For years, cybersecurity training in most organizations followed a predictable pattern.

An annual e-learning module. A short quiz. A phishing reminder. A completion report sent to compliance.

It was easy to deliver and easy to count. Whether it changed anything was a much harder question.

In the European Union, that question is becoming harder to avoid. Two pieces of legislation, the NIS2 Directive and the Digital Operational Resilience Act (DORA), place training explicitly inside the framework of cyber risk management. And as the AI Act has already done for AI literacy, they move training from a good-practice recommendation to something regulators can ask an organization to justify.

For learning and development teams, the interesting shift is not that cybersecurity training now exists. It is that it now needs to be defensible.

What the Regulations Actually Say About Training

The two frameworks apply to different organizations and use different language, so it is worth being precise.

NIS2 (Directive (EU) 2022/2555) covers a wide range of “essential” and “important” entities across sectors such as energy, transport, health, digital infrastructure, public administration and manufacturing. Two provisions matter most for L&D:

• Article 20 makes management bodies responsible for approving and overseeing cybersecurity risk-management measures, and requires members of those bodies to follow training so they have sufficient knowledge and skills to assess cyber risks and management practices. It also encourages entities to offer similar training to their employees on a regular basis.
• Article 21 lists the minimum risk-management measures entities must take, which include basic cyber hygiene practices and cybersecurity training.

Member States were required to transpose NIS2 into national law by 17 October 2024. Transposition has been uneven across the EU, and the European Commission opened infringement procedures against a number of Member States in 2025 for failing to notify full transposition. In practice, that means the exact obligations, deadlines and supervisory expectations your organization faces depend on the national law that applies to it, and that status continues to change.

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025 to financial entities and, in part, to their critical ICT third-party providers. It requires ICT security awareness programmes and digital operational resilience training for all staff, and for senior management it expects sufficient knowledge and skills to understand and assess ICT risk.

The common thread is clear. Both treat training as part of a control environment, not as an HR activity running alongside it.

The Problem With Counting Completions

A completion rate tells you who clicked through a course. It does not tell you whether someone would recognize a credential-harvesting email under time pressure, handle a suspicious payment request correctly, or know whom to call when something looks wrong.

This matters because the human element remains central to security incidents. Industry breach analyses, such as the Verizon Data Breach Investigations Report, have consistently found that a majority of breaches involve a human element, whether through error, misuse or social engineering. (Exact percentages vary by edition and methodology, so check the latest report before quoting a figure.)

If training is meant to reduce that exposure, then the evidence a supervisor or auditor might reasonably expect goes beyond attendance. It starts to include:

• whether training was matched to the risks people actually face in their role;
• whether people can demonstrate the behavior, not just recall the policy;
• whether the organization noticed where training was not working and acted on it;
• whether management-level training reflects the specific responsibilities the regulation assigns to that group.

Three Audiences, Three Different Needs

One of the most useful distinctions in the regulations is that they do not treat everyone as one audience.

Management bodies and senior leaders. Their obligation is about judgment. They need enough understanding to challenge a risk assessment, interpret an incident report, and make resourcing decisions. A generic phishing course does not meet that need. Briefings built around governance, accountability, third-party risk and incident decision-making are closer to what the text envisages. Formats that suit this audience, such as short executive workshops and tabletop exercises, often work better than self-paced modules.

General staff. Here the goal is dependable everyday behavior: spotting suspicious messages, handling data correctly, using authentication properly and reporting incidents quickly. Realistic scenarios and short, frequent practice tend to be more effective than one long annual course.

Specialist and high-privilege roles. IT administrators, developers, finance staff authorizing payments, and incident responders face distinct threats. Their training needs to be technical, scenario-led and refreshed as attack techniques change.

The point is not to build three separate programmes in isolation. It is to define, for each group, what competent behavior looks like and then design the learning backwards from that.

Measuring What Matters

If completion is not enough, what should L&D teams track? Several signals are more informative, and most can be gathered without heavy tooling.

• Scenario performance. How do people respond in simulated phishing, social-engineering or incident-response exercises, and does performance improve over time?
• Reporting behavior. An increase in people reporting suspicious messages is often a healthier indicator than a decrease in clicks alone, because it shows people are engaged and the reporting channel is trusted.
• Time to report. How quickly are suspected incidents escalated?
• Assessment by decision, not recall. Questions that ask people what they would do in a realistic situation reveal more than questions that ask them to repeat a rule.
• Role coverage. Which roles have received which training, and is there a documented reason for any gap?

Standards such as xAPI make it technically possible to capture this kind of granular learning data beyond SCORM-style completion and score records, though the value lies in deciding which behaviors to measure, not in the data format itself.

Two cautions apply. First, simulated phishing campaigns should be designed and communicated carefully, because punitive or humiliating approaches tend to undermine trust and discourage reporting. Second, learning data about individuals is personal data, so measurement needs to respect privacy and works-council or employee-representation requirements where they apply.

Keeping Evidence Without Creating Paperwork

Audit readiness is often where good training programmes struggle, not because the training was poor, but because the supporting record is scattered.

A practical evidence set usually answers a handful of questions, and it is worth deciding in advance where each answer will live:

• Which risks and obligations is this training designed to address?
• Who was the intended audience, and who actually completed it?
• What did the content say at the time, and who approved it?
• What did the results show, and what changed as a result?

Most of this is routine content governance rather than anything specific to security. Where learning content is managed in a system that records versions, approvals and publication history, answering an auditor’s question becomes a retrieval task rather than a reconstruction exercise. This is the same discipline that applies to any regulated training, and it is one of the quieter ways a content-management foundation supports compliance without being a compliance tool in itself.

Practical Steps for L&D Teams

For organizations affected by NIS2, DORA or both, a few actions are sensible starting points:

1. Confirm which obligations apply, and under which national law, with legal or compliance colleagues. L&D should not interpret the regulation alone.
2. Segment the audience into management, general staff and high-risk roles before designing anything.
3. Define the observable behaviors each group needs to show, then choose formats that let them practice those behaviors.
4. Choose a small set of meaningful metrics beyond completion and agree what action follows when results are weak.
5. Set a refresh rhythm. Threats, incidents and regulatory interpretation change, so training should have an owner and a review cycle.
6. Document decisions as you go, including why certain groups received certain training.

The Direction of Travel

Regulation is now steadily pulling workforce training toward the same expectations: be relevant to the role, be able to show it was delivered, and be able to show it had some effect. AI literacy under the AI Act, cyber resilience under NIS2 and DORA, and sector-specific rules elsewhere all point the same way.

For L&D, this is less a threat than an opportunity. Training teams that already think in terms of defined competence, realistic practice and measurable outcomes will find these requirements easier to meet than those still organized around course catalogs and completion reports.

The organizations that handle this best are unlikely to be those with the longest cybersecurity course. They will be the ones that can say, with evidence, what their people are able to do, and what they did when it turned out they could not yet do it.

Sources and Further Reading

European Union, Directive (EU) 2022/2555 (NIS2 Directive), in particular Articles 20 and 21.

European Union, Regulation (EU) 2022/2554 (Digital Operational Resilience Act, DORA).

Verizon, Data Breach Investigations Report (latest edition).

Disclaimer: legal references and dates above reflect the author’s knowledge through mid-2026 and have not been verified against live sources. National transposition status and supervisory guidance change frequently, so please check current official texts (EUR-Lex, ENISA and national authorities).