Security awareness: training and evidence

This guide shows what the rules actually require, how to set up phishing exercises fairly and with the works council, and what an auditor wants to see. The examples are invented.

What the law and the standard require

§ 30(2) no. 7 BSIG (German BSI Act): Particularly important and important entities need basic training and awareness measures in IT security. The European source, Art. 21(2)(g) NIS2 Directive, speaks of basic cyber hygiene practices and cybersecurity training.
§ 38(3) BSIG: The management body must take part in training regularly, so that it can identify and assess risks and risk management practices. This applies to every member personally.
Art. 20(2) NIS2 Directive: Member states encourage entities to offer similar training to all employees on a regular basis.
Implementing Regulation (EU) 2024/2690, Annex no. 8: For certain digital services, such as cloud, data centers and managed services, the European Commission spells out the program in more detail: recurring, also for new staff and the management body, role-based training and an assessment of its effectiveness. For everyone else it is a good benchmark.
ISO/IEC 27001:2022: clauses 7.2 (competence) and 7.3 (awareness) and control A.6.3 in Annex A on information security awareness, education and training. For competence the standard asks for documented information as evidence.

The BSI offers practical help free of charge: the IT-Grundschutz module ORP.3 "Sensibilisierung und Schulung zur Informationssicherheit" (awareness and training in information security) describes the requirements for a training program.

The program in five building blocks

Set the target groups. All staff, plus roles with more responsibility: administration, development, purchasing, HR, maintenance and the management body. Contractors with access to your systems belong in it too.
Choose the content. Phishing and social engineering, passwords and MFA, handling data, mobile devices, reporting incidents. Every training should say where and how staff report a suspicion.
Plan the rhythm. An introduction when people join, a refresher at least once a year, and extra sessions after an incident or a new threat. The rules give no fixed frequency; you set "regularly" yourself and give your reasons.
Mix the formats. Short e-learning units for office workplaces, briefings at the start of a shift for production, a workshop or tabletop exercise for management.
Measure effectiveness. Pass rate in the final test, reports of suspicious emails, results of exercises, always as totals. Record what you change as a result.

Who needs what: a sample plan

Target group	Content	Rhythm	Evidence
All staff	Basic course: phishing, passwords and MFA, data, reporting	When joining, then yearly	Participation per person with date and test result "passed"
Production without a PC workplace	Short briefing: USB sticks, remote maintenance, reporting	Yearly, at the start of a shift	Signature list with date and content
Administration and development	Role training: hardening, permissions, secure development	Yearly and with new systems	Certificate or confirmation of attendance
Management body	Identifying and assessing risks, duties under § 38 BSIG	Regularly, at least yearly recommended	Participation per member with date and topic
Contractors with access	House rules, reporting	Before first access	Acknowledgment or contract clause

Planning phishing exercises fairly and lawfully

Simulated phishing emails make awareness measurable. They also touch labor law and data protection, so plan them like a small project.

Works council: Where a works council exists, it has a right of co-determination under § 87(1) no. 6 BetrVG (German Works Constitution Act) when a technical system is designed to monitor the conduct or performance of employees; under the settled case law of the Federal Labor Court, objective suitability for monitoring is enough. A tool that records clicks typically falls under this. Agree on purpose, evaluation and retention in a works agreement before the first email goes out. In the public sector the applicable staff representation law applies.
Data protection: Set the purpose, legal basis and retention period, and involve your data protection officer. Store only what the purpose needs (data minimization, Art. 5(1)(c) GDPR). Check whether a data protection impact assessment under Art. 35 GDPR is required.
Nobody is put on the spot: No lists of names for supervisors, no employment consequences for a click. Whoever clicks lands on a short learning page. Whoever reports gets praise.
Totals, not people: Evaluate by department or site, with a minimum group size so that nobody can be identified.
Announce openly: Say that exercises take place, without giving the date. That builds trust and does not spoil the learning effect.

The most important figure is not the click rate but the reporting rate: how many people report a suspicious email, and how quickly?

Example from industry

The example is invented. A machine builder with 420 employees in three shifts falls under NIS2. So far there was one presentation in January and a spreadsheet nobody kept up to date.

Basic course: 180 employees with a PC learn online in short units; 240 in production get a 20-minute briefing at the start of their shift.
Management body: Both managing directors take part in a tabletop exercise on a ransomware attack.
Phishing exercise: Under a works agreement, four exercises run per year. Results are evaluated only by department, from ten people up.
Result after one year: The reporting rate rises from 9 to 31 percent. The auditor sees date, content and status for every person.

What an auditor wants to see

One program: target groups, content, rhythm and owners, approved by management.
Assignment: Who has to complete which training by when?
Participation per person: date, content or version of the training and, for tests, the result "passed".
Validity: When does a training expire, and who is overdue?
Management body separately: participation of every member, not one collective entry.
Effectiveness: key figures as totals and the improvements that followed.

A folder of certificates and a spreadsheet can do this. It gets tedious as soon as people join and leave, deadlines expire and several sites report in.

Checklist

Target groups and roles with greater training needs are set.
The program is written down and approved by management.
Every training names the reporting point for incidents.
New staff are trained when they join.
The refresher rhythm is set and justified.
Every member of the management body is trained, with a dated record.
Phishing exercises are agreed with the works council and data protection.
Results are evaluated as totals only.
Participation, validity and overdue people can be retrieved at any time.

Awareness and evidence in Complass

No more attendance lists in Excel and certificates in inboxes. In Complass, training and evidence come together in one place:

Basic course: You assign the awareness basic course of the Complass Academy to everyone, a department or individual people, with a due date. Employees learn with their own access, which does not take up a portal user seat.
Completion and refresher: final test, certificate of participation as a PDF and a new round after twelve months, with a reminder before it expires. The lessons name your reporting point.
Training record: who needs which training, who has it and what is expiring, on one page, as PDF or Excel. Administrators see the status, not the test results of individuals.
Your own and external trainings: You record classroom sessions and certificates from other providers per person with date, validity and file, also by CSV import.
Management body: The training under § 38(3) BSIG appears as its own row and feeds into the management duties record.
Phishing results: You import the CSV report of your phishing tool as evidence. Complass stores only totals per campaign, never names. With fewer than five recipients only the number of emails sent is kept.
Filing in the catalog: You file the training record at ISO 27001 A.6.3 or in the NIS2 catalog.

Management duties record in the cockpit of the demo company with period, trainings and PDF creation — Management duties record: decisions, oversight and trainings as a PDF.

Frequently asked questions

How often do we have to train?

Neither the BSIG nor NIS2 names a frequency. An introduction when people join and a yearly refresher are common and easy to justify, plus trainings for a reason, for example after an incident.

Does management really have to take part itself?

Yes. § 38(3) BSIG is addressed to the management body itself. Being represented by the CISO or IT is not enough.

May we evaluate who clicked?

Legally that depends on the works agreement, the purpose and the legal basis. For the learning effect you do not need it. Totals per department show where to retrain without putting anyone on the spot.

Is one e-learning course enough for everyone?

For office workplaces often yes. You reach employees without a PC workplace better with short on-site briefings. Roles with more responsibility need additional in-depth training.

Do certificates from external providers count?

Yes, if content and date fit the role. Record provider, date, validity and the certificate per person.

In a demo we use the demo company to show you how assignment, course and evidence add up to a picture that auditors and management understand.

Request a demo Try it for 14 days

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case, in particular not the labor and data protection review of phishing exercises. The current wording of the BSIG, the BetrVG and the GDPR and your licensed edition of ISO/IEC 27001 are authoritative. As of November 2026.

Security awareness: training and evidence under NIS2