NIS2 vs ISO 27001: How Much Does Certification Cover?
If you already hold ISO 27001 certification, you have done much of the work NIS2 asks for. But certification is not compliance: NIS2 adds legal duties that a management system standard does not address. Here is what carries over and what does not.
Two different things
| ISO/IEC 27001 | NIS2 | |
|---|---|---|
| What it is | A voluntary international standard for an information security management system (ISMS) | An EU directive, applied through national law |
| Who it applies to | Any organisation that chooses it | Essential and important entities in 18 sectors |
| How you show it | Certification by an accredited certification body | Supervision by national competent authorities, with fines |
| Core idea | Risk-based management system with a reference set of controls (93 in the 2022 edition, in four themes) | Minimum risk-management measures (Art. 21), management duties (Art. 20), incident reporting (Art. 23) |
The link is official
NIS2 asks entities to take into account relevant European and international standards when choosing their measures (Article 21(1)). For digital infrastructure and digital service providers, recital 3 of Implementing Regulation (EU) 2024/2690 states that its detailed requirements are based on European and international standards such as ISO/IEC 27001, ISO/IEC 27002 and ETSI EN 319 401. So an ISO 27001 management system is a natural foundation for NIS2.
Where ISO 27001 gives you a head start
- Risk analysis and security policy (NIS2 21(2)(a)): the ISMS is built on risk assessment, treatment and an approved policy.
- Incident handling, continuity, supply chain, secure development, cryptography, HR security, access control and asset management (21(2)(b) to (j)): all are covered by controls in the standard's reference set.
- Assessing effectiveness (21(2)(f)): internal audit, management review and continual improvement are built into the standard.
- Evidence: documented policies, risk registers and audit records are exactly what an authority will ask to see.
What certification does not cover
| NIS2 duty | Why ISO 27001 alone is not enough | Article |
|---|---|---|
| Management body approves the measures, oversees them, follows training and can be held liable | The standard expects top management commitment, but not personal liability or mandatory training for every board member | 20 |
| Early warning within 24 hours, notification within 72 hours, final report within one month | The standard requires incident management, not specific legal deadlines or recipients | 23 |
| Registration with the competent authority, and changes within two weeks | Not part of a management system standard | 3(4), 27 |
| Measures that national law or Implementing Regulation 2024/2690 make mandatory | Your scope and Statement of Applicability may exclude controls that the law requires | 21, national law |
| Supervision, inspections, binding instructions and fines | Certification audits are not regulatory supervision | 32 to 34 |
Watch your scope: an ISO 27001 certificate covers the scope you defined. If that scope leaves out business units, sites or services that are in NIS2 scope, the certificate does not speak for them.
If you are certified: a gap list
- Check the certificate's scope against the services and entities that are in NIS2 scope.
- Map your Statement of Applicability against the ten Article 21(2) measures and, if you are a digital provider, the 13 areas of the 2024/2690 Annex.
- Add the NIS2 incident reporting deadlines, contacts and templates to your incident procedure.
- Put the Article 20 board duties in place: formal approval, oversight reporting and training records.
- Register with your authority and keep the registration current.
- Where you cannot implement a requirement because of your size, recital 5 of 2024/2690 allows suitable compensating measures; document them.
If you are not certified
You do not need ISO 27001 certification to comply with NIS2. Certification is a sound way to structure the work and to show customers, but the law asks for measures, not a certificate. Many small entities start with the NIS2 measures directly; see our NIS2 compliance checklist.
Build the management system. The ISO 27001 Implementation Toolkit includes an ISMS scope document, a Statement of Applicability workbook, a risk assessment register, an information security policy, an asset inventory, an internal audit checklist and a management review template. The free NIS2 Readiness Check then shows the NIS2-specific gaps.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 3, 20, 21, 23, 27 and 32 to 34, EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690, recitals 3 and 5, Annex, EUR-Lex
- ISO/IEC 27001:2022, ISO
- IAF MD 26: transition requirements for ISO/IEC 27001:2022
Related tools
Further reading: NIS2 Compliance Checklist · Does NIS2 Apply to My Company?
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.