ISO 27001 vs NIS2: What ISO Covers, Point by Point

ENISA's own mapping links every technical measure in the NIS2 Implementing Regulation to ISO 27001. So why isn't an ISO certificate enough? The answer is in what the mapping doesn't cover.

If you hold an ISO 27001 certificate and NIS2 applies to you, the first question is how much of the work is already done. The good news is that ENISA, the EU's cybersecurity agency, has answered most of it: its implementation guidance maps every point of the NIS2 Implementing Regulation to ISO 27001 clauses or Annex A controls.

Here is what that mapping looks like, requirement by requirement, and the parts of NIS2 it doesn't touch.

The headline number

Of the 49 NIS2 requirement points, 49 (100%) map to something in ISO 27001, 0 are only loosely related and 0 have no mapping in our data. Open the gap report →

Every one of the requirement points in the Annex of Implementing Regulation (EU) 2024/2690 maps to something in ISO 27001. These links come from ENISA's own mapping table, not from our judgement, which is why they are labelled crosswalk.

Every NIS2 point and its ISO counterpart

NIS2	Requirement	Match	ISO 27001
1.1	Policy on the security of network and information systems	Crosswalk	A.5.1 A.5.37 Clause 5.2 A.5.4
1.2	Roles, responsibilities and authorities	Crosswalk	A.5.2 A.5.4 A.5.3 Clause 5.3
2.1	Risk management framework	Crosswalk	Clause 6.1.1 Clause 6.1.2 Clause 6.1.3 A.5.7
2.2	Compliance monitoring	Crosswalk	A.5.31 Clause 9.1 A.5.36 A.5.35
2.3	Independent review of information and network security	Crosswalk	A.5.31 A.5.36 Clause 9.1 A.5.35
3.1	Incident handling policy	Crosswalk	A.5.24 A.5.25 A.5.26
3.2	Monitoring and logging	Crosswalk	A.5.25 A.8.15 A.8.16 A.8.17
3.3	Event reporting	Crosswalk	A.5.5 A.6.8
3.4	Event assessment and classification	Crosswalk	A.5.25 A.8.16
3.5	Incident response	Crosswalk	A.5.24 A.5.25 A.5.26 A.5.28
3.6	Post-incident reviews	Crosswalk	A.5.27 Clause 10.1
4.1	Business continuity and disaster recovery plan	Crosswalk	A.5.29 A.5.30 A.8.14
4.2	Backup management	Crosswalk	A.5.30 A.8.13 A.8.14
4.3	Crisis management	Crosswalk	A.5.26 A.5.29 A.5.30 A.8.14
5.1	Supply chain security policy	Crosswalk	A.5.19 A.5.20 A.5.21 A.5.22
5.2	Directory of suppliers and service providers	Crosswalk	A.5.19 A.5.20 A.5.22
6.1	Security in acquisition of ICT services, ICT systems or ICT products	Crosswalk	A.5.19 A.5.20 A.5.21 A.5.22
6.2	Secure development life cycle	Crosswalk	A.8.25 A.8.26 A.8.28 A.8.29
6.3	Configuration management	Crosswalk	A.8.9
6.4	Change management, repairs and maintenance	Crosswalk	A.7.13 A.8.32 Clause 6.3 Clause 8.1
6.5	Security testing	Crosswalk	A.8.8 A.8.29 A.8.33 A.8.34
6.6	Security patch management	Crosswalk	A.8.8 A.8.31 A.8.32
6.7	Network security	Crosswalk	A.8.20 A.8.21 A.8.22 A.8.16
6.8	Network segmentation	Crosswalk	A.5.15 A.8.5 A.8.20 A.8.21
6.9	Protection against malicious and unauthorised software	Crosswalk	A.5.14 A.8.19 A.8.1 A.8.7
6.10	Vulnerability handling and disclosure	Crosswalk	A.8.8
7.1	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Crosswalk	Clause 6.1.1 Clause 6.1.3 Clause 6.2 Clause 9.1
8.1	Awareness raising and basic cyber hygiene practices	Crosswalk	A.6.3 Clause 7.3 A.8.7
8.2	Security training	Crosswalk	A.6.3 Clause 7.3 Clause 7.2
9.1	Cryptography	Crosswalk	A.8.24 A.5.31
10.1	Human resources security	Crosswalk	A.6.2 A.6.3 Clause 7.1 Clause 7.2
10.2	Verification of Background	Crosswalk	A.6.1 A.6.4 A.8.16
10.3	Termination or change of employment procedures	Crosswalk	A.6.5
10.4	Disciplinary process	Crosswalk	A.6.1 A.6.4 A.8.16 A.5.28
11.1	Access control policy	Crosswalk	A.5.15 A.5.16 A.5.18 A.8.3
11.2	Management of access rights	Crosswalk	A.5.15 A.5.16 A.5.18 A.8.3
11.3	Privileged accounts and system administration accounts	Crosswalk	A.8.2 A.8.18
11.4	Administration systems	Crosswalk	A.8.2 A.8.18
11.5	Identification	Crosswalk	A.5.15 A.5.16 A.5.18 A.8.3
11.6	Authentication	Crosswalk	A.5.15 A.8.5 A.8.22 A.5.17
11.7	Multi-factor authentication	Crosswalk	A.8.5
12.1	Asset classification	Crosswalk	A.5.12 A.5.13 A.5.9
12.2	Handling of assets	Crosswalk	A.5.14 A.8.10 A.8.11 A.5.9
12.3	Removable media policy	Crosswalk	A.5.14 A.8.10 A.8.11 A.8.12
12.4	Asset inventory	Crosswalk	A.5.9 A.5.11 A.7.14
12.5	Deposit, return or deletion of assets upon termination of employment	Crosswalk	A.5.11 A.5.18 A.8.24
13.1	Supporting utilities	Crosswalk	A.7.1 A.7.2 A.7.3 A.7.4
13.2	Protection against physical and environmental threats	Crosswalk	A.7.1 A.7.2 A.7.3 A.7.4
13.3	Perimeter and physical access control	Crosswalk	A.7.1 A.7.2 A.7.3 A.7.4

Read the table as "where to look in your ISMS", not as "already done". A mapping says the ISO control addresses the same subject. Whether your implementation meets the NIS2 point depends on how you implemented the control and on the detail of the NIS2 text, which is often more specific than Annex A.

What ISO 27001 doesn't give you

The Implementing Regulation covers the risk-management measures of Article 21. NIS2 itself asks for more, and none of it is in ISO 27001:

Incident reporting deadlines (Article 23): an early warning to the CSIRT or competent authority within 24 hours of becoming aware of a significant incident, a notification within 72 hours, and a final report within one month. ISO 27001 requires incident management, not regulatory notification on a clock.
Management accountability (Article 20): the management body must approve the measures, oversee them and take part in training, and can be held liable. ISO's clause 5 asks for leadership commitment, which is weaker.
Registration with your national authority, and supervision by it.
Scope: an ISO certificate can cover part of an organisation. NIS2 applies to the entity.

Some Annex points also go further than the matching ISO control. Supply-chain security, vulnerability handling and disclosure, and cryptography are common examples: the ISO control exists, but NIS2 spells out more.

The other direction: what NIS2 leaves out of ISO

Of the 123 ISO 27001 Annex A controls and ISMS clauses, 104 (85%) map to something in NIS2, 13 are only loosely related and 6 have no mapping in our data. Open the gap report →

The ISO requirements with no NIS2 mapping are management-system mechanics:

ISO 27001	Requirement	Match	NIS2
Clause 4.3	Determining the scope of the ISMS	No mapping in our data	—
Clause 5.1	Leadership and commitment	No mapping in our data	—
Clause 7.5.1	General	No mapping in our data	—
Clause 7.5.2	Creating and updating	No mapping in our data	—
Clause 7.5.3	Control of documented information	No mapping in our data	—
Clause 10.2	Nonconformity and corrective action	No mapping in our data	—

NIS2 doesn't ask you to run a certifiable management system, so ISMS scoping, document control and formal corrective action have no direct counterpart. That cuts both ways. An organisation building for NIS2 from scratch doesn't need them, but an ISMS gives you the strongest evidence that your measures are effective, which Article 21(2)(f) does require.

Photograph of a clipboard with a partly ticked checklist resting on a stack of bound documents on a meeting table — A mapping is a checklist of where to look, not proof you comply.

What to do if you hold ISO 27001

Confirm you are in scope under the national law of each country you operate in, and register where required.
Check your certificate's scope covers the whole entity, not just one service or site.
Run the comparison from your Statement of Applicability to the Annex points above; our ISO 27001 → NIS2 gap report exports it as a tracker.
Add what ISO doesn't cover to the ISMS: the reporting procedure with its 24- and 72-hour deadlines, management training, and registration. Putting them inside the ISMS means your internal audit and surveillance audits check them too.
Deepen the controls where NIS2 is more specific, starting with supply-chain security and vulnerability handling.

For the bigger picture, see our NIS2 guide and the full ISO 27001 vs NIS2 comparison.

Questions

Does ISO 27001 certification make you NIS2 compliant?

No. It covers most of the technical and organisational measures, but NIS2 adds incident reporting deadlines, management training and accountability, registration with the national authority, and some requirements that are more specific than Annex A. National authorities, not certification bodies, decide compliance.

What is the NIS2 Implementing Regulation?

Commission Implementing Regulation (EU) 2024/2690 sets out the NIS2 Article 21 measures in detail for DNS providers, TLD registries, cloud and data centre providers, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.

Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.

What ISO 27001 covers in NIS2, point by point