EU Cybersecurity Regulation # NIS2 & DORA Compliance Training NIS2 and DORA place the human factor at the centre of EU cybersecurity law. SecurityAwared helps your organisation meet the security awareness and cyber-hygiene training requirements of both frameworks with measurable, audit-ready programs. [Talk to a Compliance Expert](https://www.securityawared.com/contact) [Explore the demo](https://www.securityawared.com/demo/) Awareness programme **Evidence overview** Sample ### Training. Evidence. Confidence. A clear record of your awareness programme. **Training records** Learning & completion **Campaign history** Simulations & reporting **Management reporting** Progress & next steps NIS2 & DORA · awareness and training Interactive example · sample data ## Two Regulations, Two Deadlines **NIS2 Directive (EU) 2022/2555** National transposition due 17 October 2024 **DORA Regulation (EU) 2022/2554** Applies from 17 January 2025 NIS2 ## What is NIS2? NIS2 is EU Directive 2022/2555, the successor to the original NIS Directive. Member States were required to transpose it into national law by 17 October 2024, significantly widening the scope of European cybersecurity obligations across sectors. The directive classifies organisations as "essential" or "important" entities and holds them to strict cyber risk-management standards. Article 20 makes management bodies directly accountable for approving and overseeing cybersecurity risk-management measures, while Article 21 requires baseline cyber-hygiene practices and security awareness training for staff. ### Core obligations for the human factor - Article 20 — management bodies are accountable and must follow training - Article 21 — cyber-hygiene and regular security awareness training - Risk-management measures proportionate to the entity’s exposure - Incident reporting and supply-chain security expectations DORA ## What is DORA? DORA is EU Regulation 2022/2554 on digital operational resilience for the financial sector. As a regulation it applies directly across all Member States from 17 January 2025, with no national transposition needed. DORA requires financial entities to build a comprehensive ICT risk-management framework. A central pillar is the human element: firms must run ICT security awareness programs and digital operational resilience training for staff and, where relevant, management, so that people can recognise and respond to cyber threats. ### Core obligations for the human factor - Mandatory ICT risk-management framework - Staff awareness programs and resilience training - Testing of digital operational resilience - Oversight of ICT third-party and supplier risk ## Who Must Comply? Between them, NIS2 and DORA reach a broad slice of the European economy — and the suppliers that serve it. ### NIS2 — essential & important entities - Energy, transport, water and digital infrastructure - Healthcare, pharmaceuticals and manufacturing - Public administration and digital service providers - Postal services, waste management and food supply - Many suppliers and vendors inside these supply chains ### DORA — the financial sector - Banks, credit institutions and payment providers - Insurers, reinsurers and investment firms - Fintech, crypto-asset service providers and exchanges - Critical ICT third-party providers to financial entities - Crowdfunding platforms and asset managers If your organisation is unsure whether it qualifies as an essential or important entity, or as a critical supplier, our team can help you map your obligations. ## How SecurityAwared Helps You Comply We do not sell a certification — we help you meet the training and awareness requirements that NIS2 Article 21 and DORA place on your people, with evidence you can show an auditor. 01 ### Security Awareness Training Structured, role-based courses that operationalise the cyber-hygiene and awareness requirements of NIS2 Article 21 and DORA’s ICT security awareness programs — delivered in the languages your workforce uses. 02 ### Phishing Simulation Campaigns Realistic phishing simulations measure and reduce human risk over time, giving you concrete before-and-after metrics that demonstrate continuous improvement in staff resilience. 03 ### Management & Board Enablement Focused modules help management bodies satisfy their NIS2 Article 20 accountability to understand, approve and oversee cybersecurity risk-management measures. 04 ### Audit-Ready Reporting Completion records, scores and campaign analytics give you the documented evidence of ongoing security awareness that supervisors and auditors expect to see. 05 ### Mapped to the Requirements Every course and campaign is aligned to the human-factor obligations of NIS2 and DORA, so your program has a clear line back to the regulation it supports. 06 ### Continuous Cyber-Hygiene Scheduled, repeating training and simulations turn one-off compliance into the ongoing cyber-hygiene culture that both frameworks expect from essential and important entities. SecurityAwared provides security awareness training and phishing simulation to help you meet the human-factor training requirements of NIS2 and DORA. This page is informational and is not legal advice; consult your compliance or legal team for a full assessment of your obligations. ## Build Your NIS2 & DORA Awareness Program Talk to our team about a security awareness training and phishing simulation program mapped to your NIS2 and DORA obligations. [Talk to our team](https://www.securityawared.com/contact) --- [NIS2 & DORA Compliance Training | SecurityAwared](https://www.securityawared.com/nis2-dora-compliance)