Cybersecurity Awareness E-Learning

EU Directive 2022/2555 and the German NIS2UmsuCG since 6 December 2025: who qualifies as an “essential” or “important” entity, when obligations apply, and the fine framework (10M EUR / 2% for essential entities under § 60 BSIG).

The CIA triad — confidentiality, integrity, availability — translated into daily work: what it means for your files, emails and systems, with concrete SME examples.

Multi-factor authentication, passphrases over complex strings, password managers, the zero-trust principle — the minimum requirements under § 30 BSIG and Art. 21 NIS2.

Recognize phishing in under 30 seconds: sender spoofing, dangerous attachments, quishing via QR code, business email compromise — with live examples and a decision tree for the recipient.

Secure use of laptops, smartphones and hotspots: VPN obligation, screen privacy, automatic lock, loss procedures, BYOD policy boundaries.

The 24-hour early warning, 72-hour incident notification, and one-month final report under § 32 BSIG: what to report, to whom, and the role of every staff member in the chain.

Supplier risks under Art. 21(2)(d) NIS2 plus physical security: visitor protocol, tailgating prevention, clean-desk policy, hardware theft, third-party remote access controls.

The five most important reflexes: install updates, MFA everywhere, report suspicious emails, no USB sticks from unknown sources, communicate incidents early — ending with a personal action card.