Guides to ISO 27001, NIS2 and DORA
These guides from ComplyPilot (EU compliance platform) explain European security and resilience rules in plain language. Each one starts with a direct answer, compares the options side by side and links to the official legal text.
Last updated:
NIS2 vs ISO 27001: what is the difference?
NIS2 is a binding EU directive that requires in-scope organisations to implement cybersecurity measures and report incidents; ISO 27001 is a voluntary international standard for building a certifiable information security management system. An ISO 27001 ISMS covers most of the NIS2 Article 21 measures, but NIS2 adds legal duties such as 24-hour incident warnings and management liability.
By Wouter, Marketing Manager
DORA vs NIS2: what is the difference?
DORA is a directly applicable EU regulation on digital operational resilience for financial entities, applying since 17 January 2025; NIS2 is an EU directive on cybersecurity for essential and important entities across 18 sectors. For financial entities covered by both, DORA is the more specific law and takes precedence on ICT risk management and incident reporting.
By Wouter, Marketing Manager
ISO 27001:2022 controls checklist
ISO/IEC 27001:2022 Annex A lists 93 information security controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. For each control you decide whether it applies, record the justification in your Statement of Applicability, and keep evidence that implemented controls work.
By Wouter, Marketing Manager
NIS2 Article 21: the ten risk-management measures explained
Article 21 of the NIS2 Directive requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risk. Article 21(2) lists ten minimum measures, from risk-analysis policies and incident handling to supply-chain security, cryptography and multi-factor authentication.
By Wouter, Marketing Manager
How long does ISO 27001 certification take for a startup?
For a small, cloud-based startup, ISO 27001 certification commonly takes around three to nine months from kick-off to certificate, depending on scope, existing security practices and auditor availability. The biggest factors are how quickly you can implement missing controls and how long you operate the ISMS before the Stage 2 audit.
By Wouter, Marketing Manager
What is audit-ready evidence?
Audit-ready evidence is documentation or records that prove a control is designed and operating, and that an auditor can review without further explanation. Good evidence is current, dated, attributable to an owner, linked to the control and requirement it supports, and retrievable in minutes.
By Wouter, Marketing Manager