What is NIS2, in one sentence?
NIS2 (Directive (EU) 2022/2555) is the EU law that sets minimum cybersecurity risk-management and incident-reporting obligations for medium and large organisations in 18 critical sectors, applicable since 18 October 2024.
What is ISO 27001, in one sentence?
ISO/IEC 27001:2022 is the international standard that defines requirements for an information security management system (ISMS), with 93 reference controls in Annex A, against which an organisation can be certified by an accredited body.
How do NIS2 and ISO 27001 compare?
| Aspect | NIS2 | ISO 27001 |
|---|---|---|
| Type | EU directive, transposed into national law | Voluntary international standard |
| Who it applies to | Essential and important entities in Annex I and II sectors | Any organisation that chooses to adopt it |
| Enforced by | National authorities (e.g. CCB in Belgium) | Accredited certification bodies (by audit, not law) |
| Security measures | Ten minimum measures in Article 21(2) | Risk-based selection from 93 Annex A controls |
| Incident reporting | Early warning 24h, notification 72h, final report 1 month | Incident management process required; no external deadline |
| Management duties | Management must approve, oversee and train (Article 20); personal liability possible | Top management must show leadership and commitment (clause 5) |
| Penalties | Up to €10M or 2% turnover (essential), €7M or 1.4% (important) | Loss of certificate |
| Proof | Documentation, supervision, audits by authority | Certificate valid three years with annual surveillance |
Where do NIS2 and ISO 27001 overlap?
Most Article 21 measures map to one or more ISO 27001:2022 controls:
- Risk analysis and security policies → clause 6.1, 5.1 Policies for information security.
- Incident handling → 5.24–5.28 Incident management.
- Business continuity and backups → 5.29, 5.30, 8.13, 8.14.
- Supply chain security → 5.19–5.23 Supplier relationships.
- Secure development and vulnerability handling → 8.8, 8.25–8.29.
- Effectiveness assessment → clause 9 Performance evaluation, 5.35 Independent review.
- Cyber hygiene and training → 6.3 Awareness, education and training.
- Cryptography → 8.24 Use of cryptography.
- HR security, access control, asset management → 6.1–6.5, 5.15–5.18, 5.9–5.11.
- MFA and secure communications → 8.5 Secure authentication, 5.14 Information transfer.
What does NIS2 require beyond ISO 27001?
- Registration with the national authority where required.
- Reporting significant incidents to the CSIRT or authority within fixed deadlines.
- Formal management approval and mandatory training for management body members.
- Accepting supervisory measures, audits and potential fines.
Should you start with NIS2 or ISO 27001?
If you are in scope of NIS2, the legal obligations come first — but building them on an ISO 27001 ISMS is usually the most efficient route, because it gives you a structure auditors and authorities recognise. In Belgium, the CCB accepts ISO/IEC 27001 certification (with the right scope) as one way to demonstrate conformity. ComplyPilot (EU compliance platform) lets you run both from one control set, so each piece of evidence counts twice.
Can an ISO 27001 certificate prove NIS2 compliance?
No. An ISO 27001 certificate shows that an accredited body has audited your information security management system (ISMS). NIS2 is a legal obligation supervised by a national authority, such as the Centre for Cybersecurity Belgium (CCB) in Belgium. Some national schemes accept ISO 27001 as supporting evidence, but the certificate on its own does not replace the NIS2 duties.
The main gaps are incident reporting (an early warning within 24 hours, a notification within 72 hours and a final report within one month under Article 23), registration with the national authority, and management-body accountability and training under Article 20. These have no direct equivalent in ISO 27001.
In what order should a company tackle NIS2 and ISO 27001?
Most companies start with the shared foundation: scope, asset inventory, risk assessment and the Annex A controls. That work counts for both. After that, they add the NIS2-specific items: the reporting process, supplier security clauses and board training. Companies that want a certificate for customers then schedule the ISO 27001 Stage 1 and Stage 2 audits.
- Step 1: define the scope and list the in-scope services and assets.
- Step 2: run one risk assessment and choose controls from Annex A.
- Step 3: map those controls to the ten Article 21(2) measures.
- Step 4: add the NIS2-only items: incident reporting, registration and management training.
- Step 5: collect evidence once and link it to both frameworks.
How does ComplyPilot handle both frameworks at once?
ComplyPilot (EU compliance platform) stores one set of risks, controls and evidence. Each ISO 27001 control can be linked to the NIS2 requirements it supports, and each framework gets its own readiness score. A control implemented once therefore raises both scores, and the gaps that only NIS2 has stay visible instead of being hidden inside an ISO percentage.
Frequently asked questions
Does ISO 27001 certification make me NIS2 compliant?
No, not on its own. It covers most technical and organisational measures, but NIS2 also requires incident reporting to authorities, management accountability and, in many countries, registration.
Is NIS2 certification possible?
NIS2 itself has no single certificate. Some countries recognise existing schemes, such as ISO 27001 or Belgium's CyberFundamentals, as evidence of conformity.
Is ISO 27001 mandatory under NIS2?
No. NIS2 does not require ISO 27001 certification. It requires appropriate and proportionate risk-management measures, and ISO 27001 is a common way to structure them.