"We're ISO 27001 certified, so we're NIS2 compliant." This statement comes up often in executive meetings—and it's incorrect. But the relationship between NIS2 and ISO 27001 is more nuanced than a simple "sufficient" or "insufficient." Here’s what the standard actually covers, where it falls short, and how to use it as a true compliance accelerator.
Key Takeaway — The 3 Levels to Distinguish
ISO 27001 certification falls into the third category. It is a powerful tool, not a requirement.
The first thing to remember is simple: NIS2 is deliberately non-prescriptive regarding the means.
"Essential and important entities shall take appropriate and proportionate technical, operational, and organizational measures to manage the risks posed to the security of network and information systems."
— Directive (EU) 2022/2555, Article 21
The directive defines expected outcomes and competencies to be demonstrated. It leaves it up to organizations to choose the means to achieve them. No standards, tools, or certifications are mandated. What matters is being able to explain and justify your actions in a manner consistent with the identified risks.
With that in mind, ISO 27001 is neither mandatory nor the only option—but it is a particularly effective tool, provided you know how to use it.
Article 21 does not merely require "a risk analysis." It lists categories of minimum measures, all of which must be addressed in an appropriate and proportionate manner:
The direct consequence is that an organization cannot rely solely on a thorough risk analysis. Risk analysis serves as the starting point for determining the appropriate measures. The eight areas listed above constitute the scope that must be covered.
ISO 27001 is an international standard for information security management systems (ISMS). It provides precisely what NIS2 does not specify: the "how."
NIS2 imposes clear accountability on management (Article 20). ISO 27001 provides a formal framework for establishing a security policy approved by management, defining roles and responsibilities, and organizing oversight and reporting. This is an area of significant overlap—provided that management’s involvement is genuine and verifiable, not merely declarative.
Risk management is at the heart of Clause 21. ISO 27001 provides a comprehensive methodology: analysis, treatment, prioritization, and traceability of decisions. This is where the two standards align most closely.
The focus is on one key point: the risk analysis must cover critical services, external dependencies, and plausible cyber scenarios—not just the entire IT system in a purely theoretical sense.
Annex A of ISO 27001 provides a structured catalog of organizational, human, and technical controls—a solid starting point for selecting and justifying measures in relation to the eight domains outlined in Article 21. These controls cover areas such as cryptography, access management, and HR-related aspects, which align directly with the NIS2 requirements.
NIS2 is not a one-time compliance effort. ISO 27001 inherently incorporates regular reviews, internal audits, and a PDCA cycle—which helps demonstrate that cybersecurity is managed over the long term, a key factor in the event of an audit.
ISO 27001 includes incident management, but does not cover the NIS2 regulatory deadlines or the three-stage notification process required by Article 23:
ISO 27001 provides a framework for the internal incident management process. The regulatory requirements (who to notify, when, and in what format) necessitate a specific NIS2 supplement.
This is a critical aspect that is often overlooked in ISO 27001 ISMSs. NIS2 makes it an explicit requirement (Article 21) with specific expectations:
ISO 27001 addresses the security of supplier relationships (controls in Annex A), but its operational implementation often falls short of NIS2 requirements. This is frequently the first non-conformity identified during a compliance assessment.
For MSPs, MSSPs, cloud providers, and data center operators, NIS2 is supplemented by a directly applicable European implementing regulation, which does not require national transposition. This regulation sets out very specific operational requirements tailored to multi-tenant and shared environments: management of incidents with systemic impact, continuity of shared services, and control over subcontracting in the supply chain.
ISO 27001 alone is insufficient for these stakeholders unless they read and incorporate this implementing regulation.
The powers of the competent authorities, audit processes, and enforcement mechanisms fall under public law and are outside the scope of any management standard. ISO 27001 does not prepare you for a regulatory audit; rather, it helps ensure you have something to show during such an audit.
The regulatory framework is evolving. The European Commission is developing a European Cybersecurity Certification Framework (ECCF), led by ENISA, which is intended to produce standardized evidence that can be used by NIS2 supervisory authorities. This framework is currently being developed at the European level and is not yet operational at this stage.
From this perspective, holding ISO 27001 certification offers a tangible strategic advantage: a structured ISMS, documented processes, proven governance, and auditable evidence that can be directly reused once the first European certification schemes become available. ISO 27001 is not redundant; it is a catalyst for achieving NIS2 maturity, provided it is not treated as an end in itself.
To do:
Avoid:
Whether or not you are ISO 27001 certified, NIS2 compliance depends less on the number of controls and more on the overall consistency of the framework: a policy that aligns with identified risks, justified measures, and usable evidence.
Quick Assessment: If you are ISO 27001 certified with a fully operational ISMS, you have likely met 60 to 80% of the NIS2 requirements—primarily in the areas of governance, risk analysis, and technical measures. The remaining 20 to 40% mainly concern regulatory notification, the supply chain, and any sector-specific implementing regulations. This is where your path to compliance will be determined.
An NIS2 auditor does not assess the sophistication of your tools. Instead, they assess your ability to explain your choices, demonstrate your practices, and correct any deviations—exactly what a well-maintained ISO 27001 ISMS enables you to do.
👉 Take our NIS 2 self-assessment in less than 5 minutes and pinpoint your NIS 2 gaps, whether you are ISO 27001 certified or not.
2025 FeelAgile
