Does NIS2 require cyber-hygiene training for our whole workforce?

Yes. Article 21(2)(g) names basic cyber-hygiene training for everyone, with no carve-out for any role. Anyone who can open an email or click a link is in scope, from the line to the back office.

Are seasonal and agency staff included?

Yes, fully. The duty follows the person, not the contract, so seasonal, agency and contracted workers all count. EdXactly enrols them by QR with no account, so a worker who joins on Monday is trained the same day.

How do workers enrol without an IT project?

They scan a shared QR, enter a name and start on their own phone. No accounts, no app, no rollout. You print one code, put it where your people already are, and enrolments begin the same day.

What languages is the training available in?

More than ten, with the same module and the same pass in each. Workers train in the language they speak, and every result lands on one register regardless of language, so a mixed crew still gives one clean audit trail.

How is this different from the records we already keep?

It is the same idea as your dangerous-goods and handling records, kept person by person with a dated pass an auditor can check. The new part is the subject, cyber-hygiene, held as verifiable proof instead of a signed sheet.

What do we get for an audit, and where is the data held?

You get a register of who passed, when each pass expires and an evidence pack ready for an auditor. Records sit in the EU and carry no worker contact details, so you prove compliance without holding personal data.

NIS2 for postal and courier

Reach every driver and sorter, prove every one

Postal and courier work runs on a distributed, high-churn, multilingual workforce that lives on their phones. EdXactly trains them there and issues a pass you can verify in seconds.

Why Now

The obligation is moving down the chain

Postal and courier is now one of the 18 sectors NIS2 covers, and the rules catch any in-scope operator with 50 or more staff or 10 million euro or more turnover. Clients and platforms are already passing the obligation down the chain, asking subcontractors and last-mile partners to show their people are trained.

No shared terminal, no shared language

Drivers, riders and sorters are spread across depots and routes, often subcontracted, often turning over weekly. There is no shared terminal and no shared language, so a desk LMS reaches almost none of them.

A driver scans a QR at the depot or taps a link, trains in their language in about 25 minutes and gets a pass on their phone. You see live coverage across the whole network and hand a clean register to any client, platform or auditor that requires it.

Step 1

Your people enrol from a QR

Put a QR on a noticeboard, a card or a screen. A worker scans it, enters their name, and begins. No accounts, no contact details to collect, no IT project. Prefer to track by name? Load a roster instead and each worker gets their own link.

Excel

10+ languages

No integration

Step 2

Train and test on their own phone

Around 25 minutes of practical cyber hygiene for production and logistics floors, completed with an assessment. Built to WCAG 2.2 AA so everyone on the floor can genuinely finish it.

25 minutes

Assessed

WCAG 2.2 AA

Step 3

A pass any phone can verify in two seconds

On passing, the worker receives a personal QR pass with an expiry date, on their phone and printable as a badge card. A scan opens the live record on verify.edxactly.com: valid, expired or revoked, showing only the claim the checker is entitled to see. Every pass link is cryptographically signed, so an altered link shows invalid, and revocation takes effect on the very next scan.

Live status

Signed links

Instant revocation

For the audit

Evidence your auditor and your clients will accept

EdXactly Pass maintains a verifiable register: unique pass numbers, issue and expiry dates, automatic refresher triggers and periodic reports you can attach directly to a supply-chain questionnaire. Processing and storage within the EU, with data minimisation by design.

Verifiable register

Expiry tracked

EU hosted

Often Paired

One pass, more claims

The same pass carries more than cyber hygiene. Accessibility and AI literacy credentials issue on the same rails, each with its own validity, and a checker only ever sees the claim that matters to them. New obligations become a new claim type, never a new system.

AI literacy

Accessibility

Same pass

The Courses

Inside the 25-minute module

One validated curriculum, delivered in every language your floor speaks, tested at the end.

Employee in glasses reviewing printed documents at her desk

Cyber Hygiene

Practical behaviours for production and logistics floors, built as short scenario-led screens with a final check. The content tracks the regulation and updates centrally; new versions issue new passes, so your evidence never quietly goes stale.

What you'll learn :

Spotting phishing and social engineering

Passwords and multi-factor authentication, done right

Handling data and devices safely

Reporting fast, without fear

Cyber Hygiene

What you'll learn :

Spotting phishing and social engineering

Passwords and multi-factor authentication, done right

Handling data and devices safely

Reporting fast, without fear

Get every person on your line covered

We will show you a live scan and a sample evidence pack, then set you up for as many workers as you have, in their own languages.

Talk to us

Plan the pilot

How We Work

From signature to first pass in two weeks

We've done this enough times to know what works. Here's how we take you from idea to delivered learning, without the headaches.

Week 0

You sign up and we set your organisation live on the same day. There is nothing to install and no platform to connect, so the setup work never lands on your IT team at all.

Week 1

QR goes up

You place a QR where your people already are, a noticeboard, a shift card or a screen. Workers scan it and enrol themselves with just a name, or you load a roster if you want to track by name.

Week 1-2

Passes live

Each worker trains on their own phone, in their own language, in around 25 minutes, then sits a short assessment. On passing, a verifiable pass issues to them automatically, with no admin on your side.

Passes issue automatically on completion. Your team leaders can scan from day one.

Ongoing

Evidence on tap

Coverage updates live as people finish. Pull a per-person register or a one-click evidence pack whenever a retailer, client or auditor asks, all processed and stored inside the EU.

Why EdXactly Pass works

Built for the workforce as it really is: flexible, multilingual and busy.

Whole workforce

Reaches everyone, including the frontline and flex staff a desk LMS never touches.

Verifiable proof

A per-person pass that proves exactly who was trained, scannable and audit-ready.

Every language

10+ languages from one validated content base, so training lands locally.

On their phone

Workers self-enrol by QR. No accounts for you, no IT project.

Audit-ready

A verifiable register with expiry tracking and a one-click evidence pack.

Scales with you

From a single course to a full programme across every site.

FAQs

Questions? We've Got Answers

Here are the things people usually want to know before getting started.

Does NIS2 require cyber-hygiene training for postal and courier workers?

What about seasonal and agency workers who come and go?

How do people enrol, and does our IT team need to build anything?

Which languages are available?

How is this different from the training we already record?

Train Everyone. Prove It.

See a live scan and a sample evidence pack, then cover your whole workforce, in every language they speak.

Book the call

Check Your NIS2 Readiness