For the training duty under Section 38(3) BSIG
NIS2 training for your management, tailored to your company
We train your management under Section 38(3) of the German BSI Act (BSIG), the NIS2 training duty: in-house, remotely or on site, in four hours along the six modules of the BSI curriculum and with examples from your own company. Each participant receives a certificate of attendance, and management receives a template for the decisions due after the training.
What does Section 38(3) BSIG require?
The management of essential entities (in Germany: besonders wichtige Einrichtungen) and important entities (wichtige Einrichtungen) “must attend training regularly” in order to gain sufficient knowledge and skills to identify and assess risks and risk management practices in information security and to judge their impact on the services the entity provides (Section 38(3) BSIG, our translation). The duty applies to every person appointed by law, articles of association or partnership agreement to run the business and represent the entity, that is, every managing director or member of the management board.
The act names no interval and no number of hours; it only says “regularly”. According to the BSI, the Federal Office for Information Security, the explanatory memorandum assumes training at least every three years and an average duration of four hours. The BSI stresses that the four hours are not a recommendation and considers both insufficient in most cases. It recommends a thorough initial training followed by regular follow-up training whose type, duration and interval depend on the risk situation. According to the BSI guidance, reasons for follow-up training include a change in management and significant changes to business processes, risks or measures.
The training duty is subject to supervision: for essential entities, the BSI can order audits that expressly include Section 38(3); for important entities, it reviews when facts point to a breach. Section 38 does not apply to some entities, such as operators of public telecoms networks and financial entities under DORA (Section 28(5) and (6) BSIG, with counter-exceptions explained on the page on NIS2 applicability); other rules may apply to them. Whether the duty applies to you has to be assessed case by case.
What will your management be able to do after the training?
The learning objectives follow the three abilities in Section 38(3) BSIG and the learning outcomes of the BSI curriculum. The aim is for management to be able to assess, decide and oversee; technical details stay with the specialists.
Why does this concern us?
Understand duties and responsibility
What Section 38 BSIG requires of management, what can be delegated and what cannot, and how the act regulates liability.
Duties of managementWhat is in scope?
Understand the scope
Why and with which services, IT and OT processes, service providers and group companies the organisation falls under the BSIG.
NIS2 applicabilityWhat is at stake?
Assess cyber risks
Rate risks by likelihood and damage and judge their impact on services, customers and the ability to deliver.
What has to be implemented?
Steer Section 30 BSIG
The ten minimum measures as a management task: resources, priorities, supply chain, effectiveness and residual risk.
The ten measuresWho decides in an emergency?
Reporting and escalation
Registration, the 24- and 72-hour reporting deadlines and who in the company decides on a report.
NIS2 incident reportingHow do we see progress?
Read reports and oversee
Assess security reports, metrics and evidence, ask the right questions and document decisions.
What you receive
The deliverables of the initial training and the short version follow the evidence and documentation package in the BSI curriculum.
01
Pre-read
At most ten pages on classification, services, status of measures, reporting process and risks, prepared from the preparatory call and sent at least five working days before the training, as the curriculum recommends.
02
Slide deck as PDF
The slides shown, with version, date and sources, for filing in your training documentation.
03
Certificate of attendance per person
With the minimum details set out in chapter 1.5 of the BSI guidance (see “How do you evidence the training?” below).
04
Signed attendance list
All participating members of management and other participants, to be presented on request.
05
Template for the management resolution
The decisions the curriculum expects after the initial training, for example on responsibilities, register of measures, residual risks, reporting process and regular reports, ideally within two to six weeks.
06
Question catalogue and interval recommendation
Questions management can put to IT, service providers and the information security officer, and a recommendation on the interval for follow-up training with the triggers named in the guidance.
Structure of the initial training
Modules and durations follow the four-hour sample agenda of the BSI curriculum. The right-hand column shows how we relate each module to your company; the BSI expressly expects external providers to take the specifics of the entity into account.
| Module | Content according to the BSI curriculum | Duration | Link to your company |
|---|---|---|---|
| 1 BSIG, NIS2 and scope | Why the topic concerns management; services, entity category, IT/OT and group | 30 min | Your classification and your services from the preparatory call |
| 2 Section 38 BSIG: duties, liability, limits of delegation | Implementation, oversight, training duty; personal responsibility and delegation | 40 min | Your current split of tasks between management, IT and service provider |
| 3 Cyber risks as business risks | Identifying and assessing risks, protection goals, types of damage, impact on services | 40 min | Attack sequences that fit your industry, using re-enacted examples |
| 4 Section 30 BSIG as a management system | Minimum measures in clusters; resources, prioritisation, effectiveness, supply chain, staff, technology | 75 min | Your implementation status, where known, and your critical service providers |
| 5 Registration, reporting and notification duties | Sections 32-35 BSIG, decision and escalation logic, communication and approval paths | 35 min | Who reports in your company, who decides and who can be reached at night |
| 6 Governance, evidence and transfer | Reporting, documentation, metrics, list of resolutions and actions, follow-up training | 20 min | Template for your management resolution and recommendation on the interval |
Module topics, content and duration according to the BSI curriculum for management training under NIS2, version 1 of 28 October 2026, chapter 2.2 (sample agenda without exercises, 240 minutes); module titles partly shortened and translated by us. According to the BSI, the curriculum is non-binding and one possible way to implement Section 38 BSIG. Right-hand column: tailoring by Blackfort Technology.
What does the NIS2 management training cost?
You book for your management body. The initial training is the core; the short version, the tabletop exercise and the refresher are added as needed. All prices net plus VAT.
| Component | Scope | Price |
|---|---|---|
| In-house initial training | Preparatory call of 60 minutes, mandatory pre-read, 4 hours along the six modules, deliverables as described above; for one management body of up to 8 people | from €3,500 remote, from €3,800 on site, net plus VAT |
| Short version | 3 hours following the curriculum’s shortened variant; same deliverables as the initial training (everything under “What you receive”), only a shorter session; for one management body of up to 8 people | from €2,800 remote, net plus VAT |
| Incident tabletop exercise | Tabletop exercise separate from the initial training: scenario tailored to your company, 2-3 hours, evaluation with a list of actions; for one management body of up to 8 people | from €2,100 net plus VAT |
| Additional participants | from the 9th person for the initial training, short version or tabletop exercise | €150 per person net plus VAT |
| Annual refresher | 90-120 minutes remote: threat situation, legal changes, status of your measures | from €1,050 per management body, net plus VAT |
Offered exclusively to businesses (B2B only). All prices net plus VAT; on site including travel within Germany. After a short scoping call you receive a fixed-price proposal; the 60-minute preparatory call is part of the commissioned service.
How does the training work?
From enquiry to management resolution in six steps.
1
Enquiry and scoping call
You tell us the management body, number of participants, remote or on site and the preferred period. In a short call we clarify scope and setting.
2
Proposal
You receive a fixed-price proposal.
3
Preparatory call
60 minutes with a contact person as part of the commissioned service: classification, services, service providers, status of measures.
4
Pre-read
Sent at least five working days before the date.
5
Training
Four hours (or three in the short version), remotely or on site at your premises.
6
Evidence and follow-up
Certificates of attendance, attendance list, slide deck and resolution template.
We do not offer open dates. We agree the training date with you after the preparatory call.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
How do you evidence the training?
You keep the training documentation internally and present it to the BSI or a body it commissions on request. The BSI guidance names as minimum details the provider or internal function, name and role of the participants, date, time and duration, and the content covered with reference to Section 38(3) BSIG. An examination of participants is provided for neither by law nor by the BSI. We therefore issue a certificate of attendance.
According to the guidance, the documentation proves attendance, not learning success. Whether management has sufficient knowledge shows in whether it takes part in risk management decisions in a traceable way. That is why our deliverables include the template for the management resolution: with it, the documentation that matters is created in the weeks after the training.
What does the BSI say about the training?
The BSI has published two documents (both in German). The guidance “Schulung für Geschäftsleitungen” (version 1.0 of 17 April 2026) requires training to take the specifics of the entity into account, such as critical business processes, governance, risk situation and upcoming decisions. In the BSI’s assessment, purely internal training carries the risk that management cannot independently judge whether processes are adequate.
The curriculum (version 1 of 28 October 2026), developed with associations of the Alliance for Cyber Security, proposes six modules and a shortened variant of about 180 minutes. According to the curriculum, the short version remains complete in the sense of Section 38 if a pre-read of at most ten pages is documented as mandatory. The curriculum plans exercises and tabletop exercises separately from the initial training. It is expressly non-binding; training may also be split into parts.
Who should attend?
All members of management are obliged. The curriculum recommends including people with a significant role in risk management, such as the information security officer or CISO, head of IT, finance, compliance or those responsible for production. Training only the head of IT or the information security officer does not replace training management. Supervisory and advisory boards are not named in Section 38 BSIG; they can attend if they want to oversee management in these duties.
How are training and liability connected?
If management breaches its duties to implement and oversee under Section 38(1) BSIG, it is liable to its entity for culpably caused damage under the company law rules that apply to the legal form (Section 38(2)). Training is a separate duty under subsection 3 and is meant to enable management to fulfil the duties in subsection 1. What consequences a breach has in an individual case is a question for your legal counsel; in the training we explain the rules but do not give legal advice.
What the training is not
To set expectations:
- No certificate as a qualification and no examination. You receive a certificate of attendance; an examination of participants is not provided for.
- Not legal advice. On applicability, liability and insurance questions we give general information; you clarify your individual case with your legal counsel.
- Not staff training. Basic training and awareness under Section 30(2) no. 7 BSIG are a separate measure.
- Not technical in-depth training for IT or the information security officer. The curriculum provides separate modules for that.
- No recognition by the BSI. The BSI does not recommend training providers; we follow its guidance and curriculum.
The information on Section 38 BSIG reflects the act as amended on 22 October 2026 and the BSI documents as retrieved on 6 November 2026. Whether the duty applies to your company has to be assessed case by case.
Frequently asked questions
How often does management have to be trained?+
The act only says “regularly”; for the explanatory memorandum and the BSI’s view, see “What does Section 38(3) BSIG require?” above. After the initial training we recommend an annual refresher, plus training on occasions such as a change in management, and we record the recommendation for your company in writing.
Do we get a certificate?+
No, not as a qualification. Each participant receives a certificate of attendance. An examination of participants is provided for neither by law nor by the BSI, and a qualification certificate would promise more than attendance can prove.
Do all managing directors have to attend?+
According to the BSI, the training duty applies to every person appointed to run the business and represent the entity. If someone cannot attend, a make-up date can be arranged; according to the BSI, training may also be split into parts.
Remote or on site?+
Both. Remotely, the initial training costs from €3,500 net plus VAT; on site at your premises from €3,800 net plus VAT including travel within Germany. We recommend the tabletop exercise on site because the exercise works better in the room.
Do you also train the management of telecoms providers?+
Yes. For operators of public telecommunications networks and providers of publicly available telecommunications services, the training duty follows from Section 165(2d) of the Telecommunications Act (TKG); under Section 28(5) BSIG, Section 38 BSIG does not apply to them. We then align the content with the duties under the TKG and state this legal basis on the certificate of attendance.
Are there open dates?+
No. We only train in-house for your management body, because the training is meant to be tailored to your company. We agree the date after the preparatory call.
Read more
- NIS2 management obligations: Section 38 BSIG and liability
- NIS2 compliance in Germany: implementation for mid-sized firms
- NIS2 gap analysis in three tiers: indication, gap, roadmap
- Section 30 BSIG: the ten NIS2 measures, with a checklist
- NIS2 incident reporting in Germany: Section 32 BSIG deadlines
- NIS2 applicability in Germany: Section 28 BSIG scope check
Sources
- Section 38 BSIG: duties of management to implement, oversee and attend training (German) (retrieved 2026-11-06)
- Section 165 TKG, subsections 2b-2d: duties and training of the management of telecoms providers (German) (retrieved 2026-11-06)
- Section 28 BSIG (subsection 5: exemptions for telecoms and energy network operators; German) (retrieved 2026-11-06)
- BSI: Schulung für Geschäftsleitungen, guidance, version 1.0 of 17 April 2026 (PDF, German) (retrieved 2026-11-06)
- BSI: curriculum for management training under NIS‑2, version 1 of 28 October 2026 (PDF, German) (retrieved 2026-11-06)
- BSI: press release on the curriculum for NIS2 management training, 28 October 2026 (German) (retrieved 2026-11-06)
- BSI: general NIS‑2 FAQ (sections on management and duration; German) (retrieved 2026-11-06)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-06
Get in touch
Request training
Tell us how many people will attend, whether remotely or on site, and in which period. We arrange a short scoping call with you and then send you a proposal.