From legal duty to well-considered decision-making
This is the NIS2 board training from 2LRN4: a board-level training that lets every board member demonstrably meet the training duty under the Dutch NIS2 legislation. It combines e-learning with two workshops at your own board table, and delivers a certificate and an evidence file.
On 15 August 2026 the Dutch NIS2 legislation entered into force. Since then, every member of the management body of an essential or important entity has a personal obligation: you must be able to identify risks to network and information systems, assess control measures and weigh their consequences for the services you provide. You demonstrate this with a certificate from a training course that covers the legally prescribed topics, and you keep that knowledge demonstrably up to date afterwards. You must comply by 15 August 2028 at the latest.
The legislator is clear about the level required. No technical knowledge is expected of you, but knowledge at a strategic level, so that as a board member you can assess measures and have risks managed. The explanatory notes to the Dutch NIS2 implementing decree summarise the goal as arriving at “sound judgement and well-considered decision-making around the security of network and information systems”.
That is exactly what this programme trains.
Why e-learning alone is not enough
The law asks for two different things. The implementing decree prescribes thirteen topics the training must cover. That is knowledge, and knowledge is transferred efficiently through e-learning. The law itself additionally asks for skills, and a skill does not develop by listening. It develops when you have to take a decision while the facts are incomplete and the notification deadline is running.
That is why this programme consists of both, and neither is optional. Six short e-learning modules lay the theoretical foundation and demonstrably cover all thirteen legal topics. Two workshops with your own board turn that foundation into the behaviour the law is really asking for. Those who only watch videos earn a certificate. Those who also practise can actually take, and account for, the decision behind it.
The programme in six months
You complete six e-learning modules of 12 to 15 minutes, one per month, whenever it suits you. Every module revolves around the same four questions you then ask at your own board table: what can go wrong here and what does it affect, what are we doing about it and can I see that it works, what does it mean for our services if it happens anyway, and who decides on this and what is my role.
After the first three modules you take an interim test, which checks whether the basics are in place before you sit down with your own board. The first workshop follows, with your own board and your own CISO at the table. You question your own risk reporting, determine your risk appetite and take one measure decision that you justify in writing.
After the last three modules you take the decision test, which does not test facts but the defensibility of board decisions. You close with the final workshop, a simulation in three rounds. You sit in the first hours of an incident with incomplete information, on day three you face the choice between recovering and carrying on, and six months later you explain to the regulator why you decided what you decided. An independent observer records every decision in a decision log that you take home for your evidence file.
The total investment per board member is about nine and a half hours, spread over six months: eight hours for the two workshops together, plus the six modules. That is an hour and a half per month for an obligation you are personally accountable for.
What you hold afterwards
You receive a certificate that meets all the formal requirements of the Dutch NIS2 implementing decree, drawn up in Dutch or English. The reverse side lists, per legal topic, in which module or workshop it was covered and when. An auditor who places the certificate next to the legal text has nothing left to verify.
In addition, the platform continuously builds your evidence file. The law requires you to keep your knowledge demonstrably up to date after the training, and for that no certificate is prescribed but evidence “by other means”. Our reporting is precisely that evidence: a tamper-proof log per board member with completion dates, content versions, test results and the scheduled update. In the event of an inspection you hand over a single export.
Staying up to date
After the first year, a short annual update module follows with new case material and that year's legislative changes. Every two years you repeat the simulation with a new case. A board member who joins mid-term completes the full programme immediately upon appointment. The law grants a new member two years, but anyone who co-decides on measures they will only later learn to assess runs a risk without a demonstrable basis for that entire window.
Investment
One price per board, regardless of the number of members up to eight participants. All amounts exclude VAT. The workshops take place on site and include preparation with your CISO, facilitation, an independent observer and reporting.
| Component | Price per board |
|---|---|
| Full programme Six e-learning modules, interim test and decision test, certificate for every board member, evidence file and both workshops | €11,500 |
| Annual update New case material, test, updated evidence file, onboarding of new board members included | €950 |
| Biennial repeat simulation Half day, on site | €4,750 |
A board member who joins mid-term completes the full e-learning programme and receives their own certificate, at no extra cost while the annual update is running. For boards with more than eight members, or several boards within one organisation, we agree a tailored arrangement.
If you are already a 2LRN4 or Kantyra customer, a combination discount of 10% applies to the full programme. If you use both platforms, the discount is 15%. Your evidence file then also connects directly to your existing environment, so that the evidence for the training duty and the evidence for the duty of care come together in the same reporting.
Workshops outside the Netherlands
The workshops take place in the Netherlands, in Dutch or in English. We also run them at your own location abroad, in English, with travel and accommodation costs charged separately at cost. For workshops in other European countries and in the local language we are building a partner network. If you are a training provider or a consultancy and you want to deliver this programme in your own market, have a look at our partner page.
Who this applies to
The obligation rests on every member of the management body of an essential or important entity. In a one-tier board it applies exclusively to the executive directors. In a professional partnership it applies to every partner, in a general partnership to every general partner, and for public bodies the law designates the governing body, for municipalities for example the municipal executive. If you are unsure whether your organisation and your role are covered, we will find out for you in a half-hour conversation, free of charge.
Start on time
The final date is 15 August 2028 and the programme takes six months. Those who start in 2027 complete the programme calmly, alongside the registration, the duty-of-care measures and the supply-chain agreements that are on the board agenda in the same period. Those who wait until the spring of 2028 do the training under time pressure while the regulator is already watching.
Frequently asked questions about the NIS2 board training
Who does the training duty apply to?
Every member of the management body of an essential or important entity. In a one-tier board it applies only to the executive directors, in a professional partnership to every partner, in a general partnership to every general partner, and for municipalities for example to the municipal executive.
By when must a board member have completed the training?
By 15 August 2028 at the latest. The programme takes six months, so those starting in 2027 can complete it calmly alongside registration, duty-of-care measures and supply-chain agreements.
How much time does this board training take?
About nine and a half hours per board member, spread over six months: eight hours of on-site workshops plus six e-learning modules of 12 to 15 minutes.
Is e-learning alone enough to meet the training duty?
No. The implementing decree prescribes thirteen topics, and that knowledge transfers efficiently through e-learning. The law additionally asks for skills, and those only develop when you have to take a decision while the facts are incomplete and the notification deadline is running. That is why the programme also includes two workshops.
What does the training deliver as evidence?
A certificate per board member meeting the formal requirements of the implementing decree, listing per legal topic the module in which it was covered. Plus a continuous, tamper-proof evidence file showing that you keep the knowledge up to date.
Where do the workshops take place?
In the Netherlands, in Dutch or in English, or at your own location abroad in English. In that case travel and accommodation costs are charged separately at cost. We are looking for partners to deliver the workshops in other countries in the local language.
What does a NIS2 board training cost?
EUR 11,500 per board for up to eight participants, excluding VAT. After that EUR 950 per year for the update and EUR 4,750 for the biennial repeat simulation.
Plan an introduction via the contact page or email support@2lrn4.com.