From ISO 27001 to NIS2: a practical gap-closing plan

For an organisation that already holds ISO 27001, NIS2 is mostly an extension. ENISA's mapping links every technical measure in the NIS2 Implementing Regulation to ISO 27001, and our point-by-point analysis shows how. But "maps" isn't "done", and the parts ISO doesn't cover are exactly the ones regulators check first. This is the order of work we'd follow.

Of the 49 NIS2 requirement points, 49 (100%) map to something in ISO 27001, 0 are only loosely related and 0 have no mapping in our data. Open the gap report →

Phase 1: confirm and register (weeks 1 to 4)

1. Confirm scope and classification under the national law of each EU country where you provide services: sector, size, essential or important.
2. Register with the competent authority where required. Deadlines and formats differ by country.
3. Compare scopes: your ISO certificate may cover part of the organisation; NIS2 covers the entity. Plan to extend the ISMS scope.

Phase 2: governance (months 1 to 2)

1. Brief the management body on its Article 20 duties: approve the measures, oversee them and complete training. Record the approval and the training.
2. Add NIS2 to the ISMS: list it among legal requirements (A.5.31), include it in the risk assessment, and add NIS2 references to the Statement of Applicability.

Phase 3: reporting (months 1 to 3)

1. Build the significant-incident reporting procedure: who decides significance, who notifies the CSIRT or authority, and how you meet the 24-hour early warning, 72-hour notification and one-month final report. Our post on building that procedure covers it step by step.
2. Test it, including out of hours.

Phase 4: deepen the technical measures (months 2 to 6)

1. Run the requirement-by-requirement comparison with the ISO 27001 → NIS2 gap report and mark each point met, partly met or not met.
2. Prioritise the usual gaps: supply chain security (supplier criteria and contract terms), vulnerability handling and coordinated disclosure, cryptography policy, and effectiveness assessment (Article 21(2)(f)).
3. Write the NIS2 detail into existing ISO controls rather than creating parallel ones.

Phase 5: prove it works (ongoing)

1. Include NIS2 in internal audit and management review.
2. Keep evidence of effectiveness: metrics, test results and audit findings, because supervisors ask for proof that measures work, not just that they exist.
3. Watch national guidance: authorities are still publishing expectations and templates.

Who does what

A plan like this needs more than the ISMS manager:

• The management body: approves the measures, completes training and receives regular reports.
• Legal or compliance: confirms scope under national law, handles registration and tracks national guidance.
• Security operations: owns the reporting procedure, the significance decision and the exercises.
• Procurement: brings supplier selection criteria and security clauses into contracts.
• Engineering and IT: closes technical gaps such as vulnerability disclosure, cryptography and effectiveness metrics.
• The ISMS manager: coordinates, keeps the mapping and evidence current, and runs internal audit.

Naming these roles at the start avoids the most common failure: a NIS2 programme run entirely by the security team, which can't approve its own measures or rewrite procurement contracts.

Key takeaways

• For ISO-certified organisations, NIS2 is an extension, not a new programme.
• Start with scope, registration, management duties and reporting.
• Then deepen supply chain, vulnerability handling and cryptography.

The trap to avoid

Treating NIS2 as a document exercise. ISO-certified organisations often have the policies already; supervisors will ask whether the reporting procedure works at 2 a.m., whether management has actually been trained, and whether supplier requirements are in real contracts. Put effort there first.

See the NIS2 guide and the ISO 27001 vs NIS2 comparison for the full picture.

Questions

How long does it take to go from ISO 27001 to NIS2?

It depends on scope and the gaps found, but because most technical measures map, the work is mainly governance, reporting, supplier security and deepening specific controls, often a matter of months rather than a new multi-year programme.

Do I need to recertify ISO 27001 for NIS2?

No. NIS2 compliance is judged by your national authority, not a certification body. Bringing NIS2 requirements into the ISMS means your existing audits check them too.

Is ENISA's mapping binding?

No. ENISA's mapping of the Implementing Regulation to ISO 27001 and NIST CSF 2.0 is guidance. National authorities decide compliance under national law.