NIS2 and KSC training: who, how often and how to document it

NIS2 training under the Polish National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC) means two separate obligations: annual, documented training for the head of the entity (Art. 8e) and cybersecurity and cyber hygiene education for all staff (Art. 8(1)(2)(i) and (j)). Most of the offers that come up when you search for "NIS2 training" are one- or two-day legal courses for the management board. They are needed, but they answer only half of the question. The amended KSC Act covers training for the head of the entity and, separately, education for all staff. In this article we break both obligations down into specific provisions: who has to be trained, how often, in what scope and what to show the auditor.

What the KSC Act says about training

The amendment of 23 January 2026 (Dz.U. 2026 poz. 252) transposes the NIS2 Directive into Polish law and has applied since 3 April 2026. Training appears in it at two levels that are easy to confuse. Both apply to essential and important entities. If you are not sure whether your organisation is one of them, start with the test "Does the KSC Act apply to my organisation?". Sectors, size thresholds and the full list of obligations are covered in the article NIS2 and the KSC Act: who it applies to.

The first level is the whole organisation. Art. 8(1) lists the elements of the information security management system that an essential or important entity implements. In point 2(i) the Act names "cybersecurity education for the entity's staff", and in point 2(j) "basic cyber hygiene principles". On top of that, Art. 8d(4) requires the head of the entity to ensure that staff are aware of their cybersecurity obligations and know the entity's internal rules in this area.

The second level is management. Art. 8e introduces annual training for the head of the entity and for the person to whom their cybersecurity duties have been delegated.

Both levels are rooted in the directive. Art. 20(2) of NIS2 requires Member States to ensure that members of management bodies follow training and to encourage entities to offer similar training to their employees on a regular basis. Art. 21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the risk management measures.

Once

per calendar year: training for the head of the entity and the person they delegated duties to

Art. 8e(1) of the KSC Act, Dz.U. 2026 poz. 252

300%

of remuneration: the upper limit of the penalty for the head of an essential or important entity

Art. 73a(4) of the KSC Act

100%

of remuneration: the upper limit of the penalty for the head of a public entity

Art. 73a(5) of the KSC Act

3 Apr 2027

deadline for implementing the Chapter 3 obligations for entities covered by the Act from its entry into force

Art. 33(1) of the Act of 23.01.2026

Board training: Art. 8e in practice

Art. 8e has three paragraphs, and each settles a different question: who, on what, and how to prove it.

Who the obligation covers

Training must be completed by the head of the essential or important entity and by the person to whom the head's cybersecurity duties have been delegated. This provision is worth reading together with Art. 8c. The head of the entity is responsible for performing cybersecurity obligations, even when they have delegated them to another person with that person's consent. If the head of the entity is a collective body, for example a company's management board, and no responsible person has been designated, all members of that body are liable.

This leads to a practical tip. If the management board has not designated, by resolution, one person responsible for cybersecurity, it is safer to assume that all of its members should complete the training. Designating a person does not remove the head's liability, so handing the topic over to the IT department does not exempt the CEO from attending the training.

What the training has to cover

Art. 8e(2) does not talk about "cybersecurity" in general. It lists the provisions whose performance the training concerns: Art. 7b(4), 7c, 7f(3), 8, 8d, 8f(1) and (2), 9–12b, 14 and 15. Put simply, this means the information security management system and risk assessment, the head's own obligations, incident handling and reporting, documentation and audit.

This is management training, not phishing recognition training. The head of the entity has to understand what decisions they make, what funding they plan and how they oversee the performance of tasks (Art. 8d(1)–(3)). It helps if the training programme refers to these provisions explicitly. That makes it easy to show during an inspection that the scope matches the Act.

How to document participation

Art. 8e(3) is short: "Participation in the training is documented." The Act does not specify the form. In practice the document should answer four questions: who took part, when, in what scope and whether they completed the training. A named certificate with the date and programme, an attendance list or a report from an e-learning platform with the final test result all serve this purpose. Two requirements are worth putting in the calendar: it is a calendar year, not 12 months from the previous training, and each person needs their own evidence.

Training for all employees: what "staff education" means

This is where the gap in market offers shows. The obligation in Art. 8(1)(2)(i) and (j) covers all staff: accounting, HR, customer service, production workers with access to systems. The Act does not set a frequency or number of hours for them. It requires measures to be "appropriate and proportionate to the assessed risk", which means the entity chooses the form and rhythm of training itself and must be able to justify it.

Art. 8d(4) adds two specific requirements. Staff must be aware of their obligations and must know the internal rules. General cyber hygiene training alone is not enough if employees do not know how incidents are reported in their organisation or what rules apply to remote work. A programme for employees should therefore combine general knowledge with local procedures and confirmation that the employee has read them.

We write more about what everyday cyber hygiene looks like in an organisation in the article Cyber hygiene at work.

Public entities have a ready-made list of topics

An interesting detail that rarely appears in commentaries. An important entity that is a public entity, for example many local government units, does not apply Art. 8(1). Instead, it implements a system that meets the requirements of Annex 4 to the Act (Art. 8(3)). Point I.17 of that annex explicitly requires training for people involved in processing information, with particular emphasis on:

• types of cyber threats,
• basic cyber hygiene principles,
• responding to an incident,
• awareness of the consequences of breaching information security rules.

Point I.14 adds the application of cyber hygiene principles by employees, including the head of the entity. Part II, the elements that the system "may additionally include", provides in point 6 for testing employees' application of cyber hygiene principles. For a local authority, this is a ready-made outline of a training programme. We describe a training plan for a local authority and its subordinate units in the article cybersecurity training for local government.

How often to train the board, IT and employees

The Act sets a frequency only for the head of the entity. For the rest of the organisation, the risk analysis decides. The table below compares what follows from the provisions with the practice we recommend.

Why not once a year for everyone? A one-off session is easy to tick off, but what people learn fades quickly, and fraudsters change their scenarios more often than once a year. Shorter, regular modules also hold up better in front of an auditor, because they show that education is a process rather than a one-off event. Measurement through phishing tests then gives you data on whether training changes behaviour.

What evidence to prepare for an audit and inspection

Essential entities carry out their first information system security audit within 24 months of the amendment's entry into force (Art. 33(2) of the amending act), that is by 3 April 2028. The auditor and the supervisory authority will ask about training in terms of evidence, not declarations. It is worth building a file that contains:

1. A training policy or procedure. Who is trained, on what, how often and on what basis (with a reference to the risk analysis).
2. A training programme mapped to the provisions. For the board, a reference to Art. 8e(2); for employees, to Art. 8(1)(2)(i) and (j); and in public entities, to Annex 4.
3. Named confirmations of participation. Date, scope, test result, completion status. Separately for the head of the entity, to meet Art. 8e(3).
4. Confirmations that internal rules have been read. This addresses Art. 8d(4).
5. A register of new employees and their onboarding. It shows that nobody works in the systems without training.
6. Measurement results. For example, the share of suspicious messages reported in successive simulation campaigns.
7. A history of programme changes. What was updated after an incident, a change in the law or test results.

This list, with references to the provisions, can also be downloaded as a NIS2/KSC checklist.

ZeroLayer Academy generates these summaries from the manager's dashboard: progress by department, named certificates and a separate report on the annual training of the head of the entity. We describe the details in the Compliance section. The Academy provides training documentation, but assessing the compliance of the organisation as a whole is the auditor's job and covers many other areas.

Deadlines: when you need to be ready

The schedule follows from the transitional provisions of the amending act. It applies to entities that met the criteria of an essential or important entity on the date the amendment entered into force.

The transitional period does not mean training can be postponed. The Art. 8e obligation is counted in calendar years, and a first training session for the head of the entity in 2027 at the latest already provides evidence for the first audit. In addition, Art. 73a(1)(2) and (3) allows the head of the entity to be penalised also for failing to perform the obligations under Art. 8 and 8d, that is for the lack of staff education, and not only for the lack of their own training.

How to choose NIS2 training: questions for the provider

NIS2 training offers differ in format (in-person workshop, webinar, e-learning), duration and audience. The Act does not prescribe a format, so the choice should depend on whether the training lets you perform and demonstrate specific obligations. A company buying training can ask the provider a few questions before purchasing:

1. Does the board training programme refer to the provisions listed in Art. 8e(2)? This means the information security management system, the head's obligations, incidents, documentation and audit, not a general overview of the directive.
2. What proof of participation will I get? Named, with the date, scope and result, separately for each board member (Art. 8e(3)).
3. Does the training cover all staff or only management? A course for the board does not fulfil the staff education obligation under Art. 8(1)(2)(i) and (j).
4. Can our own procedures be added? Art. 8d(4) requires staff to know the entity's internal rules, for example how to report an incident.
5. How does the training measure behaviour change? A knowledge test shows what an employee remembers. A phishing simulation shows what they will do.
6. Who updates the content after changes in the law? The amendment is being reviewed by the Constitutional Tribunal, and implementing regulations may specify the requirements in more detail.

If you are comparing offers, you will find the available options in the Options section.

Board training and employee training: how to combine them

The simplest model we recommend has three elements working in one system. The management board completes annual training on its statutory obligations and receives short summaries of results for the whole organisation. Employees learn in short formats spread across the year, from onboarding to refreshers. The IT department or the person responsible for cybersecurity has one dashboard from which they export evidence and see where the team makes the most mistakes.

In ZeroLayer Academy, our cybersecurity training for employees, the team learns through games, quizzes, video micro-lessons and phishing simulations based on attacks we see every day in our work. Here is what it looks like step by step: how the Academy works. If you want to check your team's level of knowledge first, start with a short quiz.

FAQ

Is cybersecurity training for employees mandatory under the KSC Act?

For essential and important entities, yes, although the Act does not use the word "training" in relation to all staff. Art. 8(1)(2)(i) and (j) requires cybersecurity education for staff and basic cyber hygiene principles as part of the information security management system. In public entities, Annex 4 refers to training explicitly and lists its topics.

How often does the management board have to complete NIS2 training?

The head of the entity and the person to whom they have delegated cybersecurity duties complete training once per calendar year (Art. 8e(1)). Where the head of the entity is a multi-member board with no designated responsible person, all members are liable, so it is worth training the whole board.

Does online training meet the requirements of Art. 8e?

The Act does not specify the form of training, only its frequency, scope and the obligation to document it. Online training can meet these requirements if the programme covers the provisions listed in Art. 8e(2) and the platform records named proof of participation with the date and result.

What is the penalty for not providing training?

A head of the entity who fails to perform the obligation under Art. 8e, or the obligations under Art. 8 or 8d, can be fined up to 300% of their remuneration, calculated in the same way as the cash equivalent for annual leave. In public entities the upper limit is 100%. These penalties can be imposed for the first time from 3 April 2028.

Who do these obligations apply to?

Essential and important entities within the meaning of the KSC Act, that is organisations from the sectors listed in Annexes 1 and 2 that meet the size criteria or have been designated as such entities. If you are not sure whether your organisation is covered by the Act, the test "Does the KSC Act apply to my organisation?" will give you a preliminary answer, and a final analysis is best done with a lawyer.

Disclaimer

This article is for information purposes and describes the legal position as at 15 October 2026. It is not legal advice. The President referred the amendment to the Constitutional Tribunal under the follow-up review procedure, which does not suspend the application of the provisions but may affect their content in the future. The scope of a specific organisation's obligations and the management training programme are worth consulting with a lawyer or auditor.

Sources

• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Dz.U. 2026 poz. 252) — Journal of Laws of the Republic of Poland, 2 March 2026 (in Polish)
• Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2) — EUR-Lex, 14 December 2022
• The amendment to the National Cybersecurity System Act takes effect — Ministry of Digital Affairs, 2 April 2026 (in Polish)
• When NIS 2/UKSC must be implemented in essential and important entities: schedule of obligations — LEX (Wolters Kluwer), 2026 (in Polish)
• The amendment to the KSC Act takes effect: the NIS2 implementation schedule in Poland begins — ITwiz, 2026 (in Polish)