Which organizations are covered by the NIS2 directive?

NIS2 applies to essential and important entities across many sectors, expanding the scope in France from roughly 500 to 15,000-18,000 entities, and can also affect suppliers indirectly through a cascading effect.

What does Article 20 of NIS2 require from executives?

Article 20 requires the management body to approve and oversee risk management measures, and to undertake dedicated training themselves.

What are the incident notification deadlines under NIS2?

An entity must submit an early warning within 24 hours, a notification within 72 hours, and a final report within 1 month.

Can an executive be held personally liable for a NIS2 breach?

Yes, an executive's personal liability can now be engaged in the event of a serious and repeated failure, in addition to sanctions targeting the entity itself.

What is ANSSI's ReCyF framework?

ReCyF is the framework published by ANSSI that breaks down the 10 European risk management measures into 20 concrete security objectives, with a common level and a reinforced level for essential entities.

GRC-02

Cyber Governance for Executives (NIS2)

0,5

day(s)

In House

On-site

Remote Session

Training center

Paris

Audience

Decision-makers

Fee

On request

PRESENTATION & TARGET AUDIENCE

Understand your role. Limit your exposure.

A board of directors or executive committee arbitrates budgets, sets priorities, and makes decisions under pressure in a crisis. If its members lack a basic understanding of cyber risk, the organization’s compliance and its ability to respond to an incident remain fragile, regardless of the resources invested further down the hierarchy. This training is therefore not a box-ticking exercise, it directly determines the strength of the organization’s line of defense.

This training is designed for executives, Executive Committee (ExCom) and Board members, and directors of entities subject to the NIS2 directive. It aims to explain the objective of the directive and identify its consequences for executive liability.

PREREQUISITES

No technical or theoretical prerequisites are needed to attend this training.

LEARNING OBJECTIVES

The overall pedagogical objective of this training is to enable executives to identify the main issues raised by the NIS2 directive and understand the consequences for executive liability.

By the end of this training, participants will be able to:

Identify the scope of application of NIS2 and distinguish the ways their organization may be exposed, in order to map the risk typologies to which it is genuinely exposed.
Explain the compliance requirements placed on the management body, and match each family of requirements to the technological and organizational levers available to address it.
Identify the business impact of potential incidents, and justify cybersecurity investment priorities in light of that impact.

TRAINING METHODS

This training alternates interactive presentations and practical workshops. The introductory module draws on key figures and recent cases to anchor the stakes before addressing the regulations. The following modules are based on hands-on exercises and a contrasting case study leading to a group discussion facilitated by the trainer.

ASSESSMENT METHOD

The effective mastery of all the learning objectives will be assessed through a quiz (summative assessment).

PROGRAMME

Sequence 1: What NIS2 concretely means for your organization

Identify the criteria used to qualify an organization under NIS2, and distinguish between the status of essential entity and important entity depending on the activities concerned.
Identify the cascading effect mechanism through client organizations, and illustrate how an organization outside the direct scope may nonetheless become indirectly subject to NIS2 requirements.
Describe the most common risk typologies in the sector (ransomware, supplier compromise, data breach), and map the organization’s exposure to each of these risks.

Sequence 2: Legal obligations and risks for executives

Explain the obligations Article 20 of the directive places on the management body (approval, oversight, training).
Describe the evolution of executives’ personal liability, and identify the conditions (serious and repeated failure) under which it may be engaged.
Distinguish sanctions targeting the entity itself from those targeting the executive personally.
Describe the 10 risk management measures set out in Article 21 (risk analysis, business continuity, supply chain security, training, access management), forming the European security baseline.
Explain the principle of national transposition of the directive, illustrated by the French case of ANSSI’s ReCyF framework (20 objectives, a common level and an enhanced level for essential entities).
Identify the resulting notification obligations (deadlines to be met), and define the organization required to meet and sustain them over time.
Match each family of requirements to its concrete levers: methodological (EBIOS RM), normative (ISO 27001), technological (detection and response, strong authentication, encryption, isolated backups) and organizational (staff training, access governance, contractual clauses for suppliers, tested continuity plans).

Sequence 3: Concrete examples and ROI of an effective cybersecurity policy

Acquire the gap-analysis method, and justify its role as the starting point of a prioritized compliance plan.
Compare the business impact of an unmanaged incident (business interruption, loss of contracts, reputational damage) to the cost of a structured approach, in order to assess the net benefit of a cybersecurity policy.
Assess, using a reading grid, the risk-reduction impact of a security measure, and arbitrate the resulting investment priorities.

Updated on 3 July 2026

Training Center

PARIS
121 rue d'Aguesseau (centre d'affaires Emergence)
92 100 Boulogne Billancourt

Registered under number: 11922630392.

Meets NIS2 requirements

Article 20 of NIS2 requires executives to be trained on cyber risk. This training meets that obligation directly, combining exposure to the regulatory framework with hands-on workshops. It produces a training certificate and quiz results, usable as evidence during an audit or regulatory review.

A key component of a comprehensive solution :

Full NIS2 training programme : from executive training to organisation-wide staff awareness, including IT teams and phishing simulation campaigns.
Cyber crisis exercise : joint simulation with management and IT teams, to rehearse coordination under pressure
Third-party risk management : mapping your suppliers and providers, scoring their criticality, and securing your supply chain contractually.
CISO as a Service: ongoing strategic security guidance, without an in-house recruitment.