NIS-2 for the executive board, management and management level

Legal framework: NIS 2 Directive and BSIG

• Overview of the NIS-2 Directive and the amended BSIG.
• Classification of terms in KRITIS, "important" and "particularly important" facilities.
• Role of management in implementing, monitoring, and verifying risk management measures.
• Overview of liability risks and sanctions framework.

Core area 1: Risk analysis from the perspective of management

• What a risk analysis according to NIS-2/BSIG must achieve – without technical details.
• Typical threats and damage scenarios from a management perspective.
• Reading and understanding risk reports: What questions should management ask?
• Anchoring risk analysis in risk management and corporate strategy.

Core area 2: Risk management measures and minimum requirements

• Requirements for risk management measures in accordance with the NIS 2 Directive and Section 30 of the German Federal Security Act (BSIG).
• Overview of typical technical and organizational measures (TOM) and management tasks.
• Role of management: setting targets, allocating resources, prioritizing, and monitoring.

Core area 3: Impact of risks and measures on the services provided

• What impact can security incidents have on operations, production, services, reputation, and finances?
• Evaluation of measures from a business perspective: economic efficiency, proportionality, residual risk.
• Dealing with residual risks: documentation, communication, and decision-making in senior management.

Roles, responsibilities, and effective delegation

• Delineation of tasks: What must remain at the management level, and what can be delegated?
• Collaboration with CISO/ISB, IT management, data protection, compliance, and risk management.
• Requirements for reporting channels, controls, and documentation.

Implementation in practice: From the legal framework to your own governance

• Practical examples of security incidents and management liability.
• Deriving a separate roadmap for management: Which issues should be addressed in the short, medium, and long term?
• Documentation of training and management decisions made as a component of fulfilling documentation requirements.

Note on mandatory training
This training members of management training fulfill their training obligations under Section 38(3) of the German Federal Security Act (BSIG). The content is based on the BSI guidelines on mandatory training under Section 38(3) BSIG and helps participants to fulfill their training obligations.