Courses built on the same work we do every day as CISOs, CSIRT contacts and auditors: regulations read from the text, examples taken from real incidents, exercises on the company’s own processes. We run them in the classroom or remotely, for company groups or as open courses.
NIS2 requires management bodies to follow training on cybersecurity. These courses are designed for those who must approve the measures and answer for them.
What Legislative Decree 138/2024 requires of management bodies, responsibilities and fines, what to approve and how to follow its implementation, what happens in the first hours of an incident.
For: board members, directors, general management
Indicative duration: half a day
If the company’s products fall within the regulation, what changes for design, support and CE marking, which obligations already apply and which costs to plan for.
For: senior management, product managers, sales managers
Indicative duration: half a day
Practical courses for those who manage security, systems, suppliers and compliance.
Entity qualification, baseline security measures, governance, relevant suppliers, notification of significant incidents and documents to have approved, with examples of evidence.
For: CISOs, IT and compliance managers, CSIRT contacts
Indicative duration: one day
From detection to the final report: classification, who decides, timing and content of NIS2, PSNC, Cyber Resilience Act and GDPR notifications, internal and external communication.
For: CSIRT contacts, IT, legal, DPO, communications
Indicative duration: half a day with an exercise
Product classification, essential requirements of Annex I, SBOM, vulnerability handling and disclosure, support period, Art. 14 reporting and technical documentation.
For: development, quality, product security, regulatory
Indicative duration: one day
Cyber risk assessment with reference to ISO/IEC 27005 and ISO 31000, business impact analysis, criteria senior management can read, treatment and residual risk.
For: risk managers, CISOs, function heads
Indicative duration: one day
Relevant suppliers, contract requirements, questionnaires and evidence, remote access, management of ICT and OT suppliers over time.
For: procurement, IT, legal, compliance
Indicative duration: half a day
The differences between IT and OT, segmentation, remote access for maintenance providers, vulnerability management on plant systems, introduction to IEC 62443.
For: plant managers, maintenance, automation, IT
Indicative duration: one day
Courses on management systems, taught by an ISO/IEC 27001 Lead Auditor who is also a qualified trainer for certification and training bodies such as DNV and Kiwa.
Structure of the standard, context and scope, risk analysis, statement of applicability, Annex A controls, relationship with NIS2.
For: management system managers, IT, internal consultants
Indicative duration: one day
Planning and conducting internal audits according to ISO 19011: programme, checklists, interviews, evidence, findings and report.
For: internal auditors, quality and security managers
Indicative duration: two days
Impact analysis, continuity strategies, plans and tests, link with incident management and with NIS2 requirements.
For: continuity managers, IT, operations
Indicative duration: one day
Training built on sector-specific obligations.
The 4-hour supplementary module required by MIT Circular 177/2025 for those who use the facility’s critical systems, with a final test and records for the PFSP; 1-hour version for familiarisation.
For: security staff, PFSOs and deputies, port facility staff
Indicative duration: 4 hours, or 1 hour
Manufacturers’ requirements for suppliers (UN R155, ISO/SAE 21434, TISAX), NIS2 and Cyber Resilience Act: what each one asks and how to respond with a single system.
For: quality, development, IT, sales
Indicative duration: half a day
Production lines, cold chain and traceability as targets; NIS2, critical entities and Machinery Regulation; cyber scenarios in the food defence plan.
For: production, quality, maintenance, IT
Indicative duration: half a day
To reduce the most frequent mistakes and train those who must decide under pressure.
Phishing and phone scams, credentials and multi-factor authentication, personal devices and removable media, how and to whom to report, with real anonymised examples.
For: all staff
Indicative duration: 1–2 hours, also in modules
Guided simulation of an incident with the crisis committee: decisions under pressure, notifications with the clock really running, voting by phone and a written debriefing.
For: senior management, IT, legal, DPO, operations, communications
Indicative duration: 3 hours, also remotely
Each course is adapted to the organisation: we start from its regulations, its systems and its processes, so that the examples are the ones participants will actually meet. Courses for training and certification bodies follow the body’s programmes and qualification rules.
Tell us who needs to be trained and on which regulations: we will propose a programme with content, duration and assessment.
