NIS2 vs ISO 27001: is your ISMS enough?

By Paul Gillet · Updated 2026-10-17

NIS2 (Directive (EU) 2022/2555) requires essential and important entities across the EU to take cybersecurity risk-management measures and report significant incidents. Commission Implementing Regulation (EU) 2024/2690 spells those measures out in detail for digital-infrastructure and ICT-service providers (DNS, cloud, data centres, managed and managed security service providers, online platforms and others). ENISA's technical implementation guidance maps every one of its requirements to ISO/IEC 27001:2022.

That mapping is why every NIS2 point below shows as covered when you already have ISO 27001: ENISA links each point to specific ISO clauses or Annex A controls. An ISO 27001 ISMS is the most direct route to NIS2 technical readiness, and many member states treat it as strong evidence.

But ENISA is explicit that implementing the mapped standards "does not assume compliance". NIS2 also brings obligations ISO doesn't: management-body accountability and training (Article 20), incident reporting to your CSIRT or authority on fixed deadlines (Article 23: 24-hour early warning, 72-hour notification, final report within a month), registration with your national authority, and national transposition details that vary by country.

Going from NIS2 to ISO, the remaining work is the certifiable management system: scope, leadership, documented information, internal audit and management review.

At a glance

What ISO 27001 does not give you

• Reporting deadlines: a tested procedure to decide whether an incident is significant and to notify within 24 and 72 hours, including out of hours.
• Management training and liability: Article 20 requires the management body to be trained and to approve the measures.
• Registration with your national authority.
• Specific technical requirements: some Implementing Regulation points (for example on cryptography, vulnerability handling and supply-chain security) are more prescriptive than the matching Annex A control.
• Scope: an ISO certificate may cover only part of the organisation; NIS2 applies to the entity.

Using ISO 27001 as the backbone

If you are certified, run a gap assessment from your Statement of Applicability against the Implementing Regulation's Annex (or Article 21 under your national law), extend the ISMS scope to the whole entity if needed, and add the reporting procedure and management training to the ISMS so they are audited with everything else. Authorities, not certification bodies, decide compliance, but a working ISMS is strong evidence of effective measures.

Who needs which

NIS2 is mandatory for essential and important entities in the sectors it lists, generally medium-sized and larger organisations operating in the EU, plus some smaller providers such as DNS and trust service providers. ISO 27001 is voluntary but often required by customers. Organisations in scope for NIS2 that also sell to enterprises or bid for public contracts usually end up with both: NIS2 because the law requires it, ISO 27001 because customers ask for a certificate.

Cost and effort

For an organisation that already holds ISO 27001, most NIS2 cost is in governance and process rather than technology: management training and approval, a tested significant-incident reporting procedure, supplier security requirements written into contracts, registration, and evidence that measures work. Technical gaps exist but are usually narrower: vulnerability disclosure, cryptography rules and specific supply-chain measures. For an organisation starting from nothing, building an ISO-style ISMS is often the most efficient way to meet NIS2's Article 21 measures, whether or not it then certifies.

Timeline

An ISO-certified organisation can typically close the NIS2-specific gaps in three to six months: registration and management training first, the reporting procedure within the first quarter, then supplier security and the more specific technical measures. Our ISO 27001 to NIS2 plan sets out the order in detail. Starting without ISO, plan for the six to twelve months a first ISMS usually takes, with reporting and governance prioritised because supervisors check them first.

Worked example: a managed service provider

A 200-person managed service provider in the EU holds ISO 27001 for its hosting and support services. As a managed service provider, it falls under NIS2, and the Implementing Regulation's detailed measures apply to it directly.

The ENISA mapping shows every Implementing Regulation point linked to an ISO control it already runs. Its gap work therefore focuses on: extending the ISMS scope from two service lines to the whole entity; training the management board and recording its approval of the measures; building a 24-hour significant-incident reporting procedure with out-of-hours cover; adding security requirements and incident-notification clauses to its own supplier contracts; and publishing a coordinated vulnerability disclosure policy. Within six months it can show its national authority a working, audited set of measures, with the ISMS providing the evidence of effectiveness that Article 21(2)(f) asks for.

Common mistakes

• Assuming the certificate settles it. Supervisors assess NIS2 compliance; certification bodies don't.
• Leaving the scope narrow. An ISO scope covering one service line doesn't cover an entity-wide legal obligation.
• Writing a reporting procedure nobody has tested, especially out of hours, when the 24-hour clock is hardest to meet.
• Ignoring national law. Registration, supervision and some details differ between member states.
• Training management once and forgetting it. Article 20 expects training to be maintained, not a single session.

Key takeaways

• ISO 27001 → NIS2: technical measures are largely covered; add Article 23 reporting procedures, management training and national registration.
• Check your country's transposition: requirements and supervisory practice differ by member state.
• Make sure supply-chain security (CIR section 5) is evidenced, not just policy.

Download this comparison (CSV) Open in gap analysis →