Security awareness training for SMEs · training free, dashboard from €490 / year
Austria's NISG 2026 applies from 1 October 2026 →

NIS2 training · NISG 2026 · for SMEs

NIS2 training under NISG 2026: train and prove it.

Austria's NIS2 law, the NISG 2026, applies from 1 October 2026. It requires cybersecurity training for your employees and a dedicated training for management. The trainings are free for everyone, and the dashboard documents who completed them. Dashboard and report from €490 per year.

Start NIS2 training free → Sample audit report (PDF, German) → Request the dashboard →
Sample dashboard · fictitious Muster GmbH
For companies · Awareness evidence
Muster GmbH
Domain muster-gmbh.atReference date 21.09.2026Employee list 48 peopleReporting period 01.01.2026 – 21.09.2026
NIS2 Essentials
58 % completed

Basics for all employees: scope, reporting channels, duties in daily work.

NIS2 Essentials v1.228/48

20 people open. Completion: final quiz passed with at least 80 %.

NIS2 Top Management
2 management members trained

Dedicated training for managing directors and board. Shown are the people who completed the training.

EmailCompletedCertificate
anna.fuchs@muster-gmbh.at21.05.2026WG-TM-9C396872
christian.eder@muster-gmbh.at05.04.2026WG-TM-24B24765
Deadlines 1 Oct 2026 in force31 Dec 2026 registration30 Sep 2027 self-declarationfrom 1 Oct 2028 audit possible
What NISG 2026 requires

Two training duties, one proof.

The duties apply from the day the law enters into force, without a transition period. The self-declaration due by 30 September 2027 is a statement about measures that are already running by then.

§ 31 · Management

Dedicated training for management bodies

Managing directors and board members must approve the risk management measures, oversee their implementation and take part in cybersecurity training themselves. The duty applies to each member personally and cannot be delegated to IT.

§ 32 · Employees

Training as part of risk management

Cyber hygiene and training are among the minimum measures. This means the whole workforce, not just IT: whoever opens a phishing email or fails to report an incident decides how much damage is done.

§ 33 · Evidence

Self-declaration and audit

By 30 September 2027 you report the measures in place. From October 2028 the authority can request an audit by an independent body. Then what counts is what you can prove: who completed which training and when.

The NIS2 trainings

For all employees and for management.

Both trainings are free, run in the browser and end with a final quiz. Anyone who passes with at least 80 % receives a certificate with date and certificate ID.

Preview of the NIS2 Essentials training for all employees
NIS2 Essentials · all employees · approx. 15 minutes

NIS2 in daily work

What NIS2 means for everyone: who is in scope, the ten minimum measures, incident reporting deadlines (early warning, notification, final report), the supply chain and your own role. With a country section on Austria.

ReportingMinimum measuresSupply chainQuiz 80 %
Preview of the NIS2 training for management bodies
NIS2 Top Management · § 31 NISG · 20–30 minutes

For managing directors and board

Ten topics on duties and liability: classification, approving and overseeing risk management, reporting obligations, supply chain, registration, supervision and sanctions. Adapted to your level, from a single legal entity to a group holding. Final quiz with 10 questions.

LiabilityGovernanceRegistrationQuiz 80 %

More on the management training →

The trainings cover the EU directive and its implementation in Austria. There is also the general security awareness training on phishing, passwords and safe working, which many companies add as a foundation.

Start NIS2 training free →
Scope

Am I in scope?

Two criteria decide: the sector of your main activity and your company size. On top come companies that are pulled in by their customers.

Directly in scope

18 sectors, medium size and up

For example energy, transport, health, water, digital infrastructure, waste, food, chemicals or manufacturing of medical devices, machinery, vehicles and electronics. Medium size means at least 50 employees, or more than €10m turnover and balance sheet total. Some entities are covered regardless of size.

Indirectly affected

Suppliers and service providers

Companies in scope must ensure the security of their supply chain and pass requirements on by contract and questionnaire. Then you need the evidence for your customers, even if the law does not cover you. The NIS2 trainings can be shown or hidden in the dashboard.

Germany · Switzerland

Different legal bases

In Germany NIS2 applies through the BSI Act, and management must attend training regularly (§ 38 BSIG). NIS2 does not apply in Switzerland; there you mainly need the evidence for EU customers and ISO 27001.

Overview without guarantee, not legal advice. If in doubt, clarify with your chamber or legal adviser. More: NISG 2026: Austria's training obligation · NIS2 and management liability

The evidence

What you can show auditor or authority.

The dashboard shows the status of your entire employee list. You download the audit report as PDF for any reference date: with completion rates, the trained members of management and the mapping to NISG 2026 and ISO/IEC 27001:2022.

Sample dashboard · fictitious Muster GmbH
For companies · Awareness evidence
Muster GmbH
Domain muster-gmbh.atReference date 21.09.2026Employee list 48 peopleReporting period 01.01.2026 – 21.09.2026

Audit report (PDF): dated evidence with report ID and checksum. For ISO 27001 and NIS2 audits, and as proof for suppliers, customers or cyber insurers that require awareness training.

Full version (with email addresses)Short version (no personal data)CSV export
Part 1 completed
85 %
41 of 48 · 7 open
Target 80 % reached
Part 2 completed
69 %
33 of 48 · 15 open
below target 80 %
NIS2 Essentials completed
58 %
28 of 48 · 20 open
below target 80 %
NIS2 Top Management completed
2
2 management members trained · v1.3
Managing directors / board
  • Completion rate per training, based on your employee list, with date and certificate ID per person
  • List of open people, filterable and as CSV, so you can send targeted reminders
  • Starting point and progress: knowledge and self-assessment before and after training
  • Phishing recognition from the exercise, compared with the platform average
  • Management under § 31 NISG 2026: who completed the dedicated training
  • Assessment with next steps, derived automatically from your figures
Sample audit report (PDF, German) → Full version with name list (PDF, German) → CSV export (German) ↓

The report is dated, carries a report ID and SHA-256 checksum and maps the content to NISG 2026 and ISO/IEC 27001:2022. The short version contains no personal data and can be passed on directly. All figures, including the platform average, are sample data of the fictitious "Muster GmbH". The sample files (PDF, CSV) are in German. Knowledge and self-assessment appear only aggregated, from 5 people.

To be clear: the trainings support you with the training duties, and the report documents them. Whether your training concept is sufficient overall is for the auditor or authority to assess. Risk analysis, reporting processes or backups remain your company's own tasks.

How it works

Train today, add the dashboard when you need it.

Your team does not have to wait for a contract. Trainings completed before activation show up in the dashboard. Nobody has to repeat anything.

Step 1 · free

Send the link to your team

Everyone signs in with their company email at training.webguardiola.com. Login by code, no password.

Step 2 · free

Train

Security awareness, NIS2 for all staff and NIS2 for management. Everyone downloads their own certificate.

Step 3 · from €490

Activate the dashboard

Send us a short email and you receive the invoice. After payment we activate your dashboard for your email domain within one business day.

Step 4 · ongoing

Track and prove

Upload your employee list, remind open people, download the audit report for any reference date and pass it on.

Pricing

Dashboard & audit report at a fixed price.

One annual price by company size, no per-seat pricing, no custom quotes. The trainings themselves stay free for everyone.

Package S · up to 25 employees
€490 / year

net · from €19.60 per person

Request package S →
Package M · up to 50 employees
€790 / year

net · from €15.80 per person

Request package M →
Package L · up to 100 employees
€1,490 / year

net · from €14.90 per person

Request package L →
Package XL · up to 250 employees
€2,990 / year

net · from €11.96 per person

Request package XL →

What counts is the number of people on your employee list in the dashboard. Prices plus VAT where applicable.

Included in every package
  • Company dashboard for your email domain(s)
  • Maintain the employee list via Excel or manually
  • Completion status, open people, CSV export
  • Knowledge and self-assessment before and after training
  • Phishing recognition compared with the platform average
  • Audit report as PDF, with and without personal data
What the year brings
  • Add new employees to the list, their status appears automatically
  • Create a new report for any reference date, e.g. before an audit or a customer request
  • Content is updated continuously for new attack methods
  • Annual refresher, as audits usually expect

More than 250 employees or your own LMS (SCORM)? Write to us.

FAQ

Frequently asked questions

The managing directors or board members registered in the commercial register. Each member must complete the training personally. The supervisory board and heads of department are not covered by this dedicated training duty.
The trainings support you with the training duties: training for employees as part of the risk management measures (§ 32) and the dedicated training for management (§ 31). The report documents who completed which training and when. Whether your training concept is sufficient overall is for your auditor or the authority to assess. Risk analysis, reporting processes or backups remain your company's own tasks.
Often yes, through your customers. Companies in scope must ensure the security of their supply chain and ask suppliers whether their staff are trained. You can pass on the short version of the report without personal data. The NIS2 trainings can be hidden in the dashboard.
Yes. All trainings including NIS2 and a personal certificate are free for everyone, privately or at work. Sign up, enter the code from the email, start. Companies only pay for the dashboard with audit report.
Yes. Once the dashboard is activated and your employee list is uploaded, trainings these people already completed appear. Nobody has to repeat anything.
NIS2 Essentials takes about 15 minutes, NIS2 Top Management 20 to 30 minutes. Security Awareness Basics is split into short modules that can be paused at any time. Everything runs in the browser, including on smartphones.
In Germany NIS2 is implemented through the BSI Act, and management must attend training regularly (§ 38 BSIG). The NIS2 trainings cover the EU directive; examples currently refer to Austria. NIS2 does not apply in Switzerland; there you mainly need the evidence for EU customers and ISO 27001.
The dashboard keeps running: add new employees to the list and create the report for each new reference date, e.g. before the next audit. We update the content continuously for new attack methods. Audits usually expect an annual refresher, and the dashboard shows who has done it.

For companies

Request dashboard & evidence

See at a glance who is done, who is still open – and what to show auditors. The training stays free for your employees.

  • Free and without obligation
  • We usually reply within 2 business days
  • Security awareness, NIS2 – or both

Please enter your company.

Please enter a valid email address.

Please choose a package or ‘Not sure yet’.

Interested in

Please choose an option.

We only use your details to handle your request and send you a confirmation of receipt. See our privacy policy.

Security Awareness · Newsletter

Understand threats before they reach your team.

Concise updates on current phishing tactics, awareness practice and new modules. No spam, unsubscribe anytime.