NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene

In brief

NIS2 is the EU's cybersecurity regulation, transposed in Finland by the Cybersecurity Act (124/2025) in April 2025. The Act covers essential and important entities from energy and water to healthcare and public administration. On training it says two things: the entity's management must itself gain sufficient competence in cybersecurity risk management and oversee it, and staff cyber hygiene and training is one of the minimum risk-management measures. Failure can lead to an administrative fine, and management is personally responsible for meeting the obligations.

What NIS2 is and how it came to Finland

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaced the 2016 NIS Directive, extended the scope to new sectors and harmonised the obligations across the Union. Member states had to transpose it by 17 October 2024.

In Finland the directive was transposed by the Cybersecurity Act (kyberturvallisuuslaki, 124/2025), which entered into force on 8 April 2025. The Act provides for risk management, incident reporting, supervision and penalties, and replaced the earlier sector-specific rules with one general act. Supervision is coordinated by the Finnish Transport and Communications Agency Traficom and its National Cyber Security Centre; sector authorities such as the Energy Authority and Valvira supervise their own fields.

Who the Act covers

The Act divides entities into essential and important. The division follows sector and size: essential entities are typically large entities in sectors of high criticality, important entities medium-sized ones and those in other critical sectors. The size threshold is as a rule the medium-sized enterprise, that is at least 50 employees or 10 million euros in turnover, but in some fields the obligations apply regardless of size.

There are more than ten sectors. Sectors of high criticality include energy, transport, banking and finance, health, drinking water and waste water, digital infrastructure, ICT service management and public administration. Other critical sectors include postal services, waste management, chemicals, food, manufacturing and research.

For the public sector the question is often: does this apply to a municipality? Central government bodies are in scope. A municipality is not named as an entity as such, but a municipality's or joint authority's activity falls under the Act when it operates in a listed sector: a water utility, an energy company, a port. Wellbeing services counties are covered as healthcare entities. The line is best drawn function by function, not by the name of the organisation.

The Act has effect outside its scope too: an essential entity must manage the risks in its supply chain, and it passes the requirements on into contracts. A small IT supplier or an engineering office meets NIS2 as its customer's contract terms.

Management's obligations: approve, oversee, train

Article 20 of the directive and the Cybersecurity Act place the obligations specifically on the entity's management, not on the IT department. Management must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable if the obligations are not met.

On training the directive says that members of the management bodies are required to follow training, and that the entity shall encourage similar training for its employees on a regular basis. The aim is stated: management must be able to identify risks and assess risk-management practices and their impact on the entity's services.

This changes the nature of cybersecurity training. It is no longer the IT department's matter that management approves in the budget, but management's own obligation whose fulfilment has to be shown. A board member who has not completed the training is, from the Act's point of view, a gap in itself.

Cyber hygiene and training as a risk-management measure

Article 21(2) of the directive lists ten measures every entity must implement as a minimum. One of them is basic cyber hygiene practices and cybersecurity training. The other nine are risk analysis and information system security policies, incident handling, business continuity and backup, supply chain security, security in acquisition and maintenance of systems, assessment of the effectiveness of measures, cryptography, human resources security and access control, and multi-factor authentication.

Training is the only item on the list aimed at every employee. Basic cyber hygiene means everyday things: passwords and multi-factor authentication, updates, recognising phishing, handling devices and data, reporting an incident. Most real breaches start from these, not from a vulnerability in a system.

That is also why training is the hardest measure to prove. A policy is a document, encryption is a setting, but training is an event that has to be repeated for every new employee and again when the threat changes. An entity whose only evidence is a training day two years ago cannot show regularity.

Supervision and penalties

The supervisory authority can carry out inspections, request reports and issue orders to correct deficiencies. Essential entities are supervised proactively, important entities after the fact, for example on the basis of an incident or a report.

The maximum fines come straight from the directive: for an essential entity up to 10 million euros or 2 per cent of worldwide annual turnover, whichever is higher; for an important entity up to 7 million euros or 1.4 per cent. The Cybersecurity Act provides for a corresponding administrative fine in Finland.

Management liability is the new layer. The directive requires that members of the management body can be held liable for breaches of the risk-management obligations, and gives the authority means directed at persons, not only at the organisation. Meeting the training obligation is therefore in management's own interest, not only the organisation's.

How to meet the training obligation and show it

1. Management gets its own training. The Act's scope and obligations, the risk-management framework, the ten measures, incident reporting deadlines and management's own liability. Completion is recorded for each member.
2. The whole workforce gets cyber hygiene. Phishing and social engineering, passwords and multi-factor authentication, secure remote work, malware, data classification and reporting an incident. Examples from the organisation's own work, not generic slides.
3. Roles get deeper competence. Risk analysis, continuity and supply chain for IT and security staff; supplier requirements for procurement; human resources security for supervisors.
4. Regularity is built in. Training is not an annual event but continuous: a new employee gets it on starting, and it comes back to everyone as review when the threat picture changes. Microlearning is a natural form for this, because it is regular by nature.
5. The evidence is ready before it is asked for. Who completed what, when, and with what result. An exam separates the trained from the viewer. When the supervisor asks for a report, it is printed, not compiled.

The last point is where the Cybersecurity Act and the AI Act's literacy obligation meet. Both end up asking the same thing: how does the organisation make sure its people know, and how does it show it. One training system answers both, if it records every step.