Everything you need to know about the Cybersecurity Act

The training materials are based on the obligations set out in the Cybersecurity Act and are specifically tailored to the practical realities of education and research. SURF members can use these materials to organise their own training or make use of the training programmes offered by SURF.

More than just a formality

The training for board members is more than just a one-off formality to comply with the Cybersecurity Act. The training material covers the knowledge and skills that board members need to fulfil their responsibilities for cyber security effectively. The training focuses on recognising risks in good time, asking the right questions and making well-considered decisions. Cybersecurity thus becomes a regular item on the board’s agenda.

4 modules, 6 hours of training

The training material consists of 4 modules:

• Uncertainty: understanding the risks and obligations

This module covers the key concepts in the field of cyber security and the obligations under the Cyber Security Act.

• Know Your Position: understand your responsibilities

This module focuses on the role of board members in risk management. It examines how responsibilities are distributed within the organisation, how cyber-attacks unfold and the risks an institution faces. Topics covered include the Three Lines Model, risk management and the Cyber Kill Chain.

• Get in Control: maintain control over cyber security

In this module, board members learn how to steer the organisation towards appropriate security measures and business continuity. They also gain an understanding of how audits help to assess the effectiveness of security measures.

• When Murphy Strikes: prepared for a cyber crisis

This module covers incident response and crisis management, and the role board members play when an incident or crisis actually occurs.

Completing the 4 modules takes approximately 6 hours in total. You can deliver the full training in one go or spread the 4 modules over several sessions. The latter option allows directors to take concrete steps between sessions and apply the knowledge they have gained straight away.

The training is interactive and includes group discussions and the analysis of real-life case studies. Participants receive a handbook and preparatory assignments in advance.

How to use the training materials

SURF makes the training material available to all affiliated education and research institutions. You can use the material in various ways, depending on the needs and capabilities within your own institution:

1. Organise the training yourself

Using the training material, you can organise the training yourself within your institution, for example under the guidance of a CISO or another expert.

2. Make use of the central pool of trainers

Would you like to organise the training within your institution, but lack the capacity or expertise to do so yourself? In that case, you can call on SURF’s central pool of trainers. A trainer from this pool will then visit your institution to lead the training.

3. Ask SURF to organise the training

You can request on-site training from SURF. The condition for this is that board members from several institutions take part in the training. This is because the exchange of knowledge and experiences between board members is an important part of the training.

4. Attend the training at SURF

SURF also organises its own training sessions for which executives can register individually. For these sessions too, there must be sufficient registrations from other executives for the session to go ahead.

Why choose SURF’s training materials? 

There are also commercial providers of training courses on the Cybersecurity Act, but SURF’s training materials offer a number of specific advantages for higher education and research institutions:  

• Developed for and by the sector

The training is tailored to the practical realities of higher education and research. The examples and case studies are relatable and take into account the way in which cyber security is organised within the sector.

• Based on existing expertise

The training materials were developed using the knowledge and experience of experts from higher education and research institutions.

• Shared knowledge base

By using shared training materials, managers within the sector develop a comparable knowledge base. Furthermore, sharing experiences helps to strengthen the cyber resilience of the entire sector.

• Up-to-date and affordable

SURF maintains the material and updates it based on new insights and experiences from participating institutions. This means that institutions do not all have to develop their own training programmes individually or purchase material from commercial providers. All SURF members can access the training courses and materials at cost price.

Don’t wait too long

We recommend starting the training courses as soon as possible, so that your institution is prepared in good time for the duty of care that will come into force in 2030. Furthermore, the knowledge gained from the training is already valuable when assessing cyber risks, taking preventive measures and dealing with incidents and crises. Furthermore, by repeating the modules periodically, preferably every 2 years, cyber security remains a constant focus for board members.