control
awareness training
A short, repeated programme that teaches the whole staff what to spot, what to report and what the company's own rules are. The rules ask for the training and leave the length to you. What auditors look for is the record.
- what it protects
- the people side: whether staff spot something odd and know who to tell
- who owns it
- HR for the record, head of IT for the content
- start with
- one short session for management and one for everyone, with an attendance sheet
what it is
Awareness training teaches the whole staff, and management as a group of its own, how to spot something odd, who to tell and what the company’s rules are. It is a control for people. No tool does it for you, though a tool can deliver courses and keep the record.
The rules ask for the training and leave the length, the topics and the format to you. NIS2 names management bodies directly. DORA makes the modules compulsory for all employees and senior management. The AI Act adds a duty on AI literacy for staff who use AI systems.
What a programme has to leave behind is a record. Keep who attended, when, which course, and which version of the material they saw. A phishing test is useful for you, and its results do not replace that record. Keep them as a separate set.
basis NIS2 Art. 20(2), 21(2)(g); DORA Art. 13(6). The record fields and the format are practice.
a training programme that leaves a record
- 1choose the audienceeveryone, administrators and finance, management
- 2run the sessionshort, about your own tools, rules and incidents
- 3record itname, date, course and the version shown
- 4chase the missingeach absentee followed up, with the reason noted
change the content after each incident, and repeat for new joiners
basis working practice. No legal text sets this.
an example
Picture a company of 120 people that runs an awareness course every year.
One course for everyone, bought once and replayed. The completion list lives in the supplier's portal and nobody checks who is missing. Management never sat through any of it. When an auditor asks what a person saw two years ago, nobody can say.
Management has its own session and its own record. Administrators and finance get examples from the company's own incidents. The sheet shows name, date, course and version, and someone follows up every absentee. A phishing test sits beside the record, not in place of it.
An illustration. It is not a real case.
what it has to do for each rule
| rule | where | what the text asks | what the control has to do |
|---|---|---|---|
| NIS2 | NIS2 Art. 20(2) | Members of management bodies must follow training. Similar training for employees is encouraged, on a regular basis. | Book a separate session for management and keep its own record. Offer the staff programme to everyone else. |
| NIS2 | NIS2 Art. 21(2)(g) | Basic cyber hygiene practices and cybersecurity training. | Run a programme that repeats and that new joiners enter in their first weeks. Write down what it covers. |
| IR 2024/2690 | IR 2024/2690 Annex 8.1 | Listed digital providers: an awareness programme for employees and management, scheduled over time, repeated and covering new employees. Where appropriate, it is tested for effectiveness. | Tie the content to your own policies and contact points. Decide how you will judge whether it works. |
| DORA | DORA Art. 13(6) | ICT security awareness programmes and digital operational resilience training as compulsory modules, for all employees and senior management, at a level that fits their functions. | Make attendance compulsory and set the depth by role. Include ICT third-party providers where your contracts say so. |
| GDPR | GDPR Art. 39(1)(b) | The data protection officer monitors compliance, including awareness-raising and training of staff involved in processing. | Give the DPO the attendance record and a say in what the data protection part contains. |
| AI Act | AI Act Art. 4 | Providers and deployers take measures to support AI literacy of the staff who use AI systems. Wording replaced by Regulation 2026/1744 Art. 1. | Add your own AI rules and the tools in use to the session, and record who heard them. |
basis NIS2 Art. 20(2), 21(2)(g); IR 2024/2690 Annex 8.1 as a reference; DORA Art. 13(6); GDPR Art. 39(1)(b); AI Act Art. 4 as replaced by Regulation 2026/1744 Art. 1. What the control has to do is practice.
what to look for when you choose
- Can it assign courses to a group, such as all staff, administrators or management, and show who is missing?
- Does it keep an attendance or completion record per person, with date and course, that you can export?
- Does it keep the material as delivered, with a version, so you can show what a person saw in a given year?
- Can you load your own content, such as your reporting contact and your AI rules, or only the vendor's library?
- Does it enrol new joiners and leavers from your directory without manual lists?
- Does it work for people who have no company laptop, such as shop floor or field staff?
- Can it run simulated phishing, and does it keep that result apart from the training record?
- Is it available in the languages your staff speak, and can you edit the wording?
- What does it cost per user per year once contractors and part-time staff are counted?
basis working practice. No legal text sets this.
three levels, from first step to strong
Each level adds something visible. Stop where the risk you accepted allows.
- start
Run one short session for everyone and one for management. Keep an attendance sheet with name, date, course and version.
- solid
Split content by role, enrol new joiners in their first weeks and chase every missing name with a note of the reason.
- strong
Change the content after each incident, add your own AI rules, judge whether it works and keep the phishing results as a second record.
basis working practice. No legal text sets this.
where it goes wrong
training with no record
If no list shows who attended, what was shown and when, there is nothing to hand over. Keep the record from the first session.
a phishing test taken as the training
A test result shows how people behaved on one day. It does not show that anyone was taught anything. Keep it as a second record beside the attendance list.
one course for everyone, forever
Management, administrators and finance face different risks. The same slides every year are quickly ignored. Repeat the programme and change the content as your incidents change.
management leaves it to the staff
NIS2 names management bodies directly. A programme that only covers employees leaves the people with the legal duty out.
nobody follows up on absentees
A completion rate of 70% with no follow-up shows you chose not to finish. Chase the missing names and note the reason.
basis working practice. No legal text sets this.
the proof it leaves
| what you can show | who owns it | refresh |
|---|---|---|
| attendance or completion record: name, date, course | HR | each session |
| the material as delivered, with its version | head of IT | yearly |
| management training record, kept apart from the staff record | company secretary | yearly |
| list of people who missed a session and what was done about it | HR | quarterly |
| phishing test results, kept beside the record and not in place of it | head of IT | each test |
basis practice. No text lists the fields of the record. The fields and rhythms are your choice.
check it yourself
- Directive (EU) 2022/2555 (NIS2) (EUR-Lex)
- Commission Implementing Regulation (EU) 2024/2690 (EUR-Lex)
- Regulation (EU) 2022/2554 (DORA) (EUR-Lex)
- Regulation (EU) 2016/679 (GDPR) (EUR-Lex)
- Regulation (EU) 2024/1689 (AI Act), original text (EUR-Lex)
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), amending the AI Act (EUR-Lex)
your next step
Create the attendance sheet today, with name, date, course and version, before the first session is booked.