Staff and management need training that fits their role, from basic cyber hygiene to incident decisions. NIS2 names training explicitly. Generic yearly videos are a start, but role-based training for administrators, developers and managers carries more weight.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Give all staff a basic awareness programme
- Add role-based training for people with privileged access
- Train management in their own duties under the Act
Making it stick
Phishing simulations and short exercises give you measurable results to show a supervisor. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.