Sec. 38(3) BSIG
NIS2 management board training
For managing directors and executive boards, aligned with the BSI curriculum.
from €249 net per person
Content and prices →Home / Training
Online compliance training · NIS2 · CRA
Mandatory training for NIS2 and the Cyber Resilience Act
Three online courses for management, information security and product development. With knowledge checks, a numbered certificate of attendance and evidence documents that stand up to supervisors and auditors.
The management board training at a glance: core tasks, six modules, format and benefits.
The programme at a glance
The right course for every role
Every course ends with a verifiable certificate. You book individual seats or a team licence for up to five people.
Sec. 30(2) no. 7 BSIG
NIS2 tabletop exercise
For those leading the annual incident response exercise.
from €149 net per person
Content and prices →Regulation (EU) 2024/2847
CRA: SBOM and manufacturer obligations
For product, development and security teams at manufacturers.
from €199 net per person
Content and prices →How it works
Four steps to your certificate, for all three courses
- 01
Book seats
You book seats per course. Your contact person receives access to the training portal.
- 02
Invite participants
Each person receives a personal invitation link, without a password and usable on any device.
- 03
Learn at your own pace
Lessons with knowledge checks, passed from 75%. Progress is saved.
- 04
Receive your certificate
Certificate of attendance as a PDF by email, with a number and online authenticity check.
What is included
- Training portal with participant management
- Numbered certificate, verifiable online
- 12 months of access including updates
- Participant list for printing and as CSV
- German and English (DE/EN switch)
- Portal sign-in with a second factor
Sec. 38(3) BSIG · aligned with the BSI curriculum
NIS2 management board training
Assess cyber risks. Have measures implemented and oversee them. Provide the evidence.
- Scope
- 6 modules
- Lessons
- 49 + 5 optional
- Knowledge checks
- 201 questions
- Duration
- approx. 4 hrs
- Pass mark
- from 75%
Who it is for
Managing directors and board members of important and essential entities. Under Sec. 38(3) BSIG they must attend training regularly. The course teaches oversight competence, not technology.
Process
Preparation on your own company (required) → six modules → certificate → follow-up with board resolutions.
BSIG, NIS2 and scope
Applicability, services, OT, group structures, service providers
Sec. 38 BSIG: duties, liability, delegation
Implement and oversee, fines, business judgement rule
Cyber risks as business risks
Assets, protection goals, risk overview, residual risks
Sec. 30 BSIG as a management system
Ten measures in six areas, register of measures
Registration, reporting, notification
Secs. 32–35 BSIG, 24 h / 72 h, three decision cases
Governance, evidence, transfer
Regular report, BSI audit, key questions, resolutions
Evidence: the certificate of attendance states the person, role, company, period, time spent, results, course version and the reference to Sec. 38(3) BSIG, with all lessons, results and competence mapping in the annex. Authenticity verifiable online.
Prices · 12 months of access including updates
Executive Digital
€249 net per person
- complete digital course
- all modules and knowledge checks
- preparation sheet
- completion confirmation as PDF
Recommended
Executive Compliance
€349 net per person
- everything in Executive Digital
- verifiable certificate of attendance with content record
- training record and participant list
- course material, mapping to the BSI curriculum
Company licence
€1,190 net for up to 5 people
- up to five personal accounts
- individual training record per person
- joint training documentation
- for management or executive board
Executive Governance
€1,790 net for up to 5 people
- everything in the company licence
- register of measures, regular report, board resolution template
- cyber risk key questions and dashboard
- 60-min. personal management consultation
Prices net plus VAT. Aligned with the BSI curriculum for NIS2 management board training; not certified or approved by the BSI.
Sec. 30(2) no. 7 BSIG · Incident response exercise
NIS2 tabletop exercise: plan, run, document
The course for everyone leading the annual tabletop exercise on incident response and contingency planning: from the scenario to an audit-ready exercise record.
- Scope
- 4 modules
- Lessons
- 8
- Knowledge checks
- 31 questions
- Duration
- approx. 50 min.
- Pass mark
- from 75%
Who it is for
Information security officers, IT management and those responsible for emergency and crisis management in important and essential entities. Based on the BSIG as amended by the German NIS2 Implementation Act (NIS2UmsuCG), with Implementing Regulation (EU) 2024/2690 as a guide.
Lessons
- 0.1What a tabletop exercise is and why the BSIG requires it
- 1.1The reporting obligations under Sec. 32 BSIG your exercise must play through
- 1.2Who must take part in the exercise
- 1.3Whoever facilitates does not play
- 2.1A complete scenario: ransomware in the ERP system
- 2.2The hot wash: the debrief that saves the year
- 2.3The exercise record: what auditors read
- 3.1Frequency, final quiz and certificate of attendance
Your benefits
- Plan the exercise on a sound legal basis: participants, roles, reporting deadlines 24 h / 72 h / one month
- A ready-made scenario with injects to replay
- Separate facilitation from playing, and why that counts in an audit
- Hot wash, improvement points and exercise record as evidence
- 11 graphics as templates for your own exercise
Evidence: numbered certificate of attendance with online verification as role-based training for exercise leads under Sec. 30(2) no. 7 BSIG. It does not replace management board training under Sec. 38(3) BSIG.
Prices · 12 months of access including updates
Single access
€149 net per person
- complete digital course
- all knowledge checks and graphics
- verifiable certificate of attendance
Recommended
Team licence
€590 net for up to 5 people
- up to five personal accounts
- certificate per person
- participant list for facilitation and deputies
Tabletop Plus
€990 net for up to 5 people
- everything in the team licence
- 60-min. preparation call on your own exercise scenario
Prices net plus VAT. The course prepares the exercise lead; running the exercise in your company is not included and can be commissioned separately. No legal advice.
Cyber Resilience Act · Regulation (EU) 2024/2847 · BSI TR-03183-2
CRA: SBOM and manufacturer obligations
Create, maintain and evidence software bills of materials, plus the other manufacturer obligations up to CE marking.
- Scope
- 6 modules
- Lessons
- 14
- Knowledge checks
- 63 questions
- Duration
- approx. 100 min.
- Pass mark
- from 75%
Who it is for
Product owners, development teams and security and risk managers at manufacturers of products with digital elements. The reporting obligations under Art. 14 CRA have applied since 11 September 2026, all other obligations apply from 11 December 2027.
Your benefits
- Implement the SBOM requirement under Annex I Part II no. 1
- Understand tools such as cdxgen, Syft, Grype and Dependency-Track
- Reporting chain: 24 h early warning, 72 h notification, final report
- Know the conformity route for each product class
Fundamentals
What an SBOM is and why the CRA requires it
What belongs in an SBOM
Components, PURL, hashes, retention
Formats
CycloneDX and SPDX, VEX, TR-03183-2 requirements
Create and maintain
Pipeline, monitoring, reporting under Art. 14
Other manufacturer obligations
Roles, risk, Annex I, CE, market surveillance
Wrap-up
Summary, next steps, final quiz
Legal basis: Regulation (EU) 2024/2847, the German implementation act (passed by the Bundestag on 15 October 2026, BSI as market surveillance authority) and BSI TR-03183-2. Evidence: verifiable certificate of attendance; it proves the training, not the conformity of a product.
Prices · 12 months of access including updates
Single access
€199 net per person
- complete digital course
- all knowledge checks and graphics
- verifiable certificate of attendance
Recommended
Team licence
€790 net for up to 5 people
- up to five personal accounts
- certificate per person
- participant list for your documentation
CRA Plus
€1,290 net for up to 5 people
- everything in the team licence
- 60-min. assessment of your product: role, product class, conformity route
Prices net plus VAT. The CRA has no personal training obligation; the course supports the implementation of manufacturer obligations. Based on the course “CRA SBOM Fundamentals” from open-isms (AGPL-3.0), revised and extended. No legal advice.
An auditor's view, not standard e-learning
Developed by an IT auditor, not a content agency
Heinrich Markus Schulte, IT auditor and expert for information security and resilience, with more than 30 years of hands-on IT experience. The courses show not only what the law says, but which information, decisions and evidence actually count in an audit.
- CISA
- CISM
- CEH
- CIPP/E
- ISO 27001
- ISO 22301
- BSI 200-1 to 4
Frequently asked questions
Good to know
Is the training mandatory for managing directors?
Under Sec. 38(3) BSIG, the management of important and essential entities must attend training regularly so they can assess cyber risks and risk management practices. Training the IT manager or information security officer does not replace this.
Is the training certified by the BSI?
No. The management board training is aligned with the BSI curriculum for NIS2 management board training. All courses are independent offerings of Sachverständigenbüro Schulte and are not certified or approved by the BSI.
How does participation work?
Each participant receives a personal invitation link, without a password and usable on any device. Progress is saved; a knowledge check is passed from 75%. The certificate of attendance arrives as a PDF by email, with a number and online authenticity check.
Does the tabletop training replace the management board training?
No. The tabletop training is role-based training for exercise leads under Sec. 30(2) no. 7 BSIG. It does not fulfil management's training obligation under Sec. 38(3) BSIG.
Does the CRA require training?
The Cyber Resilience Act has no personal training obligation. The CRA course helps manufacturers implement their obligations, such as the SBOM under Annex I Part II no. 1 and the reporting obligations under Art. 14. The certificate proves the training, not the conformity of a product.
How long is access valid, and are the courses available in English?
Access is valid for 12 months including updates. All three courses are available in German and English.
Request seats
Request training seats
Choose a course and package. You will receive a quote with an invoice; after booking, the office sets up your access to the training portal.
More than five participants or several courses? Just say so in your message.
The courses are independent offerings of Sachverständigenbüro Schulte and are not certified or approved by the BSI. No legal advice.