NIS2 and Varhugi
Documented staff security training is one of the core duties under NIS2. This page explains who's covered, what the directive requires for training, and how Varhugi handles the training element. Varhugi helps you organise and document staff security-awareness training as part of your company's security programme. NIS2 makes further demands that the service does not cover.
This page is general guidance, not legal advice.
What NIS2 is
NIS2 (EU Directive 2022/2555) is the EU's network and information security law, replacing the original NIS Directive from 2016. In the EU member states it is already in force. The directive falls under the EEA Agreement, and Icelandic implementation is being prepared through amendments to the Act on the Security of Network and Information Systems (78/2019). The goal is a common security baseline across the countries, and the requirements already reach Icelandic companies through their EU customers.
Who's covered
The directive applies to medium and large entities (typically over 50 staff or €10M turnover) operating in the following sectors:
Essential services
Energy (electricity, gas, district heating), transport, banking and financial services, healthcare, drinking water and wastewater, digital infrastructure, public administration, and space.
Important services
Postal and courier services, waste management, manufacture and distribution of chemicals, food production, manufacturing of certain devices, digital providers (cloud, search, social media), and research.
Smaller organisations outside these sectors are usually exempt, but in practice end up on the hook indirectly when their NIS2-covered customers demand documented training of their suppliers.
What NIS2 says about staff training
Article 21 of NIS2 mandates "systematic risk-management measures" in cybersecurity. Among the explicit items are "basic cyber hygiene practices and cybersecurity training of staff".
In practice that means:
- Regular (not one-off) cybersecurity training for staff.
- A documented record of who trained on what, and when.
- Evidence that auditors and regulators can verify.
- Specific accountability for leadership, they can be personally liable for compliance with the duty.
How Varhugi handles the training element
Monthly modules
Five-minute modules in Icelandic, automatically rolled out to staff. No implementation. No LMS cost.
A documented certificate per employee
Every completion produces a verifiable certificate that auditors and customers can check on a public page (varhugi.is/verify), without us being in the loop.
An audit-ready PDF report on one click
A monthly PDF that summarises the training status of all staff in the period. Ready to hand to your auditor or regulator.
Automated reminders
You don't have to chase anyone. Reminders go out before due date, after due date, and once training on a topic is over 12 months old.
How Varhugi answers the NIS2 requirements
The table connects the directive's requirements on staff training and awareness to what Varhugi does and what you can hand over when asked.
| Requirement | What Varhugi does | Evidence |
|---|---|---|
Basic cyber hygiene practices and cybersecurity training of staff Article 21(2)(g) | Short modules in Icelandic on passwords, phishing, two-factor authentication, AI and more, assigned automatically to all staff or chosen departments. | The audit report shows who completed which module, when, and with what score. |
Training that is ongoing, not a one-off Article 21, risk management as a continuous process | A new module every month with a due date, automatic reminders and refreshers after incidents. | The report period is free, so continuous training can be shown over a quarter or a year. |
Records of who has completed training The operator's burden of proof towards supervision | Every passed quiz issues a certificate with a verification code and date. | Each certificate can be verified at varhugi.is/verify/{code} without signing in. |
Evidence an auditor or supervisory authority can review Supervision and audits, Articles 32 and 33 | A PDF audit report with a summary and one line per employee and module, plus a CSV export. | The report itself. A sample with fictional data is below. |
Accountability and training of management bodies Article 20(2) | Managers take the same modules as staff, and the dashboard shows the compliance rate, a department comparison and who is behind. | Every manager's status appears in the report like everyone else's; the dashboard shows the state at any time. |
Incident handling and awareness of reporting Article 21(2)(b) and Article 23 | A module on first response after a security incident and how to report it, and refreshers sent to an individual after an incident. | The certificate for the incident module and the refresher recorded on the employee with a date. |
References are to NIS2, Directive (EU) 2022/2555. National implementation can add requirements; have a lawyer confirm which provisions apply to your company.
The audit flow
- 1.You open the dashboard and click "Download audit report".
- 2.You get a PDF, staff list, completed modules, dates, scores, and a summary of the overall status.
- 3.The auditor receives the file. Every certificate referenced is independently verifiable at varhugi.is/verify/{code}, no further data exchange needed.
Want to see the report before creating an account? The sample is produced by the same engine as real reports, with a fictional company and fictional people. View a sample report (PDF)
Get started today
Everything you need to start is on this site: pricing, FAQ and setup guides for IT. Setup is self-service and takes a few minutes. If anything is missing, we answer email within one business day.