NIS2 Management Training: Content, Frequency, Records and Cost Under § 38 (3) BSIG

Written by the NIS2Compass editorial team / As of: November 2026

Under § 38 (3) BSIG, every management body member of an important or particularly important entity must personally attend training. The legislator reads "regularly" as at least every three years, and its cost assumptions work out at around EUR 360 per person and training session. Format and provider are up to you, and no knowledge test is required. For the record, NIS2Compass offers the "Management Training Record" template.

Who Must Attend Training Under § 38 (3) BSIG?

The obligation applies to every natural person who, by law, articles of association or partnership agreement, manages the business of an important or particularly important entity and represents it. In a GmbH, that means all managing directors, including the commercial one, and training the IT manager or information security officer (ISB) does not replace their attendance. The BSI recommends including the people who prepare decisions for management.

The statutory wording of § 38 (3) BSIG (our translation):

"The management of particularly important entities and important entities must regularly attend training in order to acquire sufficient knowledge and skills to identify and assess risks and risk management practices in the field of information technology security, and to be able to assess the impact of risks and risk management practices on the services provided by the entity."

The obligation has applied since the NIS2UmsuCG entered into force on 6 December 2025, with no transition period, and transposes Art. 20(2) of the NIS2 Directive. Under § 2 No. 13 BSIG: management means the persons who conduct the business and represent the entity. § 38 (3) does not distinguish by entity category, according to the BSI FAQ on NIS-2. Whether your entity is in scope is answered by the NIS2 applicability check.

• Obligated: all managing directors of a GmbH, all executive board members of an AG, managing partners, each person individually.
• Not sufficient: According to the BSI curriculum for management training, training only the IT management, ISB, data protection or compliance functions does not replace training for management.
• Recommended, not mandatory: according to the BSI, supporting roles such as the CISO, CFO, OT managers or authorised signatories (Prokuristen), unless they themselves fall under § 2 No. 13 BSIG.
• Supervisory and advisory boards: A pure oversight body does not conduct the business and, by the wording, is generally not covered.

Even when it relies on others for support, management retains ultimate responsibility (explanatory memorandum to § 38 (1), Bundestag printed paper BT-Drs. 21/1501, p. 154). That is why the knowledge has to reach the people who make the decisions.

Based on a free assumption, the legislator expects around 150,000 senior staff for whom the NIS2 training obligation changes something (BT-Drs. 21/1501, p. 113).

The "NIS2 Training Plan & Audience Matrix" template from the NIS2Compass Template Library separates mandatory participants from recommended ones.

What Content Must NIS2 Management Training Cover?

The BSI expects three linked core areas: identifying and assessing risks, knowing risk management measures, and assessing their impact on your own services. Training that covers only the measures is considered insufficient by the BSI. The sample curriculum from October 2026 spreads the content over six modules totalling 240 minutes.

The benchmark is the BSI guidance "Schulung für Geschäftsleitungen" (training for management), version 1.0 of 17.04.2026. It is not legally binding, but it shows the yardstick the BSI applies to training in supervisory proceedings. The three core areas:

• Identifying and assessing risks: likelihood, impact, risk acceptance and risk management as a continuous process.
• Risk management practices: at least the measures under § 30 (2) BSIG, and ideally also the measures your entity has already introduced or is planning.
• Assessing the impact: operational, financial and regulatory consequences, cyber risks as business risks, trade-offs between security and service delivery.

An overview of the BSIG, reporting and registration duties, and liability round this out. Relating the content to your sector, critical business processes and standards such as B3S is expressly intended. Not every management body member needs the same depth: existing knowledge does not have to be taught again, but the reasons for that must be documented.

The BSI sample curriculum, version 1 of 28.10.2026, developed with associations from the Alliance for Cyber Security (Allianz für Cybersicherheit), proposes this agenda:

1. BSIG, NIS-2 and scope (30 min.)
2. § 38 BSIG: duties, liability, limits of delegation (40 min.)
3. Cyber risks as business risks (40 min.)
4. § 30 BSIG as a management system (75 min.)
5. Registration, reporting and notification duties (35 min.)
6. Governance, records and transfer (20 min.)

The curriculum is non-binding and shows one possible approach. The goal is sound judgement, not detailed technical training on tools, architecture or attack techniques.

How Does Management Training Differ From Employee Training?

Employee training is based on § 30 (2) No. 7 BSIG: "basic training and awareness measures in the field of information technology security" (our translation). The guidance treats it separately, and the curriculum leaves awareness out. The explanatory memorandum assumes one hour of training or self-study per employee per year. More on this in the article Employees as the biggest NIS2 risk.

The consequence: an awareness session that the managing directors attend will, as a rule, not satisfy § 38 (3) BSIG, because the three core areas are missing.

How Often and for How Long Must Management Be Trained?

The law sets no interval, but according to the explanatory memorandum, training counts as regular if it is offered at least every three years. The BSI considers this minimum interval sufficient only in the rarest of cases and recommends a risk-appropriate rhythm. The frequently quoted four hours are not a recommendation but a cost assumption by the legislator, which the BSI usually considers too short.

What Did the Legislator Assume?

• Interval: According to the explanatory memorandum to § 38 (3) BSIG (BT-Drs. 21/1501, p. 154), training counts as regular if it is "offered at least every 3 years" (our translation).
• Duration: For the compliance cost estimate (p. 113), it is "freely assumed" that training lasts half a day, or 4 hours, on average.

What Does the BSI Expect?

In its FAQ on NIS-2, the BSI makes clear that the 4 hours are an assumption from the explanatory memorandum, not a recommendation. "In the vast majority of cases, a 4-hour training session will not be sufficient" (our translation). The BSI considers the three-year interval sufficient "only in the rarest of cases". Training may be split into several sessions.

The BSI guidance (version 1.0, section 1.2) recommends a thorough initial training followed by regular refresher sessions. Interval and duration depend on the entity's risk exposure and the individual skills of its management. As reference points for the type, duration and interval of follow-up training, it lists:

• Changes in management
• Significant changes in business processes
• Significant changes in risk exposure
• Significant changes in implemented or planned risk management measures

How Long Is the Initial Training in the BSI Curriculum?

For the initial training, the BSI curriculum outlines 240 minutes without exercises. A shortened variant gets by with around 180 minutes, but requires a mandatory, documented pre-read of no more than ten pages. The curriculum plans exercises, simulations and tabletop formats as separate formats after the initial training. The curriculum's 240 minutes are a starting point, not a permanent solution: exercises and follow-up sessions come on top.

There is no BSI requirement of "at least once a year" and no fixed deadline after taking office. An annual rhythm can still be risk-appropriate, but it is then your entity's own decision. Before planning, you can gauge where each managing director stands with the self-check for managing directors (Excel template).

What Does NIS2 Management Training Cost, In-House or External?

There is no official price. Per person and training session, the legislator assumed 4 hours at EUR 62.40 plus EUR 110 for external trainers, around EUR 360 in total, or about EUR 1,080 for three managing directors. Actual costs depend mainly on duration, interval, an in-house format and the share of company-specific content.

The figures come from the explanatory memorandum (BT-Drs. 21/1501, p. 113 f.). They are assumptions for the impact assessment, not a requirement for training duration. The 4 hours are "freely assumed" there, and the wage rate corresponds to a high qualification level.

Nationwide, the memorandum expects just under EUR 37 million in personnel costs and EUR 16.5 million in material costs for management staff, and around EUR 165 million per year including employee training. It also points to free online training courses, which would lower material costs if they are sufficient.

Sample calculation by NIS2Compass based on these assumptions:

• Working time: 4 × EUR 62.40 = EUR 249.60 per person
• External trainers: EUR 110 per person
• Total: EUR 359.60 per person and training session, EUR 1,078.80 for three managing directors

The working time is an imputed value, not an invoiced amount.

The main cost drivers are:

• Scope: duration beyond 4 hours, interval and event-driven follow-up sessions
• Format: open seminar or in-house, exercises such as tabletop or simulation games

As a reference for in-house training delivered by consultants: according to the BDU fee study 2025, the average daily rate was EUR 1,300, ranging on average from EUR 700 (analyst) to EUR 1,600 (partner) depending on seniority. That is a consultant's daily rate, not a training price.

Should the Training Be Delivered In-House or Externally?

The BSI guidance (section 1.4) allows both:

• External: External providers must take entity-specific aspects into account, which according to the BSI can mean more effort.
• In-house, for example by the ISB: Close to the context. If training is delivered exclusively in-house, the BSI sees a risk of structural knowledge gaps: management learns how processes are implemented but cannot independently judge whether they are adequate from a legal and risk perspective.
• Combination: The BSI considers it sensible to cover general content externally and add specific content in-house.

If the same service provider also implements your measures, check for possible conflicts of interest. There is no official quality seal or BSI accreditation for training providers. According to the BSI FAQ (question 5), the BSI does not recommend individual providers and advises comparing offers against the guidance.

How Do You Document the Training, and What Happens Without a Record?

The BSI expects documentation covering the provider or internal unit, participants with their roles, date, time and duration, and the content covered with reference to § 38 (3) BSIG. Testing participants is not required. The BSI can review compliance with the training obligation and order its implementation; § 65 BSIG provides no separate fine for it.

The minimum details according to the BSI guidance (chapter 1.5):

• Provider: external provider or internal unit
• Participants: name and role
• Time: date, time, duration of the sessions
• Content: topics and formats with reference to § 38 (3) BSIG

The BSI curriculum (chapter 6) adds: a signed attendance list, versioned training materials, minutes of resolutions and a defined interval with triggers.

However, the documentation only proves attendance. According to the guidance, whether the knowledge is sufficient shows in management's active, traceable involvement in risk management decisions. So file the resolutions made after the training alongside it.

When Can the BSI Request the Record?

• Particularly important entities: Ordered audits or inspections can expressly include § 38 (3) (§ 61 (1) BSIG). The BSI can order the submission of evidence without an audit no earlier than three years after entry into force (§ 61 (3)), i.e. from December 2028; for licensed hospitals, a period of five years generally applies.
• Important entities: only if facts justify the assumption that the training obligation has not been implemented, or not implemented correctly (§ 62 BSIG).

What Happens If the Training Is Missing?

§ 65 BSIG does not list § 38 (3) as an administrative offence. The BSI can, however, order its implementation (§ 61 (7), for important entities via § 62). Anyone who intentionally or negligently fails to comply with such an enforceable order commits an administrative offence: up to EUR 500,000 (§ 65 (2) No. 1 (c) in conjunction with (5) No. 5).

If a particularly important entity fails to comply with orders despite a deadline, the competent supervisory authority can, as a last resort, temporarily prohibit unreliable management from carrying out its duties (§ 61 (9) No. 2). For more on personal liability, read the article on management liability under § 38 BSIG.

For filing, the NIS2Compass Template Library offers the "Management Training Record" (Word) and the "NIS2 Training Record Register" (Excel), both part of the Pro subscription. They structure the minimum details but do not replace the training itself.

What Does Implementation Look Like in a GmbH With Three Managing Directors?

A fictional machine builder with 120 employees is an important entity and has three managing directors for engineering, sales and finance; the engineering director has prior ISO 27001 knowledge. The ISB plans an initial training for all three, invites the head of production as a supporting participant and sets the next date based on risk. Within a few weeks, management follows up with concrete resolutions.

• Step 1, participants: All three are obligated under § 2 No. 13 BSIG, the engineering director despite his prior knowledge. According to the BSI guidance, the depth of his training may be adjusted, with the reasons documented. The head of production and the ISB take part as recommended supporting roles.
• Step 2, format: An external trainer covers the general content (curriculum modules on the BSIG overview, § 38 duties and reporting duties). The ISB adds the company's own risks, OT dependencies and the status of the § 30 measures (modules on cyber risks, § 30 measures and governance). A pre-read is sent out in advance.
• Step 3, record: The training record with agenda and reference to § 38 (3) BSIG, the signed attendance list and the slide deck as a PDF go into the compliance file.
• Step 4, interval: The follow-up session will be a tabletop exercise on ransomware in production. Because of the OT dependency, management decides on a shorter rhythm than three years. If a managing director changes, the new person is trained as a triggered event.
• Step 5, follow-up: The BSI curriculum (chapter 9) provides for decisions to be addressed ideally within 2 to 6 weeks after the initial training. These include approving the § 30 measures register, rules on risk acceptance, a regular cyber risk report and planning the follow-up training.

That is why the ISB puts this follow-up meeting in management's calendar together with the training date.

Frequently Asked Questions

Is an Online Course Enough for NIS2 Management Training?

The format is up to you, and the BSI guidance even considers interactive or self-paced formats well suited. What matters is that the three core areas are covered and the content is related to your own entity. A generic course without that link usually falls short of what the BSI expects. Attendance and content must be documented.

Does the Supervisory Board or Advisory Board Have to Attend?

The obligation applies to persons appointed to manage the business and represent the entity (§ 2 No. 13 BSIG). By this wording, a pure oversight body is generally not covered. If a board has management powers under the articles of association, have this checked legally. Voluntary attendance is always possible.

Is There a BSI Certificate for Management Training?

No, there is no BSI certificate or BSI accreditation for training. According to the BSI FAQ on NIS-2, the BSI does not recommend individual providers and advises comparing offers against the guidance. Testing participants is required neither by law nor by the BSI. Certificates of attendance from providers help with documentation, but they do not replace the details on content, duration and reference to § 38 (3) BSIG.

When Does a New Managing Director Need to Be Trained?

There is no statutory deadline after taking office. However, the guidance expressly lists a change in management as a reference point for the type, duration and interval of subsequent training. Schedule the training soon after the appointment. That way, the new person can meet their duties under § 38 (1) BSIG from day one.

Does ISO 27001 Certification Replace Management Training?

No. A certificate held by the entity or the prior knowledge of individuals does not replace personal attendance. Existing knowledge may be taken into account, though: areas that are already well understood do not have to be taught again, provided you document the decision and the reasons. The obligation under § 38 (3) BSIG applies to each person, not to the entity.