More than 100,000 entities across the EU are expected to fall within the scope of the NIS2 Directive and the resulting national implementing legislation, including the Dutch Cybersecurity Act (Cyberbeveiligingswet, Cbw). Each member of the management body of an essential or important entity is required to complete targeted training. This training must provide them with sufficient knowledge and skills to identify cybersecurity risks, assess cybersecurity risk-management measures and evaluate the impact of both the risks and the measures on the services provided by the entity.

The mandatory content of the training for members of management bodies is laid down in Article 21 of the Dutch Cybersecurity Decree (Cyberbeveiligingsbesluit, Cbb), read in conjunction with Article 21(3)(a)–(j) and Article 24 of the Dutch Cybersecurity Act.

These provisions state that the training must cover at least the following three general risk-management topics:

The types of risks affecting network and information systems;
Risk-management processes;
A risk-assessment methodology.

In addition, the training must address the ten areas covered by the cybersecurity risk-management measures set out in the Cbw and NIS2:

Policies on risk analysis and information-system security;
Incident handling;
Business continuity, including backup management, disaster recovery and crisis management;
Supply-chain security;
Security in the acquisition, development and maintenance of network and information systems;
Policies and procedures for assessing the effectiveness of cybersecurity risk-management measures;
Basic cyber hygiene practices and cybersecurity training;
Policies and procedures on the use of cryptography and, where appropriate, encryption;
Human-resources security, access-control policies and asset management;
Where appropriate, multi-factor or continuous authentication solutions, secure voice, video and text communications, and secure emergency communication systems.

These terms closely follow the official English wording of Article 21(2) of the NIS2 Directive.

The “Cbw/NIS2 Governance for Management-Body Members” training was developed by our trainer on behalf of and in consultation with the Dutch Ministry of the Interior and Kingdom Relations. It covers all the requirements set out above. The training examines the objectives of the NIS2 Directive and the core concepts of cybersecurity risk management and the associated measures. Its purpose is to provide members of management bodies with the knowledge and practical tools they need to make well-informed decisions on cybersecurity.

This training for management-body members is therefore delivered in full accordance with Article 24 of the Dutch Cybersecurity Act and Articles 20–22 of the Dutch Cybersecurity Decree. These provisions set out the required knowledge and skills, the mandatory training content and the requirements applying to the certificate of participation.

What do I know and am I able to do after completing this training?

Risk management is at the heart of the Cbw. After completing the training, participants will have:

A high-level understanding of information security, how it supports organisational objectives and the role of the management body;
A high-level understanding of the NIS2 Directive, including its purpose, impact and the role of the management body;
An understanding of how information security is organised within Dutch central government and the role of the management body;
An understanding of risk management in relation to information management and information security, its relevance to the organisation and the role of the management body;
An understanding of the core elements of information security and why they matter, including the two-track approach, ISO/IEC 27001, the Government Information Security Baseline (BIO) and examples of relevant KPIs;
The knowledge needed to meet the training requirements set out in Article 24 of the Dutch Cybersecurity Act and Articles 20–22 of the Dutch Cybersecurity Decree.

Course outline

The definition and purpose of information security and how it supports organisational objectives;
An overview of NIS2, including its purpose and scope, incident-reporting obligations, cybersecurity risk-management requirements, demonstrating compliance, regulatory supervision, registration requirements and the role of the management body;
The organisation of information security within Dutch central government and the role of the management body, based on the Three Lines Model and the support provided by the CIO, CTO, CISO, CPO, Data Protection Officer and departmental Security Authority;
The two-track approach: a baseline supplemented by additional measures for higher-risk or more critical systems and processes;
BIO and ISO/IEC 27001: what a baseline is, its benefits and limitations, and the difference between compliance-based and risk-based approaches;
The fundamentals of risk management, covering at least the following topics:

Defining the context, including identifying the interests and critical assets that require protection;
Identifying threat actors and threats;
Identifying risks;
Selecting measures and mitigating risks;
Accepting residual risks;
The Plan-Do-Check-Act cycle;
Specific attention to suppliers and supply-chain management.

The ten specific areas covered by the cybersecurity risk-management measures required under the Cbw and NIS2.