ISO 27001 Employee Training and NIS2: Managing Human Risk

ISO 27001, NIST and SOC 2 are frameworks that approach information security from different angles. What they share is that all three treat employee awareness and training as a required part of security management. The EU's NIS2 directive takes this a step further and requires members of management bodies to receive cybersecurity training as well. In this article we look at how these frameworks differ, where human risk fits in them, and who NIS2 affects.

ISO 27001, NIST and SOC 2: which one when?

NIST Cybersecurity Framework
A comprehensive risk management model, widely used in energy, finance, healthcare, government and critical infrastructure. Its strengths are risk assessment, maturity measurement and mapping technical controls.

ISO 27001
The internationally recognised standard for information security management systems. It is used in many sectors, including technology, finance, healthcare and manufacturing. It aims to build an organisation-wide management system and ensure consistent policies and processes. Because it can be certified, it provides strong proof of trust in supplier and customer relationships.

SOC 2
Preferred especially by companies offering SaaS and cloud-based services. It stands out in customer audits, in building trust during sales and in verifying operational controls.

In short:

Framework	Focus	For whom
NIST	Risk framework	Critical infrastructure, government, regulated sectors
ISO 27001	Management system	Organisations of every size and sector
SOC 2	Operational and trust assurance	SaaS and cloud service providers

Is employee training mandatory under ISO 27001?

Yes. Under competence and awareness, ISO/IEC 27001:2022 requires employees to be aware of the information security policy, their own contribution and the consequences of non-conformity. Among the Annex A controls, information security awareness, education and training also appears as a separate control.

Questions commonly asked in audits:

Do you have an awareness programme, and how often does it run?
Is the content tailored to employees' roles and risks?
How do you measure the programme's effectiveness?
Where are the records?

Phishing simulations give a concrete answer to the question "how do you measure effectiveness?" in particular.

NIS2: management bodies must be trained too

In Article 20, the EU's NIS2 directive places direct responsibility on management bodies:

Management bodies must approve cybersecurity risk management measures and oversee their implementation.
Members of management bodies must receive training so they can identify risks and assess practices.
Management bodies can be held liable for infringements of these obligations.

The details depend on each EU country's national legislation. The direction is clear: cybersecurity is now on the board's agenda.

Who does NIS2 affect?

NIS2 applies directly to organisations of a certain size in the sectors listed in the directive that operate in the EU. Its indirect effect reaches much further:

Suppliers to EU companies: organisations covered by NIS2 must manage risks in their supply chain, so they will expect similar security measures from their suppliers, including those outside the EU.
Supplier questionnaires: questions about employee awareness and management-level training will appear more and more often in contracts and supplier assessment forms.
Groups with EU subsidiaries: groups that apply common policies across their companies may face this expectation directly.

Why is human risk critical in compliance?

In all three frameworks and in NIS2, human behaviour matters as much as technical controls, because a large share of breaches start with an employee clicking, sharing or skipping a process. A one-off training session held to obtain certification may help you pass the audit. It will not make sure employees act correctly during a real attack.

An effective approach combines:

Role-based awareness content
Regular phishing simulations
Dedicated sessions for executives and the board
Records and trend reports you can present in an audit

Frequently asked questions

How often should awareness training be given for ISO 27001?

The standard does not set a specific frequency. But training is expected to be regular and planned, and repeated at onboarding and on role changes. A single annual session is generally not considered enough.

Which companies does NIS2 cover?

Organisations of a certain size in the sectors listed in the directive that operate in the EU. Companies outside the EU are mostly affected indirectly, as suppliers.

Is awareness training required for SOC 2 too?

Yes. Security awareness training and its records are among the controls most often examined in SOC 2 audits.

---
InfoLore provides documented awareness programmes for ISO 27001, SOC 2 and NIS2, as well as board-level cybersecurity training. Get in touch to discuss your compliance preparation.

ISO 27001, NIST, SOC 2 and NIS2: Managing Human Risk in Compliance