NIS2 vs ISO 27001: Key Differences and Shared Controls
ISO 27001 certification provides a strong foundation for NIS2 readiness, but it doesn't establish legal compliance. For leadership teams comparing NIS2 vs ISO 27001, the distinction is legal accountability: NIS2 imposes statutory obligations, whilst ISO 27001 provides a framework for managing information security.
Your existing management system can reduce duplicated work. The priority is to identify where its scope, controls and evidence fall short of the applicable legal requirements.
Key takeaways
ISO 27001 supports NIS2 risk management, but certification doesn't replace statutory reporting, registration or management duties.
The certified scope may omit services, systems or locations covered by NIS2.
Shared controls need evidence against each applicable requirement. Mapping tables don't establish equivalence or justify a universal percentage of compliance.
NIS2 vs ISO 27001: the main differences
NIS2, Directive (EU) 2022/2555, establishes cybersecurity obligations through national legislation. Member States' transposition deadline was 17 October 2024.
ISO/IEC 27001:2022 establishes requirements for an information security management system (ISMS). Clauses 4 to 10 address context, leadership, planning, support, operation, evaluation and improvement.
Area | NIS2 | ISO 27001 |
|---|---|---|
Status | Legal obligations for covered entities | Voluntary international standard |
Scope | Determined by legislation | Defined ISMS boundary |
Security measures | Statutory, proportionate requirements | Controls selected through risk treatment |
Oversight | Competent authorities and CSIRTs | Independent certification and surveillance audits |
Recognition | No EU-wide organisational NIS2 certification scheme | Internationally recognised certification available through accredited bodies |
NIS2 encourages recognised European and international standards, including the ISO/IEC 27000 family. It doesn't name ISO 27001 certification as a compliance requirement.
ISO 27001 also requires organisations to identify applicable legal obligations. An effective ISMS should therefore incorporate NIS2 requirements where they apply.
Establish the legal scope before reviewing controls
Identify the entity, services and jurisdiction
NIS2 covers 18 sectors across its two annexes. Applicability depends on sector, size, activity and exceptions, rather than turnover alone.
Essential and important entities generally face the same core risk-management duties. Their supervision differs: essential entities face broader supervisory intervention, whilst important entities generally face action following indications of non-compliance.
UK incorporation doesn't settle applicability. Certain non-EU digital providers serving the EU can fall within NIS2 and face representative requirements.
Commission Implementing Regulation (EU) 2024/2690 adds binding requirements for specified providers, including DNS, cloud, data centre and managed service providers. Other sectors rely principally on national transposition.
Compare this boundary with your certificate
Germany's BSI guidance on ISO 27001 states that certification doesn't prove NIS2 conformity. An ISMS may cover selected business areas or sites.
Compare the certificate with regulated operations, including operational technology, outsourced services and shared infrastructure. Our asset inventory guidance supports this work by connecting information, systems and accountable owners.
A narrow certificate isn't defective, but its boundary may leave substantial NIS2 work uncovered.
How Article 21 maps to ISO 27001
Article 21(2) identifies ten minimum cybersecurity risk-management measure areas. The following references provide starting points for assessment, rather than complete equivalence.
NIS2 Article 21(2) measure | Relevant ISO 27001:2022 references |
|---|---|
(a) Risk analysis and information-system security policies | Clauses 6.1.2 and 6.1.3; A.5.1 |
(b) Incident handling | A.5.24 to A.5.28 |
(c) Business continuity, backups, disaster recovery and crisis management | A.5.29, A.5.30, A.8.13, A.8.14 |
(d) Supply chain security | A.5.19 to A.5.22 |
(e) Secure acquisition, development, maintenance and vulnerability handling | A.8.8, A.8.25 to A.8.32 |
(f) Assessing measure effectiveness | Clause 9.1; A.5.35, A.5.36 |
(g) Cyber hygiene and cybersecurity training | A.6.3, A.8.9 |
(h) Cryptography and encryption | A.8.24 |
(i) Personnel security, access control and asset management | A.6.1, A.5.15 to A.5.18, A.5.9 |
(j) Multi-factor authentication and secured communications, where appropriate | A.8.5, A.5.14, A.8.20, A.8.24 |
ISO/IEC 27002 implementation guidance explains the associated controls, but ISO 27001 remains the certification requirements standard.
ENISA's September 2025 mapping-table release, version 1.2, links implementing-regulation requirements with ISO 27001:2022 and NIST CSF 2.0. Its disclaimer rejects treating the mapping as a measure of equivalence.
There is therefore no defensible universal claim that certification delivers "80% NIS2 compliance". Coverage depends on scope, implementation and the applicable legal requirements.
Statutory obligations that certification doesn't satisfy
Incident reporting needs a timed regulatory procedure
For significant incidents, Article 23 generally requires an early warning within 24 hours of awareness and an incident notification within 72 hours. The final report follows within one month of that notification.
If handling remains ongoing, a progress report replaces the final report at that point. The final report follows within one month after handling concludes. Trust service providers face a shorter notification deadline.
If an incident also involves personal data, assess the separate notification duties under GDPR. They have their own tests and deadlines and don't replace these reporting requirements.
ISO 27001 doesn't prescribe these deadlines or mandate notification to a CSIRT or competent authority. The incident reporting procedure needs significance criteria, a named owner and deputy, authority contacts, and approval arrangements that work outside office hours. Assign someone to prepare the early warning from the initial facts.
Record when the organisation became aware of a significant incident. Completing the technical investigation doesn't start the reporting clock.
Management accountability and registration require separate evidence
Article 20 requires management bodies to approve cybersecurity risk-management measures, oversee implementation and receive training. Members can face personal liability under national implementing law.
Board minutes, training records, decisions and follow-up actions should demonstrate this oversight. An ISMS management review can support it, but attendance alone doesn't establish informed approval.
NIS2 registration with the designated national authority, or CSIRT where applicable, has no ISO equivalent. Information includes entity name, address, sector and contacts. IP ranges and domain names also feature in relevant provider-specific or national registration regimes; the fields aren't identical for every entity.
Extend the ISMS without creating a second system
Strengthen the Statement of Applicability
Clause 6.1.3 requires a Statement of Applicability (SoA) recording necessary controls, reasons for inclusion, implementation status and reasons for excluding Annex A controls.
The 2022 edition has 93 reference controls across organisational, people, physical and technological themes. Each must be considered, but universal implementation isn't required.
ISO 27005 guidance can help structure a risk assessment, with its outputs informing risk management and control selection.
Add NIS2 references, affected services, owners and evidence links to your control register. For an A.8.5 entry, link Article 21(2)(j), identify covered authentication services and reference MFA configuration and exception records.
If an excluded control addresses an applicable legal measure, reassess the exclusion. Risk acceptance cannot override a statutory obligation. Additional controls outside Annex A may also be necessary.
Test supplier security and operational evidence
Annex A.5.19 to A.5.22 supports supplier governance. NIS2 Article 21(3) requires consideration of vulnerabilities specific to each direct supplier and service provider, alongside their cybersecurity practices and secure development procedures.
Assess supply chain security, including supplier access, dependencies, vulnerability disclosure, incident cooperation and recovery capability. Relevant contractual requirements may need to reach Tier 2 and Tier 3 suppliers through direct suppliers. NIS2 doesn't impose an identical blanket flow-down clause on every subcontractor.
Evidence should demonstrate operation: supplier findings, access reviews, encryption settings, MFA coverage and exercise results. Testing recovery plans provides stronger assurance than retaining an untested continuity document.
Secured emergency communications also need practical testing when normal email, telephony or identity services are unavailable.
Build a funded, accountable implementation plan
An integrated programme needs operational ownership, not another collection of policies.
Establish the applicable legal requirements and compare regulated operations with the certified scope.
Map each requirement to working controls, evidence and unresolved gaps.
Assign accountable owners across security, IT, operations, procurement, HR and leadership.
Implement reporting, registration and governance changes alongside technical remediation.
Exercise the arrangements, audit evidence and track corrective actions through management review.
Effort depends on the gaps. Organisations extending coverage into factories or shared platforms face different work from those updating reporting procedures. A certificate alone cannot support a reliable cost or completion estimate.
Our ISO 27001 consultancy, training and internal auditing support can help structure this assessment. A vCISO can coordinate delivery where dedicated security leadership isn't available. The management body retains its statutory responsibilities.
Frequently asked questions
Does ISO 27001 certification automatically establish NIS2 compliance?
No. Certification assesses the defined ISMS against the standard. NIS2 compliance also depends on legal scope, statutory processes and evidence that applicable measures operate across regulated activities.
Should NIST CSF 2.0 replace an existing ISMS?
NIST CSF 2.0, published on 26 February 2024, has six functions: Govern, Identify, Protect, Detect, Respond and Recover. It isn't a certifiable management-system standard.
It can support risk communication and gap analysis. An established ISMS usually remains a useful foundation because it already provides ownership, audit, management review and improvement processes.
Can other compliance programmes share the same evidence?
ISO 42001, CMMC and ENX's TISAX assessment framework can share selected governance processes and security evidence. Each retains its own scope, criteria and assessment requirements.
TISAX training, consultancy and assessment preparation should therefore address automotive requirements rather than assume an ISO audit proves readiness. Shared records reduce duplication only when they demonstrate each applicable requirement.
How does national implementation affect the comparison?
National legislation determines competent authorities, registration arrangements and enforcement details. The Netherlands' Cyberbeveiligingswet is its NIS2 transposition legislation; the Dutch NCSC's information sheet presents the ten measures in Dutch.
A group-wide control framework can support delivery, but legal obligations still need country-specific ownership.
Turn existing assurance into NIS2 readiness
ISO 27001 gives your organisation a structured basis for managing security. NIS2 adds statutory obligations that need explicit ownership, procedures and evidence.
Start with the regulated boundary, then close gaps through the existing ISMS. This preserves useful controls without overstating what certification proves.
If you would like to find out more information or require any of our services please Contact Us. Complete our contact form to discuss your requirements.
Comments