Skip to content
Login to the app
  • There are no suggestions because the search field is empty.

How CyberPilot Can Help You With The CER Directive

This article explains how you can use CyberPilot’s Awareness Training to support the training and awareness requirements in the CER Directive.

Note: This overview does not cover every aspect of CER compliance, only those aspects that relate to training and awareness.

What is the CER Directive?

The EU directive on the resilience of critical entities, the CER Directive, sets requirements for organizations that provide essential services, such as energy, water and transport. Among other things, there are requirements for training employees and raising their awareness. You can use CyberPilot’s Awareness Training to support those requirements.

You can use CyberPilot’s Awareness Training to support the CER Directive

The CER Directive requires critical entities to:

  • set training requirements for employees with critical functions, including staff from external service providers
  • raise awareness among relevant employees about the organization’s security measures, for example through training courses, information materials and exercises.

      The organization decides how much training is needed, based on its own risk assessment.

      Key takeaways and how CyberPilot can help

      The CER Directive requires

      How CyberPilot can help

      Awareness of security measures among relevant employees, including physical protection and incident handling

      Enroll all employees in Awareness Training on an ongoing basis. Make sure to include the courses The physical surroundings and Security breaches.

      Training requirements for employees with critical functions

      Use the Training planner to create role-specific training plans. See the recommended training plans below.

      Training based on the organization’s risk assessment

      Choose content that matches your biggest risks. If your employees work with operational technology (OT), enroll them in Intro to OT security.

      Knowledge of the organization’s own procedures

      Upload your own emergency plan and procedures under Own Materials and add them to your training plans.

      Information materials

      Download posters from Resources → Posters, for example “See a stranger walking around your workplace alone” and “Spotted a security slip”.

      Training described in the resilience plan

      Use the Awareness Training reports to document which employees have completed which training.

      Note: Awareness Training covers cybersecurity, physical security in the workplace and reporting of incidents. Training in emergency preparedness, such as evacuation or power outages, and practical exercises, such as drills, are not part of Awareness Training as they will vary a lot from organization to organization. Plan these separately as part of your resilience plan.

      Role-specific training

      The CER Directive requires training requirements for employees with critical functions. You can set up role-specific training in three steps:

      1. Identify the roles that need specific training, for example operations staff, reception staff and management.
      2. Place these employees in groups or branches in the CyberPilot platform. See Use branches to group your users.
      3. Create a training plan for each group in the Training planner. See Set up course schedules with the Training planner.

            Employees who are in more than one group receive the content from all their training plans.

            Recommended training plans

            Further reading