Which security awareness training meets NIS2 and ISO 27001 requirements?

As of October 20, 2026. Legal texts and provider information checked on October 20, 2026.

Key Takeaways

• NIS2 requires training at two levels: Article 21(2)(g) lists "basic cyber hygiene practices and cybersecurity training" among the risk-management measures, and Article 20(2) requires members of management bodies to follow training themselves.
• Neither NIS2 nor ISO/IEC 27001 sets a fixed interval. Germany's BSI recommends training when employees join and a yearly update after that.
• Auditors and authorities look for evidence of who completed which training and when. The BSI calls documentation a necessary condition for meeting the German training duty.
• Specialist awareness platforms lead on phishing simulations, language coverage, and content depth. Compliance platforms with built-in training keep the evidence in the same system as the ISMS.
• Kertos delivers the training, the platform, and certified experts from one source. Kertos does not currently offer phishing simulations or a dedicated course for management bodies.

The right security awareness training depends on what you need it for: proving an obligation under NIS2, ISO 27001, or TISAX, measurably changing how your workforce behaves, or both. A second question matters just as much: who runs the program and shows the auditor the evidence. The market offers four models: specialist awareness platforms with phishing simulation (such as G DATA, Hornetsecurity, KnowBe4, Perseus, or SoSafe), training providers with e-learning or classroom courses (such as the TÜV NORD and TÜV SÜD academies or mITSM), compliance platforms with built-in training (such as DataGuard, Kertos, or Vanta), and free material from public bodies such as Germany's BSI. Kertos combines the training with the ISMS that holds the evidence and with certified experts who set up and run the program.

What training do NIS2 and ISO 27001 require?

The requirements differ in who must be trained and what counts as evidence. None of the sources below prescribes a format such as classroom or e-learning. Germany appears as one example of how a member state has transposed NIS2.

The directive makes training mandatory only for management bodies. For other employees, Article 20(2) asks member states to encourage similar training on a regular basis. Staff training becomes an obligation through Article 21(2)(g) as transposed into national law, which in Germany is Section 30 BSIG.

Which security awareness training providers are there?

Providers fall into four models. The names are examples of each model, not a recommendation for a specific case.

What providers state on their own websites, checked on October 20, 2026 (prices are for the German market):

Specialist platforms are ahead of compliance platforms on phishing simulations, language coverage, and content depth. You can combine the two. The completion records then sit in the awareness provider's system rather than next to your other ISMS evidence. For how compliance platforms differ beyond training, see our NIS2 software comparison.

How do you recognize training that holds up in an audit?

• Completion per person: the record shows name, date, and course, not just a participation rate.
• New joiners: the training is assigned when someone starts, as the BSI recommends for onboarding.
• Repetition: a set interval, such as yearly, plus training in response to events, for example after an incident or a new policy. TISAX expects both.
• Link to your policies: ISO/IEC 27001 requires employees to know your information security policy, not just general rules.
• Target groups: administrators, production, and field staff need different content than office roles.
• Language: the training is available in the languages your employees understand.
• Management kept separate: training for management bodies is a separate obligation with its own records.

An ISO 27001 audit rarely needs a prepared export. Companies usually show the auditor the evidence directly in the systems that hold it. For choosing a consultant or platform for certification, see our ISO 27001 consultant comparison.

Which awareness training fits a mid-sized company?

Employees without a desk. In production, logistics, and field service, many employees have no computer of their own and no work email address. Short formats, access on shared devices, or an in-person session reach this group better than a long e-learning course. A phishing simulation only reaches people with a mailbox.

Several languages. Check which languages a provider states for its courses and compare that with your workforce. The range runs from one language to more than 35.

No in-house security team. In the Kertos NIS2 Readiness Study 2026, 84% of the 51 German companies surveyed, with 50 to 1,000 employees, had neither an internal nor an external CISO. Someone still has to plan campaigns, review results, and answer the auditor, and a purchased course does not do that. A virtual or external CISO can take on the role.

Management as its own target group. Article 20(2) requires members of management bodies to follow training themselves. In Germany, the BSI notes that this does not have to mean multi-hour sessions, but the training must cover risks, risk-management measures, and their impact on the company's services. For what NIS2 means for mid-sized companies beyond training, see NIS2 software for mid-sized companies.

When is Kertos the right choice, and when is it not?

Kertos delivers the training, the platform, and certified experts from one source.

• Training: the "Information Security Basics" course with four video modules (information security fundamentals; phishing and social engineering; travel, clean desk, and screen rules; policies and incidents) plus data protection training modules, in German and English and included in the platform.
• Platform: the ISMS for NIS2, ISO 27001, TISAX, and GDPR. Kertos assigns employee training automatically, including to new joiners, and sends reminders for open courses.
• Evidence: completion status per person, kept in the ISMS as evidence next to policies, risks, and controls.
• Experts: certified in-house experts, up to an external CISO or information security officer mandate. The external information security officer plans the training and checks completion.
• Location and hosting: Munich, developed and hosted in Europe.

Kertos fits companies that need to prove awareness training as part of NIS2, ISO 27001, or TISAX and don't want to buy training, ISMS software, and advice from three providers. Kertos customers have a 100% audit pass rate and spend about 80% less effort on manual compliance work. On G2, they rate Kertos 4.8 out of 5 stars across 65 reviews.

Kertos is not the right choice if you need phishing simulations and behavior metrics, if your workforce needs training in languages other than German and English, or if you want to add your own training content. Kertos does not currently offer a dedicated course for management bodies under Article 20(2). In those cases, a specialist awareness platform or a training provider is the better choice for the training itself.

Frequently asked questions

How often do employees need awareness training?

Neither NIS2 nor ISO/IEC 27001 sets a fixed interval; ISO 27001 requires updates when policies change. Germany's BSI recommends training at onboarding and a yearly update after that. TISAX expects training at regular intervals and in response to events. Set the interval in your training concept; an audit checks whether you meet your own rule.

Does management have to take NIS2 training itself?

Yes. Article 20(2) NIS2 requires members of the management bodies of essential and important entities to follow training, so that they can identify risks and assess risk-management practices and their impact on the entity's services. In Germany, Section 38(3) BSIG requires management to attend training regularly, and the BSI states that every person who counts as management must be trained. Neither text sets an interval. The BSI recommends a thorough initial session with follow-ups, for example when management changes or the risk situation shifts, and internal records of provider, participants, date, duration, and topics.

Is e-learning enough as evidence in an ISO 27001 audit?

ISO/IEC 27001 prescribes no format, and e-learning with completion records per person is common evidence. Clause 7.3, however, requires employees to know the information security policy, their contribution to the ISMS, and the implications of not conforming. Auditors can check this in interviews. A generic course with no link to your own policies covers this requirement only in part.