NIS2 / BSIG
This training obligation is on you personally - not your IT department.
The German NIS2 transposition act obliges the leadership of affected entities to complete cybersecurity training personally (Section 38 BSIG). Unlike most other workplace training, this obligation cannot be delegated.
Who it affects
The leadership of entities covered by the revised German Federal Office for Information Security Act (BSIG) - "especially important" and "important" entities under Section 28 BSIG. The training obligation applies to leadership personally, not just the IT or security department.
Since when it applies
The act came into force on 06.12.2025, with no transition period. For entities already affected at that point, the registration deadline with the BSI ended on 06.03.2026 (at the latest three months after entry into force, Section 33 BSIG).
What makes this obligation different
Unlike most workplace training, this cannot be delegated to a specialist department - Section 38 BSIG addresses company leadership directly.
Our course for this
NormProof is preparing a short online course tailored to leadership level on the NIS2 training obligation: the key duties, a documented knowledge check, personal evidence. Register now, and we will contact you at launch.
See for yourself.
14 days free, no payment details required.
We will notify you once the course starts