NIS2 Regulation Course for Critical Infrastructure
Online 300-hour course in NIS2 regulation for critical infrastructure. 6 modules covering Directive (EU) 2022/2555 (NIS2), Implementing Regulation (EU) 2024/2690 (NIS2 technical measures) and PILAR (CCN risk analysis). Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Understand the evolution from NIS to NIS2 and its scope of application.
Identify whether an organisation is an essential or important entity.
Implement the risk management measures required by Article 21 of NIS2.
Apply the deadlines and content requirements for incident notification.
Integrate NIS2 with ISO/IEC 27001, the ENS and IEC 62443.
Define governance and the responsibilities of management bodies.
Draw up a NIS2 compliance plan for a critical infrastructure.
Who it's for
- Chief Information Security Officer (CISO) looking to specialise in NIS2 Regulation for critical infrastructure.
- NIS2 compliance consultant looking to specialise in NIS2 Regulation for critical infrastructure.
- Cybersecurity risk analyst looking to specialise in NIS2 Regulation for critical infrastructure.
- ISO/IEC 27001 auditor looking to specialise in NIS2 Regulation for critical infrastructure.
- Incident response manager looking to specialise in NIS2 Regulation for critical infrastructure.
- Industrial cybersecurity engineer looking to specialise in NIS2 Regulation for critical infrastructure.
- Engineering or science graduates looking to enter the energy sector.
What you'll work with
- Directive (EU) 2022/2555 (NIS2)
- Implementing Regulation (EU) 2024/2690 (NIS2 technical measures)
- Directive (EU) 2022/2557 (resilience of critical entities)
- ISO/IEC 27001:2022 (information security management)
- IEC 62443 (cybersecurity of industrial control systems)
- Royal Decree 311/2022 (National Security Framework)
- NIST Cybersecurity Framework 2.0
6 modules · 300 h
1.1Directive (EU) 2016/1148 and its limitations1.2Directive (EU) 2022/2555: objectives1.3Essential and important entities1.4Sectors in Annexes I and II1.5Size rule and exceptions1.6Jurisdiction and main establishment1.7Transposition in Spain1.8Relationship with CER and DORA1.9CER Directive on the resilience of critical entities1.10Workshop: determining scope for a company
2.1Article 21 and minimum measures2.2Implementing Regulation 2024/26902.3Risk analysis with MAGERIT2.4Security policies2.5Business continuity and backups2.6Supply chain security2.7Cryptography and access control2.8Multi-factor authentication2.9Training and cyber hygiene2.10Practical exercise: risk analysis of an electricity operator
3.1Significant incidents3.2Early warning within 24 hours3.3Notification within 72 hours3.4Final report within one month3.5National CSIRTs: INCIBE-CERT and CCN-CERT3.6Communication to service recipients3.7Incident taxonomy3.8European coordination with CyCLONe3.9Coordinated vulnerability disclosure3.10Case study: notification of a ransomware attack on a hospital
4.1Energy and electricity grids4.2Transport and aviation4.3Drinking water and wastewater4.4Health and hospitals4.5Digital infrastructure and DNS4.6Public administration4.7Operational technology and IEC 624434.8Space as a new sector4.9Lessons from Colonial Pipeline4.10Case study: attack on a wastewater treatment plant
5.1Responsibility of management bodies5.2Mandatory training for directors5.3Ex ante and ex post supervision5.4Security audits5.5Penalties of up to 10 million or 2%5.6European certification and EUCC5.7ISO/IEC 27001 as a means of compliance5.8ENS and its fit with NIS25.9Cross-border cooperation5.10Workshop: compliance plan for the board of directors
6.1Entity selection6.2Scope analysis6.3Maturity assessment6.4Gap analysis6.5Technical measures plan6.6Notification procedure6.7Governance model6.8Roadmap and budget6.9Report and presentation6.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. There are no fixed timetables: students progress at their own pace within the intake, making it possible to combine the programme with work.
Each module combines theory, guided reading of the original standard and applied exercises. The software used is PILAR (CCN risk analysis), Wazuh, Splunk, Microsoft Sentinel, Eramba (GRC), in free, academic or evaluation versions. Practical work is based on real gap analysis procedures against NIS2, incident notification simulations and information security audits. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Understand the evolution from NIS to NIS2 and its scope of application.
Identify whether an organisation is an essential or important entity.
Implement the risk management measures required by Article 21 of NIS2.
Apply the deadlines and content requirements for incident notification.
Integrate NIS2 with ISO/IEC 27001, the ENS and IEC 62443.
Where this takes you
Requirements
- No prior qualification is required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 300 hours, spread over 3 to 5 months. That is an average of 10 to 15 hours per week, compatible with a full-time job.
You work with PILAR (CCN risk analysis), Wazuh, Splunk, Microsoft Sentinel and Eramba (GRC). Free, academic or evaluation versions are used, and the tutor indicates the open-source alternative where one exists.
A SEIUM Institute diploma upon passing the continuous assessment and the integrative project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised towards the advanced programme. Check the recognition policy when enrolling.
Related programmes
Course in Ethics in the Deployment of UAV Systems in Civil Environments
Online 300-hour course in ethics in the deployment of UAV systems in civil environments. 6 modules covering Implementing Regulation (EU) 2019/947 (UAS operations), Delegated Regulation (EU)…
Course in International Regulation of Dual-Use Drones
Online 300-hour course in international regulation of dual-use drones. 6 modules covering Regulation (EU) 2021/821 (control of dual-use items), Recommendation (EU) 2021/1700 (research dual-use compliance) and…
Course in Ethics in Academic Aircraft Certification
300-hour online course in ethics in academic aircraft certification. 6 modules covering Regulation (EU) 2018/1139 (EASA's basic regulation), Regulation (EU) 748/2012 (Part 21) and MATLAB/Simulink. Assigned…
More in Defense, Military Engineering & Land Systems
All Defense, Military Engineering & Land Systems programmes → · How to apply · Fees & financing · Scholarships