05Advanced level
Cybersecurity Governance, Risk & Compliance (GRC): NIS2 and International Frameworks
The regulatory and methodological framework within which a defensible security programme is built. The path does not stop at describing the frameworks: it shows how they map onto each other and how they turn into verifiable evidence. In the second part the same framework becomes a compliance project carried out phase by phase, with the deliverable templates: asset inventories, Business Impact Analysis, business continuity and recovery plans, supplier register.
NIS2ACN basic specificationsAsset inventoryBusiness Impact AnalysisSupplier registerDORA and CRA
How it is delivered
- Delivery
- Entirely online and asynchronous, from any device: you study when you want, at your own pace.
- Passing the tests
- At least 70% correct answers; every answer comes with an explanation of why.
- Attempts per test
- Unlimited in the module tests, the best attempt counts. Final test: 3 attempts, 7 days apart; if none is passed, the learning path starts again from the first module.
- Time per test
- 25-40 minutes per test.
- Progress
- Tracked module by module: each module unlocks when you pass the test of the previous one.
- On completion
- A personal PDF certificate, with a unique verification code.
- Length of access
- You have 90 days from enrolment to complete the learning path. Once you complete it your access stays available with no expiry; if the deadline passes without the path being completed, the enrolment is suspended and the results you have already achieved stay on record.
- Enrolment
- With a personal key, after you have created your account.
The learning path in detail
Welcome. This path builds the regulatory and methodological framework of a defensible security programme: not only what NIS2, NIST CSF 2.0, the CIS Controls and ISO/IEC 27001 require, but how they map to one another and how they become evidence that stands up in front of an auditor. The underlying idea is that compliance is not a formality to be added to security, but the way of demonstrating it.
Two parts. Modules 1-9 build the foundations: the law, the ACN determinations, the frameworks and the sector-specific rules. Modules 10-13 are the compliance project proper, phase by phase, with templates for the documents to produce: asset inventories, Business Impact Analysis, plans and supplier register.
Path objectives
By the end of the path you will be able to:
- establish whether and how your organisation falls under NIS2 and with which obligations (Modules 1 and 2)
- use the NIST Cybersecurity Framework 2.0 as the lingua franca of the security programme (Module 3)
- apply the CIS Controls v8.1 as a prioritised implementation route (Module 4)
- understand how an ISO/IEC 27001:2022 management system works and what a certification body looks at (Module 5)
- build an integrated programme with cross-mappings, avoiding doing the same work four times (Module 6)
- prepare for and undergo an audit: evidence, non-conformities, continual improvement (Module 7)
- implementing and governing the ACN basic specifications that apply to your entity qualification, with the evidence that demonstrates them and the deadlines that order them (Module 8)
- apply DORA as a financial entity or as an ICT provider to the financial sector, and the Cyber Resilience Act as a manufacturer, importer or distributor of products with digital elements, with reporting already applicable from 11 September 2026 (Module 9)
- run a NIS entity's compliance project phase by phase, from scope and governance through to the annual review, knowing which deliverables to produce and who approves them (Module 10)
- compile the asset inventories required by the ACN basic specifications and turn them into a risk assessment, gap analysis and treatment plan (Module 11)
- conduct a Business Impact Analysis and derive from it the requirements of the business continuity, disaster recovery, crisis management and incident response plans (Module 12)
- govern the supply chain with a complete supplier register, verifiable contractual requirements and the listing of relevant suppliers required by ACN (Module 13)
Who it is for and prerequisites
IT and security managers, compliance managers, DPOs, internal auditors and anyone who has to answer security questionnaires from customers and lead firms. It is advisable to have taken the paths on fundamentals and on hygiene first: this path takes the concepts of risk, threat and control as given.
How it runs
The path is delivered entirely online, in self-paced mode: you can study whenever you want, at your own pace, from any device. The estimated total duration is 56 hours, to be spread out within the completion deadline indicated further on.
Each module is organised into four lessons and two tests:
- Lesson. A reasoned treatment of the topic, with diagrams, examples and concrete cases.
- In depth. The updated regulatory and technical framework, with the deadlines that matter and references you can check at source.
- Real-world cases. What really happens in the market: documented episodes always read with the same grid, down to the control that would have broken the chain.
- In practice. What you do on Monday morning: procedures, checklists, ready-made templates and indicators to measure the result.
- Test. Closed answer questions on the whole module. Passing requires at least 70%; attempts are unlimited and the best mark counts. At the end of each attempt you get a precise explanation of every answer, including the correct ones.
- Exercise. A case to work through by deciding: every choice opens a different path and the outcome depends on what you chose, with an explanation of what would have happened otherwise. Marking is automatic and you can retake it as many times as you like.
Progression. The 13 modules are taken in sequence: each module unlocks only after passing the test of the previous module. The exercises do not block progress, but they are an integral part of the path and of the overall assessment.
Final test and certificate
Once you have passed the tests of all the modules, the final test is unlocked: 30 questions drawn at random from the topics of the whole path, with the same 70% threshold. You have three attempts, at least one week apart: if none of them reaches the threshold, the path starts again from the first module. On passing you obtain the path certificate, downloadable as a PDF, with a unique code that allows its authenticity to be verified.
Warning
The content is up to date as of October 2026, is for training purposes and does not constitute legal advice. For the obligations that fall on your organisation, always refer to the legislation in force and to internal legal support.
Support
In the Announcements forum you will find messages from the tutor. For questions about the content or the exercises, use the channels indicated by your training contact.
Programme
The modules are taken in sequence: each one opens when you pass the test of the previous one.
Module 1
NIS2: scope and regulated entities
Directive (EU) 2022/2555 and its Italian transposition: sectors, the size criterion and its derogations, the distinction between essential and important entities, the calendar of ACN determinations and the cascade effect on suppliers.
LessonLessonLessonLessonTest · 20 questionsExercise
Module 2
NIS2: risk management measures and reporting obligations
The ten minimum measures of Art. 21 translated into controls and evidence, the direct responsibility of the management bodies, the penalty regime and the notification chain of 24 hours, 72 hours, one month.
LessonLessonLessonLessonTest · 18 questionsExercise
Module 3
NIST Cybersecurity Framework 2.0
The six functions GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER; current and target profiles as a work plan, maturity Tiers and use of the framework as a tool for dialogue with the top.
LessonLessonLessonLessonTest · 17 questionsExercise
Module 4
CIS Controls v8.1
The 18 Controls, the Safeguards and the three Implementation Groups: how to build a defensible roadmap starting from IG1, and how the mappings to NIST CSF 2.0 and ISO let you reuse the same evidence.
LessonLessonLessonLessonTest · 17 questionsExercise
Module 5
ISO/IEC 27001:2022 and the management system
The structure of the ISMS, mandatory clauses 4-10, Annex A with its 93 measures in four themes, the Statement of Applicability as the central document and the three-year certification cycle.
LessonLessonLessonLessonTest · 18 questionsExercise
Module 6
Cross-mappings and integrated compliance programme
How to make NIS2, ISO/IEC 27001, NIST CSF and CIS Controls live together without multiplying the work: the single control register, where CRA, DORA, the AI Act and Law 90/2024 fit, and the points where the mappings do not work.
LessonLessonLessonLessonTest · 19 questionsExercise
Module 7
Audits, evidence and continual improvement
What counts as evidence for an auditor, how to document a control, how to handle non-conformities and corrective actions by tracing back to the causes, and how to build indicators that trigger decisions.
LessonLessonLessonLessonTest · 16 questionsExercise
Module 8
The ACN basic specifications for essential and important entities
The basic specifications adopted by ACN: how they're structured, what distinguishes Annex 1 for important entities from Annex 2 for essential entities, how they map onto existing controls, which evidence holds up and how compliance is governed through the deadline and beyond.
LessonLessonLessonLessonTest · 16 questionsExercise
Module 9
DORA and Cyber Resilience Act: resilience of the financial sector and of digital products
The two European regimes that for some organisations are the main obligation: DORA for financial entities and their ICT providers, the Cyber Resilience Act for those placing products with digital elements on the market. Scope, obligations article by article, technical standards, deadlines, contracts, reporting and the compliance plan for those subject to both.
LessonLessonLessonLessonTest · 17 questionsExercise
Module 10
The NIS compliance project: phases, governance and deliverables
The second part of the path begins: the compliance project, phase by phase. The twelve phases that take a NIS entity from registration to the annual review, the deliverables each produces and who approves them, scope and governance, and the ACN acts of 2025 and 2026, including the enhanced security measures under consultation.
LessonLessonLessonLessonTest · 16 questionsExercise
Module 11
Asset inventory, risk analysis and treatment plan
The inventory templates required by the ACN basic specifications, with each field linked to the requirement that asks for it: devices, software and services, network flows, supplier services, information. Then the risk assessment, the gap analysis against the ACN measures and the treatment plan to be approved.
LessonLessonLessonLessonTest · 15 questionsExercise
Module 12
Business Impact Analysis: the basis of business continuity, disaster recovery and incident response
The Business Impact Analysis step by step: processes, impact criteria, MTPD, RTO, RPO and MBCO, dependencies on systems, people and suppliers. And how its results become the business continuity plan, the disaster recovery plan, the crisis management plan and the incident response plan.
LessonLessonLessonLessonTest · 15 questionsExercise
Module 13
The supply chain: supplier register, contracts and enhanced measures
Supply chain security under the NIS framework: the supplier register with all the fields needed, supply risk assessment, the requirements to put in contracts, the listing of relevant suppliers on the ACN platform and how to prepare for the enhanced measures.
LessonLessonLessonLessonTest · 16 questionsExercise
Final test and certificate
Thirty questions drawn at random from the topics of all the modules. On passing, the path certificate is issued.
Test · 30 questionsCertificate
How to get access to the learning path
To follow "Cybersecurity Governance, Risk & Compliance (GRC): NIS2 and International Frameworks" you need an account on the platform: registration is free and takes a minute. Once the account is created you can request the enrolment key for the learning path.
Enrol meI already have an account
Back to all learning paths