Today, cyberattacks, digital system outages, and supply chain disruptions can have repercussions far beyond the IT department. If critical systems are unavailable, data is compromised, or key service providers go down, the entire business can be affected within a short period of time.
This is exactly where NIS-2 comes into play. The European directive significantly expands the requirements for cybersecurity and information security and holds far more organizations accountable than previous regulations. In Germany, the relevant requirements have been in effect since December 2025.
As a result, for many companies, the question is no longer just about which technical security measures are needed. Equally important are the following questions: Who needs to understand NIS-2? What knowledge do executives and technical managers need? And how can this knowledge be used to build greater cyber resilience?
NIS-2 training provides the necessary foundation for this. After all, effective cybersecurity doesn't start with just firewalls, backups, or security software. It starts with people who understand risks, know their responsibilities, and can take the right action when it counts.
What does NIS-2 mean for businesses?
NIS-2 aims to significantly raise the overall level of cybersecurity within the European Union.
The focus is on organizations whose services are of particular importance to the economy and society. This is no longer limited exclusively to traditional critical infrastructure. The scope has been expanded to include numerous other industries and companies.
In Germany, the BSI Act distinguishes, among other things, between particularly important institutions and important institutions. Whether a company is subject to the relevant requirements depends on various factors, such as industry, company size, and the type of services offered.
Affected organizations face requirements related to risk management, security measures, incident response, reporting processes, supply chains, and management responsibility.
NIS-2 thus makes it clear: Cybersecurity is no longer an isolated IT task. It is becoming an enterprise-wide responsibility.
Why Cyber Resilience Means More Than Cybersecurity
NIS-2 is not just about preventing attacks as completely as possible.
That would be unrealistic anyway in an increasingly interconnected digital environment.
Rather, companies must be prepared for the possibility that security incidents may occur. What matters most is whether they can detect these incidents, respond appropriately, and restore business operations to normal as quickly as possible.
This is exactly where the term “cyber resilience” comes into play.
A cyber-resilient organization can identify risks early on and implement appropriate protective measures. At the same time, it has the structures in place to deal with disruptions, restore operations, and learn from incidents.
This changes the perspective.
The key question is not just:
"How do we prevent a cyberattack?"
But also:
"How can our organization remain capable of taking action if something happens?"
This understanding is one of the most important fundamentals that a NIS-2 training course should teach.
NIS-2 doesn't just affect the IT department
For a long time, many companies viewed information security primarily as a technical task.
The IT department handled systems, access rights, updates, and security solutions. Business units and management often didn't get involved until there were major investments or specific incidents.
NIS-2 significantly changes this division of roles.
Many requirements simply cannot be addressed through technical means alone. For example, a company must decide which risks are acceptable, which services are particularly critical, how responsibilities are allocated, and which measures should be prioritized.
Supplier relationships, crisis management, employee training, and decisions regarding investments in information security also extend far beyond traditional IT.
That is why different roles need at least a common basic understanding of the NIS 2 requirements.
Cyber resilience can only be effectively organized if management, IT, information security, data protection, compliance, and other relevant departments are all on the same page.
Management bears explicit responsibility
NIS-2 is particularly relevant for executives.
The German BSI Act assigns specific responsibilities to the management of particularly important and important organizations. They must implement the necessary risk management measures and monitor their implementation.
This makes information security an even more critical management responsibility.
Management cannot simply delegate cyber risks entirely to the IT department or an information security officer and then consider the matter settled.
You must have a sufficient understanding of the risks facing the organization, how these risks are assessed, and the potential impact they may have on the services provided.
That doesn't mean that CEOs have to become technical security specialists.
However, you must be able to ask the right questions and make informed decisions.
Why NIS-2 Training Is Especially Important for Senior Management
The responsibility of senior management is not merely abstract.
The BSI Act expressly requires the management of particularly important and critical organizations to participate regularly in training sessions.
The goal is to develop sufficient knowledge and skills to identify and assess risks and risk management practices in the area of information security. Similarly, managers must be able to assess the impact of such risks on their company’s services.
This means that NIS-2 continuing education takes on special significance.
The point is not to overwhelm managers with technical details. Rather, good training must help them understand how things fit together.
Why is a particular measure necessary? What consequences might a security incident have? What is management’s responsibility? What questions should senior management ask the IT and information security teams?
Only this understanding makes true control possible.
Risk Management Is Becoming a Common Language
Risk management is a central component of NIS-2.
Companies should not select security measures in isolation, but rather based on the actual risks facing their organization.
To do this, those in charge must first understand which systems, services, and information are particularly important to business operations.
The next step is to assess potential threats and impacts.
For example, what happens if a critical service is unavailable for a day? What would be the consequences of losing certain data? To what extent does the company depend on individual suppliers? And which processes must continue to function even during a security incident?
Questions like these combine technical safety with business responsibility.
NIS-2 training should therefore not merely explain individual measures. It should convey why risk-based thinking is the foundation of effective cybersecurity.
We must be prepared for security incidents before they occur
A successful cyberattack is not the right time to start figuring out who is actually responsible.
Companies therefore need established processes for handling security incidents.
Who identifies an incident? Who assesses its significance? Who is notified? What decisions need to be made? And how do statutory reporting procedures work?
NIS-2 sets out specific requirements for handling significant security incidents.
For companies, this means that reporting procedures must not be defined solely on paper. The people involved must be familiar with them and be able to apply them in an emergency.
This is precisely where the practical value of training and preparation becomes apparent.
A documented process alone does not ensure cyber resilience.
Only when those in charge know what they need to do can a plan be turned into a functioning crisis response procedure.
Business continuity is part of cyber resilience
Cybersecurity and business continuity are becoming increasingly intertwined.
When an IT system fails, the question isn't just about the cause. It's also crucial how quickly the affected service becomes available again.
That is why topics such as backup management, recovery, and crisis management are among the key components of a comprehensive security strategy.
Companies should know which processes are critical to their service delivery and what dependencies exist.
But a backup alone isn't enough.
It must also be determined whether data can actually be recovered, which systems are needed first, and how operations will be organized during a major disruption.
Cyber resilience thus combines prevention, response, and recovery.
Supply chains are becoming an integral part of a company's own security
Today, companies work with numerous external service providers, cloud providers, software vendors, and technology partners.
This creates a critical dependency.
A company can carefully secure its own systems and still be affected by a security incident at a supplier.
NIS-2 therefore explicitly takes into account risks within the supply chain as well.
For those in charge, this means not letting cybersecurity stop at their company's boundaries.
Which suppliers are particularly important? Which services depend on them? What security requirements apply? And what happens if a key supplier goes down or is compromised?
These issues aren't limited to IT.
Purchasing, contract management, risk management, and business units can also play an important role.
NIS-2 training helps shed light on these interrelationships and understand information security as a cross-organizational system.
Technical measures remain important, but they need context
Of course, NIS-2 also includes numerous requirements that are directly related to technical matters.
These include, for example, security measures for IT systems, access controls, secure communication, cryptography, vulnerability management, and authentication procedures.
However, even effective technical measures can lose their effectiveness if they are poorly integrated into the organizational structure.
For example, a company can implement robust multi-factor authentication. However, if it remains unclear which accounts are particularly critical or how exceptions should be handled, some risk will still remain.
For this reason, managers and department heads should understand technical measures at least well enough to assess their purpose and significance.
NIS-2 does not require everyone to become a security engineer.
However, it is increasingly requiring that security decisions be made deliberately.
Employees remain a critical safety factor
Many security incidents do not begin with a spectacular technical vulnerability.
Phishing, stolen login credentials, misconfigurations, or careless handling of information can also serve as the starting point for an attack.
This means that people remain a central component of information security.
NIS-2 therefore also takes training and awareness-raising measures into account.
However, security awareness should not be reduced to occasional warnings about suspicious emails.
Employees must understand the role they play within the security strategy and how they can identify and report suspicious situations.
A cyber-resilient organization is created when security is not just the responsibility of a few specialists, but is incorporated into everyday behavior.
Who should be concerned with NIS-2?
The target audience therefore extends well beyond traditional IT security roles.
NIS-2 is particularly relevant for people who make decisions regarding security, risks, or business processes. This includes executives as well as IT and information security professionals.
Governance, risk, and compliance also play an important role. Data protection, legal affairs, and auditing may be involved, as may procurement and supplier management.
Project managers must take NIS-2 into account when introducing new systems or services. Consultants need to understand the requirements when assisting companies with organizational or technological changes.
The specific depth of knowledge varies depending on the role.
For example, a managing director needs different skills than a security specialist. However, both should understand what the requirements are and how their respective responsibilities contribute to meeting them.
Integrating NIS-2 and ISO/IEC 27001 in a Meaningful Way
Companies that are already certified to ISO/IEC 27001 do not have to start from scratch with NIS-2.
Many of the fundamental concepts are familiar. These include systematic risk management, clear responsibilities, safety measures, and continuous improvement.
Nevertheless, NIS-2 and ISO/IEC 27001 are not the same thing.
ISO/IEC 27001 specifies requirements for an information security management system. NIS-2, or its national implementation, on the other hand, establishes regulatory obligations for certain organizations.
For companies, therefore, the question of which approach replaces the other is less relevant.
It makes more sense to:
How can existing structures be used to efficiently integrate new requirements?
Organizations that already have an established information security management system in place can build on it. At the same time, specific NIS 2 requirements must be reviewed and, if necessary, supplemented.
This connection prevents new security domains from emerging in parallel.
NIS-2 should not be viewed as merely a compliance project
One of the greatest risks associated with regulatory requirements is viewing them merely as a mandatory requirement.
This results in the creation of guidelines, documentation, and evidence, while the organization's actual resilience is hardly improved.
In the case of NIS-2, that would be particularly problematic.
The real goal should not be simply to be able to show that certain requirements have been addressed.
Companies should take this opportunity to truly strengthen their security organization.
Are responsibilities clearly defined? Do escalation procedures work? Are dependencies known? Can critical systems be restored? Do executives know which cyber risks truly threaten their company?
If NIS-2 helps us answer these questions more effectively, the result will be more than just compliance.
Cyber resilience is emerging.
Knowledge must be appropriate for the role in question
As with AI literacy, the same applies to NIS-2: Not everyone needs the same knowledge.
Technical specialists need to understand security measures in greater detail. Compliance and governance professionals need a clearer understanding of requirements, responsibilities, and evidence.
Managers, in turn, must be able to assess risks, set priorities, and understand decisions.
A good NIS-2 training program should therefore, above all, provide guidance.
After the training, participants must understand what NIS-2 means for their own organization, which areas of action are relevant, and what role they themselves will play in its implementation.
This is precisely what prevents two common problems: line departments waiting for management to make decisions, and executives assuming that IT will handle the issue entirely on its own.
Cyber resilience can only be achieved through collaboration.
Why a Solid Understanding of the Basics Is Important Before Implementation
When new regulatory requirements are introduced, there is often a desire to implement measures as quickly as possible.
But activity does not automatically mean progress.
Those who cannot properly assess requirements may end up investing a great deal of effort in measures that do not address the actual risks.
A solid basic understanding of NIS-2 therefore helps you assess your own situation first.
Is the organization affected? What obligations arise? What security measures are already in place? Where are the gaps? What responsibilities does management have? And which measures take priority?
Only then should the specific implementation be planned.
A foundational training course creates a shared knowledge base specifically for this purpose.
NIS-2 Foundation: Guidance Instead of Technical Overload
The NIS-2 Foundation Training at SERVIEW is designed for individuals who wish to develop a thorough understanding of the directive and its implications for organizations.
The focus is not on in-depth technical configurations.
Rather, the training course teaches how to manage cybersecurity and information security in a holistic manner. This includes the objectives and scope of NIS-2, as well as risk management, security measures, reporting requirements, and the responsibilities of senior management.
Integration into existing governance, risk, and compliance structures also plays an important role.
This makes the Foundation suitable for beginners as well as for professionals and executives who already work in the fields of information security, data protection, risk, or compliance and want to gain a solid understanding of NIS-2.
No prior knowledge is required to get started.
From Knowledge to True Cyber Resilience
Training alone does not make a company cyber-resilient.
However, it creates an important prerequisite.
After all, security measures only work in the long term if those in charge understand why they are necessary and how they work together.
NIS-2 makes it particularly clear that cybersecurity can no longer consist solely of individual technical measures.
Risk management, leadership, incident management, business continuity, supply chains, awareness, and technical security must be integrated.
That is precisely where the real value of this topic lies.
Anyone who views NIS-2 merely as a regulatory requirement will see it primarily as a burden.
Those who use these requirements as an opportunity to systematically review their own security organization can gain a real advantage: greater clarity, better preparation, and greater resilience against cyber incidents.
Conclusion: NIS-2 Makes Cybersecurity a Management Responsibility
NIS-2 is changing the way we view information security.
Technical safeguards remain essential. At the same time, risk management, responsibilities, reporting processes, supply chains, recovery, and the expertise of the people involved are becoming more closely intertwined.
This is particularly evident in the role of senior management. Cyber risks must be understood, measures must be monitored, and knowledge must be regularly updated.
NIS-2 training provides the necessary foundation for this.
It helps executives and department heads properly assess requirements, understand their own responsibilities, and view security measures not in isolation but in the context of business operations.
After all, in the long run, NIS-2 is about more than just meeting regulatory requirements.
The point is that companies must remain capable of operating even when digital security comes under pressure.
That is exactly what cyber resilience is all about.
Most Recent
To learn how generative AI is changing the tasks and skills required in professional software testing, see the previous post:
"Generative AI in Software Testing: How AI Is Changing the Work of Software Testers"
Training Tip: NIS-2 Foundation at SERVIEW
If you want to gain a thorough understanding of the NIS-2 requirements and properly assess their significance for your organization, the NIS-2 Foundation training course at SERVIEW is the perfect place to start.
During this two-day training course, you will learn about the key requirements, roles, and security measures, and discover how NIS-2 interacts with existing governance, risk, and compliance structures. The training is designed for both specialists and managers, as well as those responsible for IT, information security, data protection, compliance, management, and other relevant areas.
Learn more:
NIS-2 Training Courses at SERVIEW
