Compliance-Ready Awareness Training

The NIS2 Directive (EU 2022/2555) requires organizations to provide cybersecurity awareness training to management bodies and employees. HABITUX provides the training, engagement, and documentation you need.

• Article 20 — Management Training

  Management bodies must undergo regular cybersecurity awareness training. HABITUX provides structured, documented training sessions with measurable outcomes.

• Article 21 — Employee Awareness

  Organizations must offer cybersecurity awareness to all employees. HABITUX's game-based approach ensures high engagement and participation rates.

The Digital Operational Resilience Act (DORA) requires financial entities to implement ICT security awareness programmes. HABITUX satisfies these requirements with engaging, documented training.

• Article 13 — Awareness Programmes

  Financial entities must establish mandatory ICT security awareness programmes. HABITUX delivers structured programmes with participation tracking.

• Ongoing Training Evidence

  DORA requires evidence of continuous training sessions. HABITUX provides detailed reports showing participation, performance, and improvement over time.

ISO 27001 requires organizations to ensure all personnel are aware of information security policies and their contribution to the ISMS. HABITUX makes this measurable.

• Annex A.7 — Human Resource Security

  Personnel must understand their security responsibilities. HABITUX's scenario-based training ensures practical understanding, not just policy acknowledgment.

• Annex A.6 — Organization of Information Security

  Awareness must be ongoing and documented. HABITUX provides continuous training with full audit trails and measurable outcomes.

The Trusted Information Security Assessment Exchange (TISAX) is the automotive industry's standard for information security. Based on VDA ISA, it requires organizations in the supply chain to demonstrate comprehensive security awareness and training programmes.

• VDA ISA 3.1.1 — Security Awareness

  All personnel must receive regular information security awareness training covering current threats and organizational policies. HABITUX delivers engaging, measurable training sessions with documented participation.

• VDA ISA 4.1 — Access Control Awareness

  Employees must understand access control policies and authentication requirements. HABITUX scenarios cover access management, physical security, and the principle of least privilege.

The OWASP Foundation provides the most widely adopted frameworks for application security. HABITUX includes dedicated developer-focused scenarios covering the OWASP Top 10, Proactive Controls, and the Developer Guide — building security awareness specifically for development teams.

• OWASP Top 10 — Application Security Risks

  Developers learn to recognize and prevent the most critical security risks: injection, broken access control, cryptographic failures, and more — through realistic scenario-based training.

• Proactive Controls & Developer Guide

  From defining security requirements (C1) to implementing secure logging (C9), HABITUX covers all 10 OWASP Proactive Controls with hands-on scenarios for development teams.

The BSI IT-Grundschutz framework is the German federal standard for information security. It requires organizations to implement comprehensive security awareness programmes covering personnel, operations, and technical controls.

• ORP.3 — Security Awareness & Training

  All employees must receive regular security awareness training covering current threats and organizational policies. HABITUX delivers engaging, measurable training sessions with documented participation.

• CON.10 — Secure Development & Data Handling

  Employees must be trained on secure development practices and data handling. HABITUX scenarios address cryptographic concepts, data protection, and secure communication workflows.

The Cyber Resilience Act sets mandatory cybersecurity requirements for products with digital elements placed on the EU market — from security by design and vulnerability handling to mandatory updates and incident reporting. HABITUX builds the awareness teams need to meet these obligations across the product lifecycle.

• Annex I — Security by Design & Vulnerability Handling

  Products must ship securely configured by default and free of known exploitable vulnerabilities, backed by coordinated vulnerability disclosure and a software bill of materials (SBOM). HABITUX trains teams on these essential requirements.

• Art. 14 — Reporting & Security Updates

  Manufacturers must report actively exploited vulnerabilities and severe incidents to ENISA and the relevant CSIRT within strict deadlines, and provide free, timely security updates throughout the support period. HABITUX reinforces these duties.