{"id":4111,"date":"2026-08-18T09:00:00","date_gmt":"2026-08-18T07:00:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/?p=4111"},"modified":"2026-09-27T19:59:29","modified_gmt":"2026-09-27T17:59:29","slug":"who-needs-nis2-training-besides-the-board","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/who-needs-nis2-training-besides-the-board\/","title":{"rendered":"Who else needs NIS2 training besides the management board?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for boards and HR teams \u2022 published August 18, 2026 \u2022 updated September 12, 2026 \u2022 8 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Short answer<\/h2>\n\n\n\n

Apart from the head of the entity, the Polish Act on the National Cybersecurity System (KSC) names only one more role. It is the person entrusted with the head\u2019s duties in the area of cybersecurity. For everyone else the obligation is built differently. The Act sets out neither positions nor frequency, but it does describe a result \u2014 staff must be aware of their cybersecurity duties and know the entity\u2019s internal rules (Article 8d(4)). Baseline awareness of cybersecurity duties and internal rules covers the entity\u2019s staff. Depth and frequency are differentiated by role, access and risk, while persons performing the tasks under Articles 8 and 11 are identified separately.<\/p>\n<\/div>\n\n\n\n

Why the question comes up at all<\/h2>\n\n\n\n

Two training obligations in the same Act are built in completely different ways. The first has an addressee, a cycle and a proof. The head of an essential or important entity completes training once each calendar year, and participation in it is documented (Article 8e). The second obligation has none of those three elements. Cybersecurity education for the entity\u2019s staff is one of the elements of the information security management system (Article 8(1)(2)(i)), alongside basic cyber hygiene practices (point (j)). Neither a deadline nor a list of positions stands next to them.<\/p>\n\n\n\n

The second source of doubt lies in the difference between the directive and the Act. Directive (EU) 2022\/2555 imposes a training obligation on the members of management bodies, while towards employees it merely \u201cencourages\u201d entities to offer similar training (Article 20(2)). The Polish legislator went further and wrote staff education into the catalogue of measures an entity has to implement. Anyone who reads the directive alone concludes that training beyond the board is voluntary. That conclusion does not follow from the national Act.<\/p>\n\n\n\n

The third reason is organisational. The question about the circle of people usually comes up once training for the head of the entity is already in the calendar. That is when it turns out there is no ready list for the rest of the organisation.<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

The organisational chart will not replace a list of the roles to be trained, because duties under the Act are distributed differently than positions.<\/p>\n\n<\/div>\n\n\n\n

What to establish before deciding<\/h2>\n\n\n\n

Who besides the head of the entity is named in the Act<\/h3>\n\n\n\n

Article 8e(1) names two roles. They are the head of an essential or important entity and the person entrusted with the head\u2019s duties in the area of cybersecurity. Both are subject to the same annual cycle and the same scope set out in paragraph 2. Both must have documented participation in training.<\/p>\n\n\n\n

The second role is often overlooked, because in many organisations it exists in fact rather than formally. Someone runs the subject day to day and prepares materials for the board, but the entrustment has never been recorded. Entrustment requires that person\u2019s consent and does not relieve the head of the entity of responsibility (Article 8c(3)). The practical conclusion is simple. If the entrustment exists, both sides are trained. If it does not, the first thing to settle is whether it should.<\/p>\n\n\n\n

The scope of training for these two roles is set out in What should NIS2 training for the board cover?<\/a>. It is the scope of the head of the entity\u2019s responsibility, not a programme for specialists.<\/p>\n\n\n\n

Who performs the tasks under Articles 8 and 11<\/h3>\n\n\n\n

This is the most useful criterion for selecting groups, because the Act uses it for an entirely different purpose. Before a person is admitted to tasks under Article 8 or Article 11, the organisation must obtain from them a certificate from the National Criminal Register confirming no conviction for offences against the protection of information (Article 8f(1)). Meeting that obligation requires a list of named individuals.<\/p>\n\n\n\n

That same list is the natural starting point for a training plan. It covers the people who perform the tasks of the information security management system and those involved in handling and reporting incidents. In a medium-sized organisation this is usually a dozen or so people from several different departments, not a single team.<\/p>\n\n\n\n

Two things are worth checking at this point. Whether the list covers the people who actually perform the activities, not only the formal owners of areas. And whether it covers deputies as well, because incident duties run regardless of holidays and staff turnover.<\/p>\n\n\n\n

The people designated for contact with the national cybersecurity system<\/h3>\n\n\n\n

An essential or important entity designates at least two people responsible for maintaining contact with the entities of the national cybersecurity system (Article 9(1)(1)). One person is enough only for micro and small enterprises and for an important entity that is a public entity (Article 9(2) and (3)). Once entered in the register, the entity begins using the ICT system through which it submits its reports (Article 9(1)(4)).<\/p>\n\n\n\n

The Act does not provide a separate training obligation for these people. The task itself, however, determines the scope of preparation. It is about operating the reporting system and about the deadlines counted from detection of a significant incident. This is a practical assessment, not the content of a provision. It is an assessment that is easy to defend, though, because a contact person without that knowledge will not perform the task they were designated for.<\/p>\n\n\n\n

Which roles follow from the catalogue of measures itself<\/h3>\n\n\n\n

The Act lists the elements of the information security management system in Article 8(1)(2). Each of them has an owner in the organisation, and a substantial part of them sits outside the IT department. The table below assigns the elements to roles and indicates what the preparation of those people covers. It is a practical assessment based on the typical structure of a medium-sized and large organisation, not a catalogue that follows from the provision.<\/p>\n\n\n\n

Element of the system (Article 8(1)(2))<\/th>Who usually decides<\/th>What the preparation covers<\/th><\/tr><\/thead>
Human resources security (point (d))<\/td>HR department and line managers<\/td>Hiring, change of role and departure of an employee; the criminal record check before admission to tasks under Article 8f<\/td><\/tr>
Security and continuity of the ICT supply chain (point (e))<\/td>Procurement and contract owners<\/td>Supplier assessment criteria under Article 8(2) and security clauses in contracts<\/td><\/tr>
Security in the acquisition, development and maintenance of the system (point (b))<\/td>Development and maintenance teams, project leads<\/td>Security requirements in the project and testing of the system before go-live<\/td><\/tr>
Asset management and access control policies (points (m) and (n))<\/td>Access administrators, managers approving requests<\/td>Least privilege, access reviews, revoking rights after a change of role<\/td><\/tr>
Business continuity and recovery plans (point (f))<\/td>Process owners<\/td>The role of the process in providing the service, the conditions for invoking the plan, taking part in tests<\/td><\/tr>
Staff education and cyber hygiene (points (i) and (j))<\/td>All staff who use the system<\/td>Recognising events, the internal reporting path, the rules in force<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The table shows why a list of groups built from the organisational chart is usually incomplete. The first three rows concern departments that are not the first to come up in a conversation about cybersecurity, yet they are responsible for decisions that are hard to reverse after the fact.<\/p>\n\n\n\n

Where the boundary of \u201call staff\u201d runs<\/h3>\n\n\n\n

The information security management system is implemented in the information system used in processes that affect the provision of the service (Article 8(1)). That narrows the scope of the management system itself. The head\u2019s duty under Article 8d(4) is framed more broadly and speaks of the entity\u2019s staff.<\/p>\n\n\n\n

The narrowing works only where the organisation can point to the boundary of the system. Where support processes use the same infrastructure and the same accounts, that boundary effectively does not exist. Covering all staff is then a simpler solution than proving who falls outside the system.<\/p>\n\n\n\n

It is worth noting separately that the Act speaks of the entity\u2019s \u201cstaff\u201d, not of employees. People working on a basis other than an employment contract use the same systems and make the same mistakes. The dividing criterion is the scope of tasks and access, not the type of contract.<\/p>\n\n\n\n

An important entity that is a public entity has a different point of reference<\/h3>\n\n\n\n

An important entity that is a public entity does not apply Article 8(1); it applies the requirements of Annex 4 to the Act (Article 8(3)). The same provision covers some universities to the extent that they carry out public tasks. On the subject that interests us here, the annex is more specific than the general provisions.<\/p>\n\n\n\n

Part I of the annex lists training for people involved in the processing of information as a measure that minimises the occurrence of incidents (point 17). It also sets out the subject scope. These are the types of cyber threats, basic cyber hygiene practices, responding to an incident, and awareness of the consequences of breaching information security rules. A separate point requires cyber hygiene practices to be applied by employees who use information systems, including by the head of the entity (point 14). The whole system is reviewed at least once a year (Part III of the annex).<\/p>\n\n\n\n

For this group of entities the answer is therefore closest to being ready-made. The circle is marked out by involvement in the processing of information, and the subject scope is written out in the annex.<\/p>\n\n\n\n

What to do about the provider\u2019s staff<\/h3>\n\n\n\n

An entity performs its tasks through its own structures responsible for cybersecurity or under a contract with a managed cybersecurity services provider (Article 14). The choice of model does not change the addressee of the obligations towards its own staff. The entity is responsible for the awareness of its own people.<\/p>\n\n\n\n

What remains to be settled is the interface between the two sides. Someone on the entity\u2019s side receives information from the provider, assesses it and triggers the decision to report. That person needs preparation regardless of the provider\u2019s competence, because the addressee of the reporting obligation remains the essential or important entity.<\/p>\n\n\n\n

When the list has to be ready<\/h3>\n\n\n\n

Entities that met the qualification criteria on April 3, 2026 have twelve months to meet the obligations set out in the chapter on essential and important entities, that is until April 3, 2027 (Article 33(1) of the amending act of January 23, 2026). An entity that meets the criteria later has twelve months from that moment (Article 16 of the KSC Act). Staff education belongs to the same chapter as the other elements of the system.<\/p>\n\n\n\n

The list of groups, however, comes into being earlier and almost as a by-product. It is the by-product of two other pieces of work. The first is establishing the scope of the information security management system, the second is identifying the people who perform the tasks under Articles 8 and 11. An organisation that is still establishing the scope of its obligations and its state of readiness<\/a> will not build a credible list of groups before that is settled.<\/p>\n\n\n\n

Most common mistakes<\/h2>\n\n\n\n