NIS2 Management Training – Learning Objectives, Certificate of Attendance and Follow-up in accordance with MCFFS 2026:11 | Word/PDF/Excel

NIS2 management training – document what management needs to know and what has actually been followed up. A practical Word/PDF/Excel package for Swedish organisations covered by the Cybersecurity Act that need to plan, deliver, assess, and document management training. Attendance or an acknowledgement is not automatically evidence of verified competence, and the package is not an official approval.

Quick facts: Swedish working templates · five separate working documents, a Swedish user guide and an English user guide · 7 editable Word (DOCX), 7 searchable and printable PDF and 1 Excel (XLSX) = 15 customer files · version 1.0 · intended for digital ZIP delivery with subsequent activation. The PDF files are not interactive forms; the English guide does not mean that the working documents are available in English.

Who should choose this template?

Situation 1: an organisation covered by the Cybersecurity Act needs to show how its management has identified and addressed training needs. Situation 2: a security officer wants to follow up on whether management can make well-founded decisions about cybersecurity objectives, risks, and protective measures. Not suitable: for organisations that are not covered by the legal requirements or that need a comprehensive NIS2 risk register, technical incident management, audit, or a ready-made certificate. For broader security governance, there is a separate NIS2 template package.

File by file – function, language and format

Excel tool – nine tabs and clear status logic

The workbook includes Overview, Management Roles, Training, Attendance, Knowledge Objectives, Competence Gaps, Decision Log, Evidence Register and Read Me. Records, filters, data selection and summaries help you see completed training, open competence gaps and missing supporting documentation. Registered attendance must not automatically receive the status of verified knowledge. A planned or proposed action is also not counted as a completed and approved decision.

Example: a member of management has participated in training but lacks a documented scenario result. Attendance can be entered, while the knowledge assessment remains unverified. The tool does not perform personal competence certification, legal compliance review, or reporting to an authority.

Step by step

1. Determine whether the organisation and the relevant management functions are covered and which sector regulations apply.
2. Establish relevant training needs and knowledge objectives based on the actual cyber risks of the organisation.
3. Plan the training effort and document attendance separately from actual learning outcomes.
4. Assess relevant scenarios and document the method, results, deviations, and associated evidence.
5. Decide on supplementary actions and who is responsible for follow-up.
6. Archive the completed documents and re-assess training needs when responsibilities, the threat landscape, or conditions change.

Rules and limitations

According to the Cybersecurity Act (2025:1506), Chapter 2, Section 4, the management of affected operators shall undergo training that provides knowledge and skills to identify risks and assess cybersecurity measures. MCFFS 2026:11, particularly Chapter 1, Section 1 and Chapter 2, Section 1, specifies management training within the scope of the regulations. For organisations also covered by Chapter 3, there are special provisions regarding management governance and recurring reporting. Annual information to management must not be confused with a general requirement that specific training be carried out every calendar year.

There is no generally prescribed score or officially approved certificate resulting from this template. Which requirements and regulations apply depends on the organisation, sector, and legal role. General advice is not binding regulations in itself. Specific legal questions need to be assessed individually.

Compare related documents

For broad risk management and security measures, choose the NIS2 Template Package. For assessment and follow-up of external security providers, see NIS2 supplier cyber certificate and re-testing. This product is limited to management training evidence and competence follow-up, not a general policy.

Frequently asked questions

Do all Swedish companies need NIS2 management training?

No. The rules apply to operators who are actually covered by the Cybersecurity Act and applicable regulations. First assess the company's organisation, sector, and role.

Is a signed participant list sufficient evidence of competence?

Not in itself. An acknowledgement can confirm attendance, but it does not alone show that the right knowledge and skills have been achieved. Use relevant knowledge items and documented follow-up.

Must management take a course every year?

Not as a general, explicit calendar year interval according to the rules this package is based on. Needs must be assessed against relevant requirements and risks. However, some management reports may be covered by the annual minimum level of the regulations.

Can Excel assess whether the organisation follows NIS2?

No. Excel keeps track of activities and supporting documentation. The legal assessment and decision are made by responsible persons.

Are the PDF files digitally fillable, or are Swedish templates available in English?

PDF is searchable and printable but not an interactive form. The Word files are editable. The main templates and Excel are in Swedish; only the separate English User Guide is in English.

Sources and transparency

Document version: 1.0, November 11, 2026. Legal source review: November 11, 2026. Official sources are the Cybersecurity Act (2025:1506) and MCFFS 2026:11. The source control is AI-assisted and is not an independent legal review, official approval, or a guarantee of legal compliance.