Recognise and report attacks
Short label: TRAINING
Meaning
Help staff recognise suspicious messages, unexpected requests and unsafe handling of company information.
Why it matters
A person who reports an unusual request gives the team a chance to check it before it causes damage.
What you can do
Use a realistic example from your work. Agree how to report it and how staff can verify a request through another channel.
Services that can help
Workshops practise examples and produce instructions your team can use. Session frequency is agreed with you.
Official reference — NIS2 Art. 21(2)(g)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(g) basic cyber hygiene practices and cybersecurity training;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(g)
Everyone in the organisation must know the basics and be trained: updates, passwords, what a phishing email looks like.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.