How often do I need to retake an awareness training course to remain DORA-compliant?

The Digital Operational Resilience Act (DORA) does not prescribe a specific frequency, but it does state that awareness and training must be an ongoing process. A one-time training session is not sufficient. This is how you remain compliant and strengthen your digital resilience: Regular repetition Cyber threats and operational risks are constantly changing. That’s why training sessions must be repeated periodically—at least annually—supplemented with brief updates or simulations. Updates Following Incidents DORA requires that training be updated immediately following significant IT incidents. This allows your organization to learn from events and keeps knowledge current. Additional training in response to changes Introduce extra sessions when major changes occur, such as new systems, software, or processes. This prevents employees from falling behind on technological developments. Role-based and dynamic content Training must be tailored to the employee’s role. IT specialists need different updates than front-office teams. This ensures the program remains relevant and effective. In short: DORA requires a continuous awareness program that adapts to the threat landscape and your risk profile. This way, you comply with the law and build a culture of digital resilience.

Is cybersecurity awareness mandatory under NIS2?

Yes. NIS2 explicitly requires that both staff and management be involved. Employees Mandatory training and awareness campaigns Management Gaining knowledge, overseeing operations, and approving measures. Non-compliance may result in personal liability.

How often do I need to repeat awareness training to remain NIS2-compliant?

The NIS2 Directive does not specify an exact frequency, but one thing is clear: a one-time training session is not enough. Cyber threats are constantly evolving, so awareness must be an ongoing process. This is how you stay compliant and reduce your risks: Regular refresher training Cyberattacks evolve rapidly. That’s why training shouldn’t be a one-time event but should be repeated regularly. Consider annual sessions supplemented with short updates. Periodic refresher courses Employees must be trained periodically to stay informed about new threats and security risks. This keeps awareness up to date. Additional training when changes occur Introduce additional training sessions when major changes occur, such as new software, systems, or processes. This prevents knowledge from falling behind technological developments. Focus on Risk Awareness Training should not only impart knowledge but, above all, raise awareness. Employees must understand why cybersecurity is crucial and how their behavior directly impacts the organization’s security. In short: NIS2 requires a continuous awareness program that evolves with the threat landscape. This way, you comply with the Duty of Care and build a strong human firewall.

How do we ensure that employees truly participate in the awareness program?

Engaging employees in cybersecurity awareness requires more than just mandatory training. It’s about changing behavior and embedding awareness into daily practice. This way, we ensure that your organization isn’t just compliant, but also operates more securely: Relevant and role-based content Training sessions are tailored to the employee’s role. An IT specialist is presented with different scenarios than an HR employee. This makes the program feel useful and applicable. Interactive formats and gamification No boring e-learning—just short modules, quizzes, and phishing simulations. This boosts engagement and makes learning both fun and effective. Continuous repetition and updates Awareness isn’t a one-time effort. We offer periodic refresher courses and up-to-date content in response to new threats or following incidents. This keeps knowledge current. Management involvement and leading by example Managers complete the same awareness training and actively communicate its importance. This builds support and demonstrates that cybersecurity is a top priority. Measurable results and feedback We monitor participation, scores, and incident reports. Reports not only demonstrate compliance but also identify areas for improvement. This allows you to demonstrate that the program is effective.

Cybersecurity Services » Awareness

From technical implementation to behavioral change: we guide your organization

Awareness

A cybersecurity awareness program often fails not because of its content, but because of a lack of buy-in, poor communication, and a lack of integration with systems. Without proper guidance, awareness and behavioral change will not occur.

We’ll guide your organization through the rollout of a security awareness program that aligns with your culture, systems, and workflow. This way, you’ll have a program that truly contributes to cybersecurity awareness.

More than just a platform

Getting Started with Impact

We ensure that your cybersecurity awareness program doesn’t stall after the first module. We keep employees engaged with an introductory video, review challenges, and updates. Our consultants guide you from launch to full implementation.

Benefits for Your Organization

Strategic Guidance for Lasting Impact

A successful cybersecurity awareness program starts with buy-in. We foster internal enthusiasm, engage team leaders, and ensure targeted communication. In this way, we build awareness step by step and embed cybersecurity best practices in your organization for the long term.

Seamless technical integration with your systems

We link the security awareness platform to the company account so that employees can log in securely and with confidence via Microsoft, Google, or SURF. Employees can start the e-learning awareness modules right away, and you can easily track participation and progress.

Compliance with a key requirement of NIS2 and DORA

With our awareness platform, you can easily meet the legal requirements of DORA and NIS2. We offer comprehensive training and awareness programs tailored to specific roles and risks. This helps you reduce human error, strengthen your digital resilience, and demonstrate compliance to regulators.

Varied and appealing

In an engaging, interactive way, your employees will learn everything they need to know about information security and data protection. Our cybersecurity awareness e-learning program consists of short videos and quizzes on a variety of topics.

Each department has its own learning path

80% of our modules consist of lessons that are relevant to all your employees. However, some roles or departments require more specialized knowledge—such as IT professionals, executives, and financial specialists. For these groups, we offer separate learning paths.

You decide at what pace your employees are offered new modules. So during busy periods or vacations, you can temporarily put the program on “pause.”

Earn badges and foster a sense of competition

The Scoreboard

Gamification makes security awareness both fun and effective. Our Awareness Platform encourages employees to complete modules through badges, leaderboards, and personalized progress tracking. This fosters engagement, competition, and behavioral change—exactly what’s needed to truly embed secure digital work practices.

With CISO Services

Expand

Through our CISO services, we provide additional expertise to strategically guide your program. Our CISOs assess progress, identify risks, and advise on next steps. With our CISOs, you gain additional expertise, save time, strengthen your impact, and enhance your organization’s digital resilience.

Compliance with Laws and Regulations

Compliance with NIS2
The NIS2 Directive requires organizations to raise employee awareness of cyber threats. Our awareness service helps employees stay alert and act securely. This includes recognizing phishing attempts, using strong passwords, and preventing data breaches. With our awareness service, you can ensure compliance with the NIS2 Directive.

Support for ISO 27001 and NEN 7510
ISO 27001 and NEN 7510 set clear requirements for information security and awareness. Our approach is fully aligned with these standards. We offer modules, reports, and communication tools that help you demonstrate that you are systematically working toward behavioral change. This ensures you are well-prepared for audits and certification processes.

Compliance with DORA
The Digital Operational Resilience Act (DORA) requires financial organizations to raise employee awareness of IT risks. Our awareness service helps you meet this requirement with targeted training and programs. With our awareness service, you can ensure compliance with the DORA regulation.

Frequently Asked Questions About Cybersecurity Awareness

Our specialists have compiled a list of frequently asked questions for you. If your question isn't listed here, please contact us.

The Digital Operational Resilience Act (DORA) does not prescribe a specific frequency, but it does stipulate that awareness and training must be an ongoing process. A one-time training session is not sufficient. This way, you remain compliant and strengthen your digital resilience:

Regular Refresher Training
Cyber threats and operational risks are constantly changing. That is why training sessions must be repeated periodically—at least once a year—supplemented with brief updates or simulations.

Updates Following Incidents
DORA requires that training programs be updated immediately following significant IT incidents. This allows your organization to learn from these events and keeps knowledge up to date.

Additional Training During Changes
Introduce additional sessions when major changes occur, such as new systems, software, or processes. This prevents employees from falling behind on technological developments.

Role-Based and Dynamic Content
Training programs must be tailored to the employee’s role. IT specialists need different updates than front-office teams. This ensures that the program remains relevant and effective.

In short: DORA requires an ongoing awareness program that adapts to the evolving threat landscape and your risk profile. This way, you comply with the law and build a culture of digital resilience.

The Digital Operational Resilience Act (DORA) requires financial organizations to strengthen their digital resilience. Awareness is not a secondary consideration here, but a mandatory measure within the IT risk management framework. A well-designed awareness program can help your organization remain compliant:

Compliance with Legal Requirements
DORA requires that all employees and management receive regular training in digital operational resilience. An awareness program ensures that these training sessions are structured, verifiable, and role-specific.

Reducing Human Error
Many incidents are caused by human actions: clicking on phishing links, using weak passwords, or using unsecured devices. Awareness training teaches employees to recognize and prevent these risks. This reduces the likelihood of data breaches and fines.

Support for Mandatory Reporting and Governance
DORA requires the prompt and accurate reporting of serious IT incidents. Through awareness training, employees know exactly how and where to report incidents, which is crucial for compliance with reporting requirements. In addition, a formal awareness program provides demonstrable evidence to regulators and management.

In short: an awareness program is not just a compliance tool, but a strategic investment in business continuity and trust. This way, you comply with DORA and strengthen your organization’s resilience.

Operational Risk Management
Minimize human error

Incident Reporting Well-trained employees report incidents more quickly

Culture of Resilience
Awareness embeds digital security within the organization

Yes. DORA requires financial entities to incorporate awareness and training into their IT risk management framework.

Comprehensive “
” Programs For all employees and management

Role-specific content
Tailored to your role

’s Administrative Insights Management Must Understand and Oversee IT Risks

Yes. NIS2 explicitly requires that both staff and management be involved.

Employees Mandatory training and awareness campaigns

Management
Gain knowledge, monitor compliance, and approve measures. Non-compliance can result in personal liability.

The NIS2 Directive does not specify an exact frequency, but one thing is clear: a one-time training session is not enough. Cyber threats are constantly evolving, so awareness must be an ongoing process. This way, you remain compliant and reduce your risks:

Regular Refresher Training
Cyberattacks are evolving rapidly. That is why training should not be a one-time event, but should be repeated regularly. Consider annual sessions supplemented with brief updates.

Periodic Refresher Courses
Employees must receive periodic training to stay informed about new threats and security risks. This keeps their awareness up to date.

Additional Training During Changes
Introduce additional training sessions when major changes occur, such as new software, systems, or processes. This will help ensure that knowledge keeps pace with technological developments.

Focus on Risk Awareness
Training programs should not only impart knowledge but, above all, raise awareness. Employees need to understand why cybersecurity is crucial and how their behavior directly impacts the organization’s security.

In short: NIS2 requires an ongoing awareness program that adapts to the evolving threat landscape. This way, you fulfill your duty of care and build a strong human firewall.

The NIS2 Directive makes cybersecurity awareness a mandatory measure. It is no longer just a “nice-to-have,” but a legal requirement under the duty of care. A well-designed awareness program helps your organization in three crucial ways:

Implementation of organizational measures.
NIS2 requires organizations to implement appropriate technical, operational, and organizational measures. Awareness falls under the latter category. A structured program allows you to demonstrate that you are actively working on risk management.

Reducing Human-Related Risks.
Many incidents are caused by human actions: clicking on phishing links, using weak passwords, or using unsecured devices. Awareness training teaches employees to recognize and prevent these risks. This reduces the likelihood of data breaches and fines.

Support for mandatory reporting and governance.
NIS2 mandates 24-hour reporting of serious incidents. Through training, employees learn how to report an incident immediately and correctly. In addition, a formal awareness program provides demonstrable evidence to regulators and management.

In short, an awareness program is essential for achieving NIS2 compliance and systematically strengthening your organization’s cyber resilience.

Yes, the approach is tailored to your industry. We'll provide relevant modules and a schedule.

Yes, there is seamless integration with existing LMS, HR, or intranet systems. This allows employees to easily begin their awareness training and enables administrators to monitor participation.

Engaging employees in cybersecurity awareness requires more than just mandatory training. It’s about changing behavior and embedding awareness into daily practice. This is how we ensure that your organization is not only compliant but also truly operates more securely:

Relevant and role-based content
Training courses are tailored to the employee’s role. An IT specialist is presented with different scenarios than an HR employee. This ensures the program feels useful and applicable.

Interactive formats and gamification
No boring e-learning—just short modules, quizzes, and phishing simulations. This boosts engagement and makes learning both fun and effective.

Ongoing review and updates
Awareness is not a one-time effort. We offer periodic refresher courses and up-to-date content in response to new threats or following incidents. This ensures that knowledge remains current.

Management Commitment and Leading by Example
Managers complete the same awareness training and actively communicate its importance. This builds support and demonstrates that cybersecurity is a top priority.

Measurable Results and Feedback
We monitor participation, scores, and incident reports. Reports not only show compliance but also identify areas for improvement. This allows you to demonstrate that the program is effective.

We guide organizations through the full implementation of a cybersecurity awareness program. This includes technical integration, communication consulting, engagement campaigns, and support for adoption and sustainability.

We're happy to work with you to find a solution

Ready to raise your awareness?

Would you like to know how we can help your organization improve cybersecurity awareness? Human behavior remains the primary cause of successful cyberattacks. Insufficient knowledge and a lack of risk awareness increase the risk of incidents. We can help you change that. Contact us for a no-obligation consultation.

Would you like to learn more about Managed Services?

Let our specialists help you

Does this sound familiar in your situation? Would you like to learn more about how to optimize, make more sustainable, and secure your business processes related to printing and scanning? Get in touch and let our specialists help you set up these processes to be future-proof.