Skip to content
Back to the knowledge base

6

Cyber hygiene and training

2026-08-10

Cbw art. 21, third paragraph, opening (g) · NIS-2 art. 21(2)(g) · Cbb art. 12

The best technology doesn't help if staff don't know which behaviour carries risk. This family is about knowledge and habits.

What this means in practice

Staff know the risks that come with their own work, you set basic cyber-hygiene rules for day-to-day work, offer training for roles carrying security responsibility, and practise with phishing and suspicious requests.

Why this is in the law

Many incidents start with a human action, not a technical flaw. Training and drills demonstrably reduce that risk.

Measures in this family

  • MC-25 — Staff know the risks that come with their own work
  • MC-26 — Basic cyber hygiene rules in daily work
  • MC-27 — Training for roles carrying security responsibility
  • MC-28 — Practising with phishing and suspicious requests

Sources

Also worth reading

Not sure yet whether this applies to you? Take the free scope check.

Take the free scope check