The Cybersecurity Act (NIS2): Training, Incident Exercise and Executive Responsibility
Cybersecurity has become a clear leadership issue. With NIS2, responsibility is no longer indirect or delegated – it is formal, personal and defined by law. Fulfilling that responsibility requires more than policies and reports. It requires understanding, sound judgement and practical training in how leadership should act when it truly matters.
This one-day training is a first step. For organisations ready to move from accountability to execution, it also serves as a natural starting point for our Resilience service, where we work systematically and long term with cybersecurity.
When responsibility becomes personal
NIS2 means cybersecurity is no longer just a technical matter. It is a statutory responsibility for executive management and the board. In cases of non-compliance, administrative fines may reach up to two percent of global annual turnover. But the greatest risk is often something else:
- Business disruption
- Loss of trust
- Unclear decision-making in times of crisis
The legislation requires members of management to undergo training on security measures and to demonstrate that they understand their responsibilities.
What the training provides
During one full day, executive management and board members will gain:
- A clear understanding of the formal responsibilities under NIS2
- Tools to interpret risks and identify critical assets
- The ability to set the right expectations within the organisation
- An understanding of what constitutes “appropriate security measures”
Practical table-top simulation exercise
The training includes a realistic incident simulation in which the leadership team responds to a simulated cyberattack. Participants practise:
- Decision-making under pressure
- Communication responsibilities
- Balancing legal, operational and business priorities
- Collaboration with the operational security function
The objective is to ensure that responsibility is not only documented, but operationally understood.
After the training, you will be able to
- Account for executive responsibility under the law
- Request the right decision-support materials
- Act in a structured manner during an incident
- Initiate a risk-based approach that also includes suppliers
Upon completion, you will receive a summary document that can be used for internal follow-up and in the event of regulatory supervision.
PRICE: FROM SEK 168,000
Based on 8–20 participants. Delivered on site or digitally.
Next steps
The training and incident exercise can be delivered as a standalone engagement. For organisations that wish to continue working in a structured and long-term manner with their cybersecurity capabilities, it is possible to build further within our Resilience service.
There, we work systematically with prioritisation, follow-up and implementation, aligned with the NCSC’s 10 cybersecurity capabilities. This is not a requirement. The training itself provides the knowledge and practical exercise required by law.
Related services
Contact us
Are you interested in this offer? Please fill out the form below and one of our experts will contact you shortly.
Follow us!
We’re happy to share knowledge, experiences, and inspiration. Follow us on LinkedIn or subscribe to our newsletter to get the latest insights—before anyone else.