From Policy to Practice

This thesis investigates how nine EU member states have transposed the Network and Information Security Directive’s (NIS2) cybersecurity training requirements into national legislation, focusing on the legal obligations imposed by Articles 20 and 21. The research addresses the problem of inconsistent implementation, which complicates compliance for organizations operating across borders and may undermine the directive’s goal of achieving a high common level of cybersecurity. The primary research question: How have EU member states transposed the NIS2 Directive’s cybersecurity training requirements into national legislation, and what legal obligations do these regulations impose on organizations? Using a systematic literature review and thematic analysis, the thesis identifies two primary models of legal transposition: compliance through specification and compliance through principle. Some countries have introduced detailed mandates with enforcement mechanisms, while others rely on general guidelines with minimal operational detail. The findings reveal that legal divergence affects organizational readiness, training standardization, and cross-border collaboration. The study concludes that although flexibility in implementation enables national adaptation, it also results in inconsistent application, potentially undermining collective cybersecurity. Greater EU-level coordination and clearer guidance could improve legal coherence and operational clarity. The thesis contributes to understanding the legal landscape of cybersecurity training in the EU and offers practical insights for policymakers, compliance officers, and organizational decision-makers.