Cyber training: a NIS2-compliant programme for your entire organisation
NIS2 requires all essential and important entities to train their executives, IT teams and staff in cybersecurity. Stroople delivers a complete, Qualiopi-certified programme that covers your entire organisation through a single coordinated programme. Every module directly addresses the requirements of the directive.
What does NIS2 require in terms of training?
The NIS2 directive (EU 2022/2555) requires essential and important entities to implement risk management measures that include training and awareness for all personnel. Article 20(2) specifically requires that members of management bodies complete dedicated training enabling them to identify cyber risks and assess their impact on the services the entity provides. Article 21(2)(g) extends this obligation to all staff through cybersecurity hygiene practices and training.
In practice, three obligations apply simultaneously: training executives in cyber governance, raising staff awareness of everyday threats, and equipping IT leadership to drive operational compliance. An NIS2 training programme that covers only one of these levels does not fully satisfy the regulatory requirement.
What NIS2 says: Article 20(2) requires members of the management bodies of essential and important entities to complete specific cybersecurity training. Article 21(2)(g) extends the obligation to all staff through cybersecurity hygiene practices and training. In the event of non-compliance, personal liability of directors may be engaged.
An NIS2 training programme
structured across three levels.
The Stroople programme covers the three profiles NIS2 targets. Each track is an annual programme blending in-person and remote delivery, designed to consolidate lasting reflexes without pulling teams away for full days at a time.
Before any training begins, Stroople conducts a maturity assessment and adapts content to your sector, your technology environment and your specific risk exposure.
This training is designed for executives, Executive Committee (ExCom) and Board members, and directors of entities subject to the NIS2 directive. It enables participants to identify the main issues raised by the directive, understand its consequences for executive liability, and match each family of requirements to the technological and organizational levers available to address it. No prior technical expertise is required.
Discover the full program →This training is designed for CIOs and CISOs of entities subject to NIS2. It gives IT teams the reference points and methods needed to translate NIS2 into concrete day-to-day actions: RACI grid across the compliance framework, risk analysis methodology (EBIOS RM, ISO 27005) linked to Article 21 and the ReCyF framework, incident classification and notification within NIS2 deadlines, supply chain security and proportionate sizing of technical measures.
Discover the full program →This training is designed for Executive Committee (COMEX) members and members of the IT Department (CIO office). It enables strategic decision-makers and operational leaders to share a common culture of cyber crisis management and to clarify each person’s role in a crisis situation, including regulatory notification within NIS2 deadlines. No prior technical expertise is required, as the training is designed for executives and managers.
Discover the full program →Executive track
Designed for board members and C-suite executives, this track builds the cyber governance posture that NIS2 requires under Article 20(2). Beyond regulatory knowledge, participants train to lead under pressure: the crisis exercise places the full leadership team in a live incident scenario, from initial detection through to the decision chain and regulatory notification.
IT leadership track
Designed for CIOs, IT managers and security officers, this track covers NIS2 from an operational standpoint: scope, concrete implementation measures and third-party risk management. The crisis exercise is run jointly with the executive track, ensuring both teams rehearse the same scenario and speak the same language when it matters.
Employees track
An annual programme for all employees, with no technical prerequisite. Four phishing simulation campaigns run throughout the year, with immediate remediation for every clicker and dedicated virtual classroom sessions for repeat clickers. Themed e-learning capsules extend awareness across a broad range of everyday threats.
Cybersecurity training in practice: the detail of your programme
Each organisation’s level of cyber maturity varies.
Before we roll out our training modules, we carry out a quick audit to assess your sector, your technological environment and your level of exposure, so that we can tailor a programme to suit your specific needs.
Phishing simulations: customisable campaigns, measurable results
Phishing simulation campaigns are fully customisable: scenarios, sender identity, pretext and difficulty level are adapted to your sector and your target population. Each campaign is more demanding than the last, progressing from generic mass phishing to targeted spear phishing and executive-level whaling. A detailed report is delivered after each campaign, covering click and reporting rates by department, high-risk profiles and remediation actions triggered.
Phishing simulation campaigns — ACME Healthcare
1,187 employees · Full year 2024 · 4 campaigns · Increasing difficulty
Avg. click rate
18%
↓ −14 pts vs C1
Reporting rate
39%
↑ +29 pts vs C1
Serial clickers
67
Virtual classrooms triggered
Remediation
94%
219 total clickers
Trend — click rate vs reporting rate
Click rate by department — C4 (whaling)
C1 — Feb. 2024
Mass phishing
Generic security alert email
C2 — May 2024
Targeted mass
Fake Office 365 security alert
C3 — Sep. 2024
Spear phishing
Personalised email — internal HR
C4 — Nov. 2024
Whaling
Executive targeting — urgent CEO request
* The C4 click rate remains close to C3 despite overall progress: whaling scenarios are the hardest to detect. The relevant benchmark is performance at equal difficulty level, not the raw trend. · Data shown is fictional and produced for illustrative purposes only.
A curated e-learning offer, configured for your organisation
The e-learning offer is configured by Stroople ahead of the programme, based on your regulatory obligations and risk profile. Each module is available in multiple languages, designed to be completed in under to twenty minutes and validated by a scored assessment at an 80% pass threshold. Content is updated as the threat landscape evolves.
E-learning offer — ACME Healthcare
Staff track · NIS2 Art. 21(2)(g) · 2025 annual cycle
Assigned to staff track
Identifying a malicious email
Phishing and ransomware awareness
Phishing awareness
AI and phishing: new threats
Spear phishing
QR code phishing
SMS phishing
USB key phishing
Regulatory modules — also assigned
NIS2 directive overview
GDPR in everyday practice
Understanding GDPR compliance
Content is managed by Stroople and customised to your sector and regulatory obligations. Completion rates reflect ACME Healthcare staff track progress as of Dec. 2025. Data shown is fictional and produced for illustrative purposes only.
Continuous tracking and audit-ready reporting
Completion and assessment data are tracked continuously across all three groups. The reporting covers individual scores, time spent, risk level and phishing click rate per learner, and serves directly as the documentary evidence expected during a NIS2 compliance audit.
Training follow-up — ACME Healthcare
1,187 learners · NIS2 staff track · Dec. 2025
Overall completion
78%
926 of 1,187 learners
Avg. score
6.7/10
Pass threshold: 6.0
Avg. time
47 min
Per active learner
High-risk learners
94
Score below 6.0 or 0% progress
Progress by formation
Most active learners
C. Moreau
P. Laurent
S. Richard
A. Bernard
F. Dubois
N. Martin
Completion by group
Group 1 — Staff
Group 2 — Management
Group 3 — IT leadership
How is the programme deployed?
Deployment follows four steps, with minimal coordination burden on your teams. First, Stroople conducts the maturity assessment and programme scoping – typically one to two weeks. Next, scheduling is coordinated with your calendar and team availability. In-person sessions can be held on-site or at our training facilities; remote modules are accessible via any browser with no installation required.
Throughout the programme, each module generates formal evaluation outputs: entry-level skills assessments, e-learning QCM results at an 80% pass threshold, and phishing simulation reports. These documents are directly usable as audit evidence for NIS2 compliance. A closing report is delivered at the end of each annual cycle.
Your organisation falls within the NIS2 scope. Ready to structure your training programme?
Rethinking Cyber Training: One Size Fits None
Most cybersecurity training programs follow the same logic: roll out identical e-learning modules to all employees, once a year, and tick the box. This approach has one virtue: it is simple to deploy and cost-effective. It has one major flaw: it does not work. Not because the tools are poor. Because the starting question is wrong.