What you receive from PHSHX, and what it proves.
This page is for the person who has to file the evidence: the IT lead, the compliance officer, the external auditor. Six items, the format of each, and the article of Directive (EU) 2022/2555 it documents. No pitch.
Six documents. Each answers one question.
Training register
CSV and signed PDF, one row per person or per employer-assigned identifier
Which modules each person completed, on which dates, with what score, and whether the 80% pass mark was met. Non-completion is listed, not hidden.
Art. 21(2)(g) · Art. 20(2)
Management body record
Separate table inside the register, named individuals
That the members of the management body personally completed the management module, with dates. This is the line a supervisor checks first because it is the easiest to verify.
Art. 20(2)
Certificate with verification code
PDF per person; code checked at phshx.com/train/verify without an account
That a named person passed the full path at 80% or above. The code resolves to the score and date on our side; the certificate cannot be edited into existence.
Art. 21(2)(g)
Simulation results
PDF per campaign: date, template used, click rate, report rate, by department
Whether people recognise a phishing attempt when it arrives unannounced, and whether that improves between campaigns. Reported per group, never per person, unless the person has opted in.
Art. 21(2)(g) · Art. 21(2)(f)
Exposure check
PDF, one page, dated, one domain
Whether the domain can be spoofed (SPF, DKIM, DMARC), which staff addresses appear in public breach data, and which look-alike domains already exist. The starting point a risk analysis is measured against.
Art. 21(2)(a)
Programme statement
One page, signed by PHSHX
What was delivered, to whom, at what cadence, with what pass mark, and who was excluded and why. The cover sheet that lets a third party read the rest of the file without calling us.
Art. 21(2)(f)
The certificate, its verification and the exposure check are live today. The register, the management record, simulation results and the programme statement are produced by hand for each company while the automated export is built. The format above is the format they arrive in either way.
The questions a DPO asks, answered first.
A training register is personal data. These five points are the ones that decide whether it can be produced at all, and they are settled in the agreement before anyone is trained.
Privacy policyWho is the controller
The company. PHSHX acts as processor under a written data processing agreement. The register is produced for the company and handed to the company; PHSHX does not publish it or share it with anyone else.
Names or identifiers
Either. Where the company cannot or does not want to give PHSHX staff names (a works council, a public-sector rule), the register runs on employer-assigned identifiers and the mapping to people stays with the employer. The evidence is identical.
Retention
Records are kept for 24 months from the last training event, then pseudonymised. A company that needs a longer retention for its own audit cycle keeps its own copy; that is what the CSV is for.
Where it is stored
On EU-hosted infrastructure. Certificate verification sends only the code to our server, which validates it and discards the request. Public training progress never leaves the employee's own browser.
Use against individuals
Simulation results are reported by group. Any finding about a named person is produced only where that person has opted in. The purpose of the file is to improve training, and the agreement says so.
Four things this file is not.
An auditor who reads the limits first trusts the rest faster. These are ours.
Compliance with NIS2 as a whole. Training is one of ten required measures. The other nine (incident handling, backups, supply chain, access control and so on) are outside what PHSHX delivers or documents.
That the company is in scope, or which category it falls in. That is a legal determination the company makes with its own advisers.
That the training satisfied the supervisor. National laws and supervisory practice differ. What the file proves is that training took place, to whom, when, and with what result; whether that is enough is a question for the supervisor and the national law.
The 24-hour and 72-hour incident notifications under Article 23. PHSHX has no role in those.
Write to us directly. Sample register and sample programme statement on request, with the columns filled in, so you can check them against your own checklist before anyone signs anything.
Article references are to Directive (EU) 2022/2555. National transpositions may add requirements. This page describes what PHSHX delivers; it is not legal advice.