In brief
An ISO/IEC 27001 certificate covers most of the risk management measures required by NIS2, but not all obligations. Registration with the competent authority, reporting of significant incidents within 24 hours, 72 hours and one month, management accountability and training, and readiness for supervision and security audits must be handled separately.
Which NIS2 measures map to ISO 27001 controls?
Article 21(2) of the NIS2 Directive lists ten groups of measures, which every Member State transposes into national law. Each corresponds to clauses and controls of ISO/IEC 27001:2022.
| Measure (NIS2 Directive, Art. 21(2)) | ISO/IEC 27001:2022 |
|---|---|
| a) policies on risk analysis and information system security | 5.2, 6.1.2, 6.1.3, A.5.1 |
| b) incident handling | A.5.24–A.5.28, A.6.8 |
| c) business continuity, backup management, disaster recovery, crisis management | A.5.29, A.5.30, A.8.13, A.8.14 (and ISO 22301) |
| d) supply chain security | A.5.19–A.5.23 |
| e) security in acquisition, development and maintenance of systems, vulnerability handling and disclosure | A.8.8, A.8.25–A.8.29, A.8.32 |
| f) assessing the effectiveness of measures | 9.1, 9.2, 9.3 |
| g) basic cyber hygiene and training | 7.2, 7.3, A.6.3 |
| h) cryptography and encryption | A.8.24 |
| i) human resources security, access control, asset management | A.6.1–A.6.6, A.5.9–A.5.18, A.8.2, A.8.3, A.8.5 |
| j) multi-factor authentication, secured communications | A.8.5, A.5.14, A.8.20, A.8.21 |
Coverage applies if the controls are within the scope of the system, selected in the Statement of Applicability (SoA) and actually implemented. Excluded controls or a narrow certification scope are also a gap under NIS2.
What does ISO 27001 not cover?
| Obligation | NIS2 | What needs to be done |
|---|---|---|
| Registration | Article 3(4) | submitting the entity's details to the competent authority and reporting changes |
| Reporting of significant incidents | Article 23 | early warning within 24 hours, notification within 72 hours, final report within one month |
| Management accountability and training | Article 20 | approval and oversight of measures by the management body, its training, regular staff training |
| Supervision and security audits | Articles 32 and 33 | essential entities: inspections and regular and targeted security audits; important entities: supervision after the fact |
| Cooperation during supervision | – | evidence of implemented measures, prepared for the competent authority |
In addition, national rules may require a defined set of security documentation – for example a business continuity policy and plan with a business impact assessment, or an incident response plan with a protocol for notifying the CSIRT. Most of these documents already exist in an ISMS, but their form and content must be checked against the national requirements.
Do we need an ISO 27001 certificate for NIS2?
No. NIS2 requires risk management measures and evidence that they work, not a certificate. A system to ISO/IEC 27001 is a systematic basis for this, and the certificate independently confirms that the system works – which is convincing evidence during supervision.
How do you close the gaps between ISO 27001 and NIS2?
Scope assessment and registration
Whether you are an essential or important entity and whether registration with the competent authority has been completed.
Gap analysis against Articles 20, 21 and 23
Comparison of the certification scope, SoA and documentation with the law.
Procedure for reporting significant incidents
Criteria for a significant incident, roles, deadlines and the protocol for notifying the CSIRT.
Management training and approvals
Training of responsible persons and recorded management decisions.
Evidence for supervision and the compliance audit
Evidence linked to measures, and preparation for supervision and security audits.
Our services: ISO 27001 implementation and NIS2 compliance.
Frequently asked questions
Does an ISO 27001 certificate mean we comply with NIS2?
Not automatically. An ISMS to ISO/IEC 27001 is a systematic and demonstrable basis for most risk management measures. Registration, procedures for reporting significant incidents (24 hours, 72 hours, one month), management accountability and training, and evidence for supervision must be handled separately.
Does NIS2 require an ISO 27001 certificate?
No. The law requires risk management measures and evidence that they work, not a certificate. A certificate does, however, independently confirm that the system works.
What should we do first if we already have ISO 27001?
Registration with the competent authority, a procedure for reporting significant incidents within the deadlines of Article 23, management training and accountability (Article 20), and a check of your security documentation against national requirements.
Sources
- Directive (EU) 2022/2555 (NIS2), Article 21 – EUR-Lex
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
- ISO/IEC 27001:2022 (ISO)
Last updated: · Prepared by the Regulus Ai team
Would you like to check what your certificate covers under NIS2?
Book an initial consultation