NIS2 tabletop exercises: what Articles 20 and 21 actually require

In Germany alone, the federal cyber security authority (BSI) estimates roughly 29,500 companies in scope of the transposed law. Which tier applies follows from sector and company size; the substantive duties (risk management, incident reporting, management training) apply in both. Other member states run their own registers and portals, but the underlying directive articles are identical, so the preparation work travels well across borders.

Article 20 also makes management bodies liable for infringements of the Article 21 duties, within the limits set by national law. In Germany, §38 BSIG spells this out as personal approval, oversight and training duties of the Geschäftsleitung, with liability to match.

Honesty matters here: the directive mandates measures and training, not the tabletop exercise itself. But when you have to prove that your management body is trained and genuinely oversees implementation, a webinar attendance certificate is thin: it proves presence, nothing more. A documented tabletop exercise proves judgement: which decisions the management body took under time pressure, when, on what information, and with what outcome. As training and oversight evidence, that is the strongest artefact you can produce.

National laws copy this list; Germany anchors it in §30(2) BSIG: business continuity, backup management, recovery and crisis management. (Digital-infrastructure providers additionally fall under Implementing Regulation (EU) 2024/2690, which details these requirements.) Taking it seriously means more than firewalls and patch cycles:

A BCM manual on the shelf satisfies the letter of the law. Whether it survives contact with reality is decided in the first real incident, or, far more cheaply, in the first serious exercise.

Three deadlines look manageable on paper. In reality, the 24-hour question lands in the middle of the worst night your company has had: who decides the incident is significant? Who drafts the early warning while the same people are isolating systems? Who holds the portal credentials, and who covers for them on holiday? These questions decide between on time and late, and they cannot be asked for the first time on the day itself. In Germany, §32 BSIG mirrors this chain, with the BSI as the receiving authority.

That is exactly why Verdus exercises ship with dedicated reporting-chain injects: your team is confronted with the notification question at the least convenient realistic moment, the decision is captured with a timestamp. The debrief shows in black and white whether your early warning would have made the 24-hour window.

That is no accident; it is the supervisory logic in one sentence: an emergency concept that has never been rehearsed is a hypothesis. Only an exercise shows whether alerting paths work, deputies step in, and decisions are taken where the plan says they are. Knowing the standard and executing it under pressure are two different maturity levels, and supervisors care about the second.

Verdus Cyber operationalises that requirement: instead of an annual paper walkthrough you get a live, escalating exercise in the browser whose timeline, decisions and findings drop straight into your BCM documentation. You are not exercising beside the standard: you are generating the exercise evidence that distinguishes a lived BCM.