NIS 2 Foundation study guide
NIS 2 Foundation · Work through your exam, one topic at a time.
The NIS 2 Foundation credential is an entry-level certificate about the EU's NIS 2 Directive, offered by PECB (the Professional Evaluation and Certification Board) as part of its NIS 2 Directive training track. It is aimed at people who need a working vocabulary of the directive rather than hands-on implementation duties: newcomers to cybersecurity compliance, IT and OT staff in essential or important entities, risk and audit staff, and managers who must understand what the directive asks of their organisation. The NIS 2 Foundation study guide has 4 sections and about 1,628 words.
01NIS 2 fundamentals and scope
This domain tests whether you can place the NIS 2 Directive (EU) 2022/2555 in the EU legal framework and decide whether an organisation is in scope, and whether it is essential or important. NIS 2 is a directive, not a regulation: Member States had to transpose it by 17 October 2024, and it repealed Directive (EU) 2016/1148.
396 words, about 2 min02Cybersecurity risk-management measures and obligations
This domain tests Article 21: the risk-based, all-hazards measures that essential and important entities must adopt, and how to apply them proportionately to their exposure. Entities must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems, and to prevent or minimise the impact of incidents.
400 words, about 2 min03Governance, incident reporting and supervision
This domain tests the accountability chain: who owns cybersecurity risk, what must be reported and when, and how authorities supervise and sanction. Under Article 20, the management body of an essential or important entity approves the cybersecurity risk-management measures, oversees their implementation, and is accountable for compliance.
430 words, about 2 min04Conformity, certification and good practices
This domain tests how compliance is evidenced. NIS 2 is outcome-based: it does not create a single 'NIS 2 certificate', but it uses European certification and recognised good practice to support assurance.
402 words, about 2 min