From legal duty to well-considered decision-making
On 15 August 2026 the Dutch NIS2 legislation entered into force. Since then, every member of the management body of an essential or important entity has a personal obligation: you must be able to identify risks to network and information systems, assess control measures and weigh their consequences for the services you provide (Article 20(2) NIS2). You demonstrate this with a certificate from a training course that covers the legally prescribed topics, and you keep that knowledge demonstrably up to date afterwards. You must comply by 15 August 2028 at the latest.
The legislator is clear about the level required. No technical knowledge is expected of you, but knowledge at a strategic level, so that as a board member you can assess measures and have risks managed. The explanatory notes to the Dutch NIS2 implementing decree summarise the goal as arriving at “sound judgement and well-considered decision-making around the security of network and information systems”.
That is exactly what this programme trains.
Why e-learning alone is not enough
The law asks for two different things. The implementing decree prescribes thirteen topics the training must cover. That is knowledge, and knowledge is transferred efficiently through e-learning. The law itself additionally asks for skills, and a skill does not develop by listening. It develops when you have to take a decision while the facts are incomplete and the notification deadline is running.
That is why this programme consists of both, and neither is optional. Six short e-learning modules lay the theoretical foundation and demonstrably cover all thirteen legal topics. Two workshops with your own board turn that foundation into the behaviour the law is really asking for. Those who only watch videos earn a certificate. Those who also practise can actually take, and account for, the decision behind it.
The programme in six months
You complete six e-learning modules of 12 to 15 minutes, one per month, whenever it suits you. Every module revolves around the same four questions you then ask at your own board table: what can go wrong here and what does it affect, what are we doing about it and can I see that it works, what does it mean for our services if it happens anyway, and who decides on this and what is my role.
Halfway through comes the first workshop, with your own board and your own CISO at the table. You question your own risk reporting, determine your risk appetite and take one measure decision that you justify in writing.
At the end comes the second workshop, a simulation in three rounds. You sit in the first hours of an incident with incomplete information, on day three you face the choice between recovering and carrying on, and six months later you explain to the regulator why you decided what you decided. An independent observer records every decision in a decision log that you take home for your evidence file.
The total investment per board member is roughly nine hours, spread over six months. That is an hour and a half per month for an obligation you are personally accountable for.
What you hold afterwards
You receive a certificate that meets all the formal requirements of Article 22 of the Dutch NIS2 implementing decree, drawn up in Dutch or English. The reverse side lists, per legal topic, in which module or workshop it was covered and when. An auditor who places the certificate next to the legal text has nothing left to verify.
In addition, the platform continuously builds your evidence file. The law requires you to keep your knowledge demonstrably up to date after the training, and for that no certificate is prescribed but evidence “by other means”. Our reporting is precisely that evidence: a tamper-proof log per board member with completion dates, content versions, test results and the scheduled update. In the event of an inspection you hand over a single export.
Staying up to date
After the first year, a short annual update module follows with new case material and that year's legislative changes. Every two years you repeat the simulation with a new case. A board member who joins mid-term completes the full programme immediately upon appointment. The law grants a new member two years, but anyone who co-decides on measures they will only later learn to assess runs a risk without a demonstrable basis for that entire window.
Investment
One price per board, regardless of the number of members up to eight participants. All amounts exclude VAT. The workshops take place on site and include preparation with your CISO, facilitation, an independent observer and reporting.
| Component | Price per board |
|---|---|
| Full programme Six e-learning modules, decision test, certificate for every board member, evidence file and both workshops | €11,500 |
| Annual update New case material, test, updated evidence file, onboarding of new board members included | €950 |
| Biennial repeat simulation Half day, on site | €4,750 |
A board member who joins mid-term completes the full e-learning programme and receives their own certificate, at no extra cost while the annual update is running. For boards with more than eight members, or several boards within one organisation, we agree a tailored arrangement.
If you are already a 2LRN4 or Kantyra customer, a combination discount of 10% applies to the full programme. If you use both platforms, the discount is 15%. Your evidence file then also connects directly to your existing environment, so that the evidence for the training duty and the evidence for the duty of care come together in the same reporting.
Who this applies to
The obligation rests on every member of the management body of an essential or important entity. In a one-tier board it applies exclusively to the executive directors. In a professional partnership it applies to every partner, in a general partnership to every general partner, and for public bodies the law designates the governing body, for municipalities for example the municipal executive. If you are unsure whether your organisation and your role are covered, we will find out for you in a half-hour conversation, free of charge.
Start on time
The final date is 15 August 2028 and the programme takes six months. Those who start in 2027 complete the programme calmly, alongside the registration, the duty-of-care measures and the supply-chain agreements that are on the board agenda in the same period. Those who wait until the spring of 2028 do the training under time pressure while the regulator is already watching.
Plan an introduction via the contact page or email support@2lrn4.com.