	Board decision it supports	Learning outcomes	Code principle
1. The threat to this organisation	Is our risk picture credible?	Name the main threat types for the sector (ransomware, fraud, supply chain, insider, state activity) and how they would hit our critical services	A, E
2. Critical services and crown jewels	What must we protect first?	Explain which services, data and systems matter most and who owns each	A1, A2
3. Risk appetite and tolerances	How much cyber risk will we accept?	Read and challenge an appetite statement, a tolerance and a quantified loss range	A3, E2
4. Regulatory duties and personal liability	Are we compliant, and what do I personally owe?	State the laws that apply, the board's approval and oversight duties, and incident reporting deadlines	E5, D3
5. Reading cyber metrics	Is the programme working?	Distinguish activity counts from outcome measures; ask for trend, target and tolerance	E2, B4
6. Investment and strategy	Are we funding the right things?	Challenge a cyber budget against risk reduction and strategy	B1 to B3
7. Supply chain and third parties	What do we depend on?	Understand concentration on key suppliers and cloud providers and how supplier risk is assessed	A4
8. Identity and access as the control plane	Who can act on our systems?	Understand that stolen credentials, privileged accounts and machine identities such as API keys drive many incidents, and ask how they are governed	A, E
9. Incident decisions	What do we do in the first 72 hours?	Know the board's role in an incident, decision rights, disclosure triggers and communications, including extortion decisions	D1 to D4
10. Culture and personal hygiene	Do we lead by example?	Apply phishing-resistant sign-in and safe handling of board papers; recognise that directors are targets	C1, C3

Sector content: add the specific rules and threats for the sector, for example DORA incident classification for financial entities or patient safety for healthcare. See the Healthcare Board Cyber Briefing for a sector example.
AI and agents: where the organisation is deploying AI agents, add a short module on the new risks and decisions. See Board Briefing: AI Security.
Identity angle: module 8 is often missing. Directors who understand that compromised accounts and unmanaged machine credentials are a common route into organisations ask better questions about privileged access and non-human identity. See Board Briefing: NHI Risk.

Delivery formats and when to use each

Format	Best for	Time	Limits
Self-paced e-learning (for example the NCSC Cyber Governance Training)	Baseline knowledge for every director and new joiners	The NCSC package has an introduction and five modules of about 20 minutes each	Generic; does not cover your risks or decisions
Facilitated board session with the CISO	Organisation-specific threat, appetite and metrics	45 to 90 minutes, once or twice a year	Depends on the CISO's ability to brief in business terms
Board incident exercise	Decision rights, disclosure and communications under pressure	2 to 3 hours, at least annually	Needs realistic scenarios and an honest after-action review
External expert briefing	Independent challenge; regulatory and legal updates	30 to 60 minutes	Can drift into generic threat talks
One-to-one induction	New directors and new committee chairs	60 minutes with the CISO and general counsel	Easily skipped without a formal induction plan
Site visit to the security operation	Understanding capability and constraints	Half a day	Must be framed around decisions, not a tour

The NCSC training is free, written for directors without cyber expertise, and organised by the five Code principles, with a scenario video and five multiple-choice questions per module. It is a sound baseline in any jurisdiction, but by itself it does not cover your organisation's own risks, laws or incident plan, which are what a regulator will ask about. The UK Cyber Governance Code of Practice Guide covers the Code itself.

Decision guidance: scaling the programme

Small and mid-sized entities in NIS2 scope: e-learning for all directors at appointment and annually, one facilitated session a year that covers the organisation's own risks and reporting duties, and one tabletop exercise. Use the board meeting minutes as evidence.
Large or listed organisations: add committee-specific depth (audit or risk committee), an annual external briefing, and a programme owner (often the company secretary) with a written plan approved by the chair.
Financial entities under DORA: treat the management body's knowledge as a supervised requirement under Article 5(4); align training with the digital operational resilience strategy and include the major incident reporting process. See the DORA Guide.
Groups with subsidiaries: NIS2 applies entity by entity through national law, so subsidiary boards may each carry the duty. A group programme can deliver it, but record attendance per entity.
Frequency: NIS2 and BSIG section 38 say "regular" without an interval. Annual refresher training plus training at appointment, and an update when the law, threat picture or business changes materially, is a defensible minimum; record the reasoning for whatever cycle you choose.

How to implement

Confirm the obligations: with legal counsel, list the laws and codes that apply to each entity and director, including national NIS2 transposition status. The European Commission sent reasoned opinions to 19 Member States on 7 May 2025 for incomplete transposition, so check national law, not the directive alone.
Assess current knowledge: a short, confidential self-assessment per director against the module outcomes, plus the chair's view of past board discussions on cyber.
Agree the plan: the chair or nominations committee approves the curriculum, formats, frequency and evidence standard. Fold it into the board's existing development and evaluation process.
Deliver the baseline: e-learning for all directors within a set window, then a facilitated session on the organisation's risk appetite, critical services and reporting.
Run an exercise: a board-level scenario using a credible incident for the sector, with legal, communications and the executive team. See the Tabletop Exercise Guide.
Review and adjust: after each cycle, check the measures below and change content. If a module does not change how the board asks questions, rewrite it.
Induct new directors: make cyber part of the formal induction, completed before they sit on a committee that oversees risk.

Evidence to keep

Evidence	Why it matters	Owner
Training plan approved by the chair	Shows the board defined what "sufficient knowledge and skills" means for it	Company secretary
Attendance and completion per director and per entity	Shows each member, not just a committee, was trained	Company secretary
Content and learning outcomes per session	Shows training matched the stated purpose and the organisation's risks	CISO
Exercise reports and actions	Shows decisions were tested and lessons used	CISO and general counsel
Board minutes recording cyber challenge and decisions	Shows the training translated into oversight	Company secretary

Measuring whether training works

Coverage: share of directors trained at appointment and within the annual cycle (target 100%, per entity).
Quality of challenge: number of board or committee questions or decisions on cyber recorded in minutes per quarter, and whether they concern appetite, tolerances and investment rather than only status updates.
Exercise outcomes: time for the board to reach key decisions in an exercise, and the share of exercise actions closed by the next exercise.
Self-assessed confidence: director ratings against the module outcomes before and after each cycle.
Use of metrics: whether the board has agreed tolerances for its quarterly cyber metrics (UK Code action E2), and how often a breach of tolerance led to a decision.

Common failure patterns

Awareness training reused for the board: the staff phishing module is assigned to directors and logged as compliant, but it teaches nothing about approving measures or overseeing risk.
Risk committee only: the risk or audit committee is trained and the rest of the board is not, while NIS2 and DORA place the duty on every management body member.
Technical depth with no decisions: sessions explain malware families and tools and never ask the board to decide anything.
No exercise: the board first meets its incident role during a real incident, when disclosure clocks are already running.
No records: training happened, but there is no attendance, content or outcome record to show a regulator or court.
Static content: the same deck runs every year despite new laws, new suppliers or a move into AI agents.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.RR-01; GV.RR-02; GV.OV-01; PR.AT-02	Leadership accountability; roles and authorities; review of strategy outcomes; training for people in specialised roles
NIST SP 800-53 Rev 5	AT-3 Role-based Training; PM-13 Security and Privacy Workforce	Role-specific training for senior leaders
ISO/IEC 27001:2022	Clause 5.1 Leadership and commitment; clause 7.2 Competence; Annex A 6.3 Information security awareness, education and training	Top management commitment and competence evidence
UK Cyber Governance Code	Actions C3, C4, D2, E1, E2, E5	Director literacy, exercising and oversight

Practitioner checklist

List the training and knowledge obligations for each entity and director, including national NIS2 law and DORA where relevant.
Agree a written board training plan with the chair, covering curriculum, formats, frequency and evidence.
Cover all ten modules over a cycle, weighted to the organisation's sector and critical services.
Give every new director cyber induction before they join a risk-related committee.
Run at least one board-level incident exercise a year and track its actions to closure.
Record attendance, content and outcomes per director and per entity.
Update content when laws, the threat picture or the business change materially.
Review the measures after each cycle and report them to the nominations or governance committee.

Standards and references

Related NHI Mgmt Group resources: NIS2 Directive Guide · Board Cyber Report Template · Risk Appetite and Tolerance for Cyber Guide · Cyber Crisis Board Update Template. This guide summarises NIS2, DORA, the UK codes and the SEC rules as they relate to board training and is not legal advice.

Board Cyber Security Training Guide: What Directors Must Learn Under NIS2 and Governance Codes