NIS2 vs ISO 27001
NIS2 is mandatory — ISO/IEC 27001 is your accelerator. We show how EU Directive 2022/2555 and the international ISMS standard overlap, where the decisive gaps lie and how an existing ISO 27001 system shortens your NIS2 implementation by months. With a concrete article-to-Annex mapping and a clear recommendation for mid-sized businesses.
NIS2 and ISO 27001 in direct comparison
Same goal, different obligation: both aim at information security — but NIS2 is EU law with liability, ISO 27001 a certifiable standard
Regulation vs. standard
NIS2 (EU Directive 2022/2555) is mandatory EU law with fines of up to €10 million or 2% of annual turnover. ISO/IEC 27001 is a voluntary, certifiable standard. Both target information security — but with a different level of obligation.
Scope of application
NIS2 applies, depending on the sector, to around 30,000 companies in Germany (BSI estimate) across 18 sectors. ISO 27001 can be adopted voluntarily by any organisation. NIS2 dictates WHAT must be protected; ISO 27001 provides the HOW.
Shared risk core
Both require a risk-based approach, a management system that is actually practised and the anchoring of security at management level. Article 21 NIS2 and Annex A of ISO 27001 overlap to a large extent in terms of content.
Compliance accelerator
According to the BSI guidance, an existing ISMS based on ISO 27001 already covers a large part of the NIS2 minimum measures. Certified companies typically shorten their NIS2 project by several months.
The NIS2 gaps
ISO 27001 alone is not enough: NIS2 requires statutory reporting obligations (24h/72h), registration with the BSI, personal liability of management and supply chain security — points that go beyond the ISO scope.
Recommendation for SMEs
For mid-sized businesses, ISO 27001 is the pragmatic entry point: structured, recognised and eligible for funding. We combine a lean ISMS with a targeted NIS2 delta assessment — without duplicated effort.
The NIS2 → ISO 27001 mapping in detail
This is how the minimum measures from Article 21 NIS2 map to the controls in Annex A of ISO/IEC 27001:2022 — the foundation of every efficient NIS2 project
Governance & responsibility
Art. 21 (2) NIS2 requires security governance at management level — congruent with ISO 27001 Clause 5 (Leadership). Here ISO delivers the documented role and responsibility structure that NIS2 demands.
Risk management
The risk-based approach from Art. 21 (1) NIS2 corresponds to ISO 27001 Clauses 6 & 8 (risk assessment and treatment) as well as Annex A 5.7 (threat intelligence). An ISO risk process directly fulfils the NIS2 core requirement.
Incident management & reporting obligation
Art. 23 NIS2 mandates an initial report within 24h and a full report within 72h to the BSI. ISO 27001 Annex A 5.24–5.28 governs incident management — we add the statutory NIS2 reporting channels as a NIS2 delta.
Business continuity
Backup, emergency and crisis management under Art. 21 (2c) NIS2 are mirrored in ISO 27001 Annex A 5.29–5.30 and in ISO 22301. This is how you demonstrably safeguard the operational continuity required by NIS2.
Supply chain security
Art. 21 (2d) NIS2 requires security in the supply chain — mapped via ISO 27001 Annex A 5.19–5.23 (supplier relationships, cloud services). An often underestimated NIS2 focus that is relevant in audits.
Cryptography & access control
Encryption and MFA under Art. 21 (2h/j) NIS2 correspond to ISO 27001 Annex A 8.24 (cryptography) as well as A 5.15–5.18 & 8.5 (access control, secure authentication). Largely congruent from a technical perspective.
Awareness & cyber hygiene
Art. 21 (2g) NIS2 requires basic cyber hygiene and training — covered by ISO 27001 Annex A 6.3 (awareness) and Clause 7.2/7.3 (competence and awareness). On this basis we build a NIS2-compliant training programme.
Effectiveness measurement
Art. 21 (2f) NIS2 requires concepts for assessing effectiveness. ISO 27001 Clause 9 (performance evaluation: internal audits, management review) and 10 (continual improvement) provide the PDCA evidence that auditors and the BSI want to see.
Frequently asked questions
The questions we are asked most often before a project – with answers on process, costs and data protection.
What is the difference between NIS2 and ISO 27001?
NIS2 (EU Directive 2022/2555) is mandatory EU law for operators of essential and important entities in 18 sectors and provides for fines of up to EUR 10 million or 2% of global annual turnover as well as personal management liability. ISO/IEC 27001, by contrast, is a voluntary, internationally certifiable standard for information security management systems (ISMS). In short: NIS2 legally prescribes WHAT must be protected and sets reporting and registration obligations; ISO 27001 provides the recognised methodology for HOW security is systematically implemented and demonstrated.
Does an ISO 27001 certification automatically meet the NIS2 requirements?
No, not fully. According to the BSI guidance, an ISMS under ISO 27001 covers a large part of the risk management measures from Article 21 NIS2 — often 70 to 80%. However, specific NIS2 obligations remain that go beyond the ISO scope: registration with the BSI, the statutory reporting obligations (initial report within 24 hours, report within 72 hours, final report within one month), the personal liability of the management bodies and, in some cases, stricter supply chain security requirements. ISO 27001 is therefore a strong accelerator, but not an automatic proof of NIS2 compliance.
What does a concrete NIS2-to-ISO-27001 mapping look like?
The minimum measures from Art. 21 (2) NIS2 can largely be mapped to the controls in Annex A of ISO/IEC 27001:2022: risk analysis (Art. 21 2a) → ISO clause 6/8 & A 5.7; incident handling and reporting (Art. 21 2b, Art. 23) → A 5.24–5.28; business continuity and backup (Art. 21 2c) → A 5.29–5.30; supply chain security (Art. 21 2d) → A 5.19–5.23; cryptography (Art. 21 2h) → A 8.24; MFA and access control (Art. 21 2j) → A 5.15–5.18 & 8.5; cyber hygiene and training (Art. 21 2g) → A 6.3 & clause 7; effectiveness assessment (Art. 21 2f) → ISO clause 9/10. Governance at management level corresponds to ISO clause 5.
How does ISO 27001 accelerate NIS2 compliance?
An existing ISO 27001 ISMS already provides the building blocks that NIS2 requires: a documented risk management process, defined roles and responsibilities, incident management processes, business continuity plans, supplier management and a PDCA cycle with internal audits and management review. This removes the need to build from scratch. In practice, a NIS2 project for certified companies is reduced to a delta assessment: we only check the NIS2-specific additional obligations and close the gaps in a targeted way — which typically shortens implementation by several months.
Should SMEs implement ISO 27001 first or NIS2 directly?
For small and medium-sized enterprises we recommend the path via a lean ISO 27001-oriented ISMS as a foundation, supplemented by a NIS2 delta. ISO 27001 is structured, internationally recognised, required in many tenders and creates auditable evidence. On top of that we add the mandatory NIS2 elements — registration, reporting processes and liability documentation. This way SMEs avoid duplicate effort: one system that covers both the certification benefit of ISO and the statutory NIS2 obligation. A full, expensive ISO certification is not mandatory for NIS2 — but the ISO methodology as a blueprint is highly efficient.
Which NIS2 obligations does ISO 27001 not cover?
ISO 27001 addresses the technical and organisational security measures, but not the purely legal NIS2 obligations. Not covered are in particular: the registration obligation with the competent authority or the BSI, the legally fixed reporting deadlines to the BSI (24h/72h/1 month under Art. 23), the personal responsibility and liability of the management including mandatory training of the management bodies (Art. 20 NIS2) as well as official supervisory and sanction mechanisms. We add these points within the NIS2 consulting as a standalone module beyond the ISMS.
Ready for the next step?
Let's discuss in a free initial consultation how we can move your business forward.