NIS2 vs ISO 27001: What's the Difference and What Do You Need?

Many organisations face the same question: Do we need NIS2 compliance, ISO 27001 certification or both? It can be confusing to navigate these two frameworks, especially when they both concern information security.

The short answer is: NIS2 is legislation (you MUST comply if covered), whilst ISO 27001 is a voluntary standard (you CHOOSE). But the interesting part is that ISO 27001 covers around 70-80% of NIS2 requirements, making it a strong foundation for NIS2 compliance.

In this guide, you'll get a complete comparison of the two frameworks, see precisely where they overlap, and receive practical recommendations for what your organisation needs.

What is NIS2?

NIS2 (Network and Information Security Directive 2) is the EU's updated cybersecurity directive, which came into force in January 2023. The directive must be implemented in national legislation in all EU member states by October 2024, and organisations must be compliant from 17 October 2024.

NIS2 is mandatory legislation for organisations in critical and important sectors with more than 50 employees. It focuses specifically on cybersecurity for critical infrastructure and services essential to society's functioning.

The directive contains clear requirements for risk management, incident reporting and management accountability. Organisations covered by NIS2 must register with national authorities and are subject to supervision and potential sanctions for non-compliance.

The sanctions can be significant – up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% of turnover for important entities.

What is ISO 27001?

ISO 27001 is the internationally recognised standard for information security management systems (ISMS). Unlike NIS2, ISO 27001 is a voluntary standard that organisations can choose to implement and become certified in.

The standard follows a risk-based approach to information security and applies to all types of organisations, regardless of size or industry. ISO 27001 certification demonstrates to customers, partners and stakeholders that the organisation takes information security seriously.

An ISO 27001 certification is valid for three years with annual surveillance audits. The standard requires organisations to establish, implement, maintain and continually improve an ISMS based on their specific risk profile.

ISO 27001:2022 (the latest version) contains 93 controls in Annex A, covering organisational, technical and physical security measures. The organisation selects which controls are relevant based on their risk assessment.

Read more about ISO 27001 compliance and how to implement ISO 27001.

NIS2 vs ISO 27001: Quick Comparison

Is ISO 27001 Enough for NIS2 Compliance?

The Short Answer

No, ISO 27001 alone is not sufficient to meet all NIS2 requirements. But it covers approximately 70-80% of the requirements and therefore provides the best possible foundation for NIS2 compliance. If your organisation starts with ISO 27001, you significantly reduce the additional effort required to become NIS2-compliant.

What ISO 27001 Covers from NIS2

ISO 27001 covers most of the technical and organisational security requirements in NIS2:

✓ Risk assessment and management – Clause 6 and multiple Annex A controls
✓ Security policies – Comprehensive policies and procedures
✓ Incident handling – Processes for handling security incidents
✓ Business continuity – Continuity and disaster recovery
✓ Access control – Comprehensive controls for access management
✓ Cryptography – Requirements for cryptographic controls
✓ Awareness and training – Employee security education
✓ Supplier security – Supply chain security
✓ Asset management – Information asset management
✓ Secure development – Security in systems development

What NIS2 Requires Beyond ISO 27001

However, there are important areas where NIS2 requirements go beyond ISO 27001:

✗ Mandatory incident reporting to authorities – NIS2 requires reporting to CSIRT and national authorities
✗ Specific deadlines – 24 hours for early warning, 72 hours for incident report, 30 days for final report
✗ Registration as NIS2 entity – Formal registration requirement with authorities
✗ Sector-specific requirements – Some sectors have additional specific security requirements
✗ Personal management liability with sanctions – Management is personally liable and can be sanctioned
✗ Supply chain security – More explicit requirements for vendor management than ISO 27001
✗ Active cooperation with authorities – Ongoing cooperation and information sharing

NIS2 and ISO 27001: Requirement-by-Requirement Mapping

To understand precisely where ISO 27001 covers NIS2 requirements, here's a detailed mapping of NIS2 Article 21 security measures against ISO 27001 controls:

As the table shows, the primary gaps are not in the technical security measures, but in the compliance processes around reporting, registration and authority contact.

When Should You Have What?

Scenario 1: You Are Covered by NIS2

If your organisation falls within NIS2's scope, NIS2 compliance is mandatory. There's no way around it. However, we strongly recommend using ISO 27001 as the foundation:

Recommended approach:

1. Start by implementing the ISO 27001 framework (certification is optional)
2. Build NIS2-specific requirements on top of this foundation
3. Establish processes for incident reporting and authority contact
4. Register as a NIS2 entity with authorities

The advantage of this approach is that you get a solid, internationally recognised security system that also prepares you for NIS2.

Scenario 2: You Are NOT Covered by NIS2

If your organisation is not covered by NIS2, ISO 27001 is still relevant if:

• Customers or partners require it – Many larger companies require ISO 27001 certification from their suppliers
• You want to demonstrate security – Certification shows credibility to stakeholders
• You want to prepare for potential NIS2 – If your organisation grows or changes focus, you may become covered later

However, be aware that even if you're not directly covered by NIS2, your customers may be. This means that as part of their supply chain, you may be subject to requirements for security documentation.

Scenario 3: You Are Already ISO 27001 Certified

If your organisation is already ISO 27001 certified and becomes covered by NIS2, you're in a good position. You simply need to:

1. Identify gaps – Review the mapping table above
2. Implement incident reporting – Establish processes for 24h/72h/30d reporting
3. Register as NIS2 entity – Contact relevant authorities
4. Document management liability – Ensure management understands their personal liability
5. Update vendor assessments – Strengthen supply chain security where necessary

The good news is that much of the work has already been done through your ISO 27001 compliance.

Scenario 4: You're Starting from Scratch

If you need to start from the ground up with both NIS2 and information security, we recommend:

1. Use ISO 27001 as the framework – Even if certification isn't the goal
2. Include NIS2 requirements from the start – Avoid duplication later
3. Use an integrated management system – One system for both frameworks
4. Prioritise critical areas first – Start with risk assessment and basic controls

This approach gives you the most value for money and avoids having to do the work twice.

Practical Approach: ISO 27001 as Foundation for NIS2

Here's a practical approach to using ISO 27001 as the foundation for NIS2 compliance:

Step 1: Implement ISO 27001 ISMS

Start by establishing an information security management system based on ISO 27001:

• Conduct a comprehensive risk assessment of your information assets
• Develop security policies and procedures
• Implement relevant controls from Annex A based on your risks
• Establish processes for internal audit and continual improvement

This gives you a solid framework for security management, whether or not you choose to pursue certification.

Step 2: Identify NIS2 Gaps

Use the mapping table earlier in this article to identify where ISO 27001 doesn't fully cover NIS2 requirements:

• Incident reporting – Are you missing processes for authority reporting?
• Registration – Are you registered as a NIS2 entity?
• Management liability – Is management fully informed about their personal liability?
• Supply chain – Do your vendor assessments meet NIS2 requirements?

Step 3: Fill the Gaps

Implement the missing elements:

• Establish concrete processes for incident reporting with deadlines (24h/72h/30d)
• Register with relevant national authorities
• Document management's understanding and acceptance of liability
• Update data processing agreements and vendor contracts to include NIS2 requirements
• Establish contact point to CSIRT and national cybersecurity authorities

Step 4: Maintain Both

Operate an integrated management system where both frameworks are maintained together:

• Use the same platform for documentation and task management
• Coordinate internal audits to cover both frameworks
• Update risk and compliance assessments continuously
• Ensure training covers both ISO 27001 and NIS2 requirements

This integrated approach ensures you get maximum value from your compliance efforts without unnecessary duplication.

ENISA's Mapping: Official Guidance

The European Union Agency for Cybersecurity (ENISA) has published official guidance on the relationship between NIS2 and ISO 27001. ENISA confirms that ISO 27001 is a strong starting point for NIS2 compliance.

ENISA specifically recommends using ISO 27001:2022 (the latest version) rather than ISO 27001:2013, as the updated standard has better alignment with modern cybersecurity threats and requirements.

You can find ENISA's resources and guidance at www.enisa.europa.eu, where updated material on NIS2 implementation is continuously published.

What Do We Recommend?

Based on our experience with hundreds of organisations working with compliance, here are our recommendations:

For companies covered by NIS2:

1. Start with ISO 27001 – Use it as a framework, even if certification isn't required
2. Consider certification – It provides credibility and facilitates compliance documentation
3. Add NIS2-specific requirements – Focus on gaps around reporting and registration
4. Use one integrated system – Avoid duplicate documentation and administration

For companies NOT covered by NIS2:

1. Assess business needs – Is ISO 27001 relevant for your customers and market?
2. Be aware of supply chain – Your customers may be covered and impose requirements on you
3. Start simple – Implement basic information security and scale up as needed
4. Prepare for the future – Your organisation may grow into NIS2's scope

The most important message is: Whether you're covered by NIS2 or not, a structured approach to information security provides value to the organisation. ISO 27001 gives you this framework, and if NIS2 becomes relevant, the work is already half done.

How .legal Helps with Both Frameworks

At .legal, we've developed a platform that specifically handles both NIS2 and ISO 27001 in one integrated system. Our Frameworks module gives you:

• Pre-built frameworks with complete mapping between NIS2 and ISO 27001
• Automatic tracking of overlap, so you don't document the same thing twice
• Integrated task management with annual wheel for both frameworks
• Reporting to management, internal audits and authority reporting
• Vendor management that meets both ISO 27001 and NIS2 requirements

With .legal, you get an overview of your compliance status across frameworks and can focus on the actual security work instead of documentation administration.

See how we handle NIS2 and ISO 27001 or book a demo to see the platform in action.

Frequently asked questions about NIS2 vs ISO27001