Compliance
The auditor arrives Tuesday. Where's your evidence?
NIS2, ISO 27001 (control A.6.3) and DORA all ask you to train staff on security. nophi.sh keeps a dated record of every campaign and every course, for your audits.
Key facts
nophi.sh produces security awareness evidence for NIS2, ISO 27001 (A.6.3) and DORA audits: simulation campaign history, results by department and training follow-up, in a PDF report. The platform offers 80 phishing scenarios in French and English and a short lesson after every click. It covers the awareness part of these frameworks; other obligations are handled separately. Data is hosted in France. Plans start at €99/month excl. VAT, with a 14-day free trial and no credit card.
NIS2 and insurers expect proof of awareness training
NIS2: real fines
For essential entities, fines can reach €10M or 2% of worldwide turnover. Article 21 lists cybersecurity training among the measures to put in place.
Source: Directive (EU) 2022/2555, Articles 21 and 34
Your insurer may ask for proof
When you take out a policy or file a claim, your insurer may ask whether staff were trained. A dated history of campaigns and courses answers the question.
Audits are prepared over months
ISO 27001 control A.6.3 covers awareness and training. Auditors expect dated records covering the whole audit period.
Entities in scope of NIS2 must train their staff
Article 21 lists cybersecurity training among the required measures. nophi.sh gives you evidence for that part: simulation results, results by department, completed training. The other measures (risk management, incident handling, continuity) are handled separately.
Control A.6.3: awareness, education and training. Dated history of campaigns and courses.
ICT risk awareness for staff in financial services: documented phishing tests.
The documents to show your auditor
Nothing to format: the report fills itself as campaigns run.
PDF audit report
Executive summary, trends, risk distribution, departments and training. One-click export.
Training follow-up
Courses assigned, completed or overdue, with date and quiz score.
Campaign log
Dates, scenarios, open, click and submit rates. CSV export.
Per-person risk
Repeat clickers, people never tested and overdue training, at a glance.
- 01 Executive summaryPosture score and campaigns for the period, for management
- 02 TrendsOpens, clicks and submitted passwords, month by month
- 03 Risk distributionNumber of people per risk level
- 04 DepartmentsResults and progress per department
- 05 TrainingCourses assigned, completed and overdue
Illustration. Contents depend on your campaigns.
Your next audit, with less stress
Launch your first campaigns. Evidence compiles as results come in.