What does the Cybersecurity Act require for staff training?

In brief

The Finnish Cybersecurity Act 124/2025 requires covered organisations to manage cybersecurity risks through current, proportionate and sufficient measures. For staff, the key point is that personnel security and cybersecurity training must be included in the organisation’s risk management operating model under section 9. NIS2 Directive Article 21 says the same idea at European Union level by naming basic cyber hygiene practices and cybersecurity training as required risk management measures. The law does not prescribe one course, one format or one annual training day; it requires training that matches the organisation’s risks and is kept up to date.

Cyber hygiene is safe everyday work

Cyber hygiene means the small working habits that keep systems, accounts and information safer. It is the workplace version of washing hands before handling food. One weak habit can spread harm to other people and services.

In daily work, cyber hygiene can mean that an employee checks a sign-in request before approving it. It can mean that a laptop is locked before leaving a meeting room. It can mean that a suspicious message is reported instead of opened. It can also mean that cloud files are shared only with the right people.

The Cybersecurity Act uses a risk management structure. Section 7 requires an operator to identify, assess and manage risks to the security of communications networks and information systems used in its operations or services. The purpose is to prevent or minimise the effect of incidents on operations, continuity, service recipients and other services.

For staff, this matters because many risks appear during normal work. A password is used by a person. A device is carried by a person. A file is shared by a person. A phone call asking for urgent payment is answered by a person. The law treats these working habits as part of risk management, not as a side topic for the information technology team alone.

NIS2 Directive Article 21 makes this explicit. It lists basic cyber hygiene practices and cybersecurity training among the measures that essential and important entities must include. The Finnish Cybersecurity Act implements the same logic through sections 7, 8 and 9.

Training is part of the risk management operating model, not a separate campaign

The Cybersecurity Act does not present staff training as a one-off awareness campaign. Section 8 requires a current cybersecurity risk management operating model. That model must identify risks to networks, systems and their physical environment. It must also define and describe objectives, procedures and responsibilities.

This means training should connect to the risks the organisation has identified. If employees use cloud services, training should cover safe use of cloud services. If employees work remotely, training should cover devices, remote connections and public networks. If employees handle information that must not be disclosed, training should cover secure handling and transfer.

Section 9 then requires proportionate technical, operational or organisational measures under that operating model. The same section says the operating model and measures must take into account and keep up to date several areas. One of those areas is personnel security and cybersecurity training.

The legal logic is therefore simple:

Legal requirement	What it means in work
Risks must be identified and managed under section 7	The organisation must know which staff actions can create cyber risk
The risk management operating model must be current under section 8	Training cannot be detached from responsibilities, procedures and actual systems
Measures must be proportionate under section 9	Training should match the type and scale of operations and the likely effect of incidents
Personnel security and cybersecurity training must be included under section 9	Staff competence is one of the controls used to reduce cyber risk

Management also has a defined role. Under section 10, the operator’s management is responsible for arranging the implementation and supervision of cybersecurity risk management. Management also approves the cybersecurity risk management operating model and supervises its implementation. This does not mean that management teaches every topic. It means that training must be governed, approved and monitored as part of the overall model.

The management-side obligation is discussed further in NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene.

What staff need to know from the law’s point of view

The Act does not contain a syllabus for employees. It names the risk areas that the organisation must address. Staff training should make those areas understandable in the jobs where they matter.

From section 9 of the Cybersecurity Act and Article 21 of the NIS2 Directive, the main staff topics are these:

• Basic cyber hygiene. Employees need safe daily habits for accounts, messages, devices, files and shared systems.
• Personnel security. People need to know how their role, access and conduct can protect or endanger systems and information.
• Access management and authentication. Employees need to understand how sign-in, access rights and verification reduce misuse.
• Secure communication where needed. Staff need to know which channels are safe for work information when protected communication is required.
• Incident detection and handling. Employees need to recognise when something may be wrong and know the internal handling route.
• Continuity in ordinary work. Employees need to understand their role in backup, recovery, crisis handling or alternative working procedures where those are relevant.
• Information and asset handling. Employees need to know how to handle devices, software, information assets and physical workspaces safely.
• Supply chain awareness. Employees who work with suppliers or service providers need to understand that supplier practices can affect the organisation’s cyber risk.

A useful test is whether training changes behaviour in the systems people actually use. A finance employee may need to recognise manipulation in payment requests. A social services employee may need to handle information securely. A field worker may need to protect a mobile device. A system owner may need to understand access rights and incident handling.

The Act’s risk-based wording matters. Training is not measured only by attendance. It should be tied to the organisation’s identified risks, responsibilities and controls.

Who the requirement covers

The Cybersecurity Act applies to an operator that carries out an activity referred to in Annex I or Annex II, or is an operator referred to in those annexes, and meets or exceeds the conditions for medium-sized enterprises under the Commission Recommendation referred to in section 3. The operator must also offer services or carry out activities in a European Union Member State.

Section 3 also applies the Act, regardless of size, to certain operators. These include providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain name registry operators and Domain Name System service providers.

The Act can also apply regardless of size to an Annex I or Annex II operator where the service is central to maintaining critical societal or economic functions, where disruption would significantly affect public order, public safety or public health, where disruption could cause significant systemic risk, or where the operator is critical because of its particular importance at national or regional level.

For municipalities, the scope is narrower. Section 4 says the Act applies to a municipality only for activities referred to in Annex I or Annex II. A municipality therefore needs to look at each activity separately. The answer is not based only on the legal form of the organisation.

Section 1 also states that implementation of NIS2 for the public administration sector referred to in Annex I point 10 is provided in the Act on Information Management in Public Administration. The Cybersecurity Act still contains the municipal limitation in section 4 for the activities covered by its own scope.

What the law does not require and what remains for the organisation to decide

The Cybersecurity Act does not say that every employee must receive identical training. It does not set a number of training hours. It does not prescribe an exam. It does not name a required training tool. It does not state that training alone is enough to meet the risk management duty.

The Act also does not separate training from other controls. Section 9 includes many areas alongside training, such as access management, authentication, incident handling, backup, recovery planning, crisis management, secure development and maintenance, supply chain security, encryption practices, asset management, physical security and basic information security practices.

This is important for decision-makers. A training record is useful, but it is not the whole risk management model. If employees learn to report suspicious activity but there is no incident handling procedure, the control is incomplete. If employees learn strong sign-in habits but access rights are not managed, the risk remains.

The law leaves several choices to the organisation. The organisation decides which staff groups need which content. It decides how often training is refreshed. It decides how learning is evidenced. It decides how training connects to policies, access rights, supplier work and incident handling. Those choices must still be current, proportionate and sufficient in relation to the risks, as required by section 7 and section 9.

There are also limits on enforcement. Under section 35, an administrative penalty may be imposed for certain intentional or grossly negligent failures, including failures related to risk management, the risk management operating model, required measures and incident reporting. The same section says an administrative penalty cannot be imposed on state authorities, state enterprises, wellbeing services counties or their joint authorities, municipal authorities, independent public law institutions, Parliament’s offices, the Office of the President of the Republic, or the Evangelical Lutheran Church of Finland and the Orthodox Church of Finland and their parishes, parish unions and other bodies.

For operators that can receive a penalty, section 38 sets the maximum administrative penalty for an essential entity at 10,000,000 euros or 2 percent of the operator’s worldwide annual turnover in the preceding financial year, whichever is higher. For an entity other than an essential entity, the maximum is 7,000,000 euros or 1.4 percent of the operator’s worldwide annual turnover in the preceding financial year, whichever is higher.

Evidence of training should connect to risk management

Because the legal duty sits inside risk management, evidence of training should do the same. A decision-maker needs more than a list of names. The useful evidence shows what risk the training addressed, which staff group it covered, when it was completed and how it connects to the risk management operating model.

This matters if a supervisory authority asks how the organisation has implemented section 9. It also matters if a customer asks how the organisation manages cyber risk in practice. A certificate or completion record is stronger when it can be mapped to a legal requirement and to the organisation’s own controls.

The same thinking helps with incident response. Section 11 requires an operator to notify the supervisory authority without delay of a significant incident. The first notification must be made within 24 hours of detecting the significant incident. A follow-up notification must be made within 72 hours. Section 12 requires extra information or an interim report if the supervisory authority asks, and for a long-lasting significant incident an interim report must be given no later than one month after the follow-up notification. Section 13 requires a final report within one month after the follow-up notification, or for a long-lasting incident within one month after handling ends.

Those deadlines show why staff competence matters. If employees do not recognise or escalate suspicious events, the organisation may lose time before detection and handling. Training is therefore not only prevention. It also supports the organisation’s ability to detect, report and recover.

For many workplaces, cyber hygiene training should sit next to other baseline competence areas, such as data protection. The overlap is practical. The same employee who handles personal data may also handle cloud files, sign-in requests and suspicious messages. The data protection angle continues in What data protection skills must every employee have?.