An ISO 27001:2022 ISMS covers roughly 70 to 80 per cent of what NIS2 Article 21 asks for. Of the ten measures in Article 21(2), five are fully covered and five partly. None is a complete gap. The rest is deepening the five partial measures and meeting five NIS2 obligations no ISMS contains. Run one programme, not two.
This guide covers the mapping, where “partial” bites, what NIS2 adds, the order to work in, the cost, and where both frameworks stop.
| NIS2 Article 21(2) measure | Covered by ISO 27001 | Where NIS2 asks for more |
|---|---|---|
| (a) Risk analysis and information security policy | Full | — |
| (b) Incident handling | Partial | Telling anyone outside, on a clock |
| (c) Business continuity and crisis management | Partial | Operational resilience of the service, including crisis management and backup |
| (d) Supply chain security | Partial | The dependencies behind your direct suppliers |
| (e) Secure acquisition, development and maintenance | Full | — |
| (f) Assessing effectiveness of the measures | Full | — |
| (g) Cyber hygiene and training | Partial | Training as an obligation of the management body |
| (h) Cryptography and encryption | Full | — |
| (i) HR security, access control, asset management | Full | — |
| (j) MFA, secure communications and emergency comms | Partial | MFA and secured emergency communications in use, not just selected |
Read the table this way: build an ISMS properly and you are most of the way through Article 21 without having opened a NIS2 project. The detail of each measure is in the NIS2 Article 21 measures.
Where does ISO 27001 only partly cover NIS2?
“Partial” is doing a lot of work in that table, so here are the five.
Incident handling. ISO 27001 wants you to detect, respond, learn and improve. It says nothing about telling anybody outside. NIS2 does, and on a clock (see below).
Business continuity. ISO 27001 asks for continuity of information security. NIS2 asks for operational resilience of the service, including crisis management and backup arrangements at a level an ISMS does not necessarily reach.
Supply chain. ISO 27001 Annex A 5.19 to 5.22 covers your direct suppliers. NIS2 expects you to think about the dependencies behind them, and to pass requirements down. If your customers already send you supplier questionnaires, this is the same mechanism pointed at you, described in supply chain security under NIS2.
Cyber hygiene and training. ISO 27001 requires awareness and competence. NIS2 requires it of the management body specifically, and makes it their obligation rather than a training record. See training requirements for boards and employees.
MFA and secure communications. ISO 27001 names authentication as a control to select. NIS2 names multi-factor authentication and secured emergency communications as things you use. A control marked applicable and partly deployed passes one and not the other.
What does NIS2 require that ISO 27001 does not?
Five obligations, and they are the part that surprises people who assumed a certificate would settle the matter.
1. Incident reporting deadlines
Early warning within 24 hours, notification within 72 hours, final report within one month, to your CSIRT or competent authority. ISO 27001 has no equivalent obligation and no clock. Getting this wrong is a reporting failure rather than a security failure, and it is measured in hours. The mechanics are in the NIS2 incident reporting timeline.
2. Management body liability
Article 20 puts approval and oversight of the measures on the management body and makes it accountable. ISO 27001 asks for leadership commitment, which is not the same legal thing. See board accountability under NIS2.
3. Registration
In-scope entities have to register with the national authority. Purely administrative, no ISO 27001 equivalent, and easy to miss entirely.
4. Coordinated vulnerability disclosure
NIS2 expects participation in the EU mechanism. ISO 27001 covers internal vulnerability management, not external coordination.
5. Jurisdiction
Which member state supervises you is a NIS2 question with a real answer, and it matters if you operate in several. ISO 27001 does not care where you are. See which jurisdiction applies.
Notice what these five have in common. None of them is a security control. All of them are obligations of the organisation, and four of the five are things a certificate cannot demonstrate.
Should you do ISO 27001 or NIS2 first?
Scope NIS2 first, draw the ISMS around it, and build one control set for both. These steps are cheap to follow if you decide early.
- Settle whether you are in scope at all. Do this before anything else. The NIS2 scope checker takes a couple of minutes, and the categories are explained in essential and important entities compared.
- Draw the NIS2 boundary before the ISMS scope. ISO 27001 scope is your decision. NIS2 scope is a matter of law, and it is not negotiable. Work out the boundary of the regulated service first, then draw your ISMS scope so that it contains it. Draw the narrowest possible ISO scope first and find the regulated service half outside it, and you redo the risk assessment and the Statement of Applicability. That is the trap in scope and the Statement of Applicability, with legal consequences added.
- Build one control set, not two. Implement a control once, map it to both frameworks, and evidence it once. Two registers, two policy sets and two evidence folders for the same controls is the most common and most expensive mistake here. It compounds, because every future framework gets its own folder too.
Does doing ISO 27001 and NIS2 together cost less?
Yes. If a customer is pushing you toward ISO 27001 and a regulator toward NIS2, do not run them as two projects. Run separately, you pay twice for gap analysis, policy work, evidence collection and internal effort. Internal effort is the largest line either way, as set out in what ISO 27001 actually costs an SME.
Run together, you pay once for the 70 to 80 per cent. The NIS2 increment is the five obligations above plus deepening the five partial measures. In a company of 20 to 250 people that is weeks, not months, and mostly procedural rather than technical.
Does ISO 27001 certification make you NIS2 compliant?
No. The one thing you cannot merge is the certificate. ISO 27001 gets audited by a certification body. NIS2 gets supervised by an authority, and supervision for important entities is generally reactive rather than a scheduled audit.
Holding a certificate does not discharge the NIS2 obligation. ISO 27001 certification is still the most efficient way to be able to demonstrate most of it, a point covered in certification standards under NIS2.
Where do ISO 27001 and NIS2 both stop?
At the same place. ISO 27001 asks you to select and implement controls. NIS2 asks for measures appropriate to the risk. Both are outcome-agnostic about quality.
A.8.8 and Article 21(2)(e) both ask you to handle technical vulnerabilities. Both are satisfied by a documented process with a monthly scan, whether or not the critical findings from that scan were fixed. Both ask for logging. Neither asks whether anyone reads the logs. Article 21(2)(b) and A.5.24 both want incident handling, and a written procedure meets them while nothing in the estate would actually raise the incident.
So doing both once gets you one control set, one evidence record and two obligations discharged for slightly more than the price of one. It does not tell you whether an intrusion would be noticed. That takes detection and exposure management running continuously and feeding findings back into the same record: the half of the problem the frameworks describe and neither one performs. The fastest way to see which of your gaps are documentation and which are technical is a structured audit before you commit.
ISO 27001 and NIS2 checklist
- Settle whether NIS2 applies to you, and in which category.
- Draw the boundary of the regulated service before the ISMS scope.
- Build one control set mapped to both frameworks, with one evidence record.
- Deepen the five partial measures to what NIS2 asks, not what the ISMS asks.
- Be able to meet the 24-hour, 72-hour and one-month reporting deadlines.
- Put approval and oversight of the measures on the management body.
- Register with the national authority, and know which member state supervises you.
Frequently asked questions
Does ISO 27001 cover NIS2?
Mostly. An ISO 27001:2022 ISMS covers roughly 70 to 80 per cent of the ten measures in NIS2 Article 21(2): five fully and five partly, with none a complete gap. It does not cover NIS2 obligations such as the incident reporting deadlines, management body liability and registration.
Does ISO 27001 certification make you NIS2 compliant?
No. Holding a certificate does not discharge the NIS2 obligation, though it is the most efficient way to be able to demonstrate most of it. ISO 27001 is audited by a certification body, while NIS2 is supervised by an authority.
What does NIS2 require that ISO 27001 does not?
Five obligations have no ISO 27001 equivalent: incident reporting deadlines, management body liability under Article 20, registration with the national authority, coordinated vulnerability disclosure, and the question of which member state supervises you.
What are the NIS2 incident reporting deadlines?
An early warning within 24 hours, a notification within 72 hours and a final report within one month, to your CSIRT or competent authority. ISO 27001 has no equivalent obligation and no clock.
Should you do ISO 27001 or NIS2 first?
Scope NIS2 first. NIS2 scope is a matter of law, so work out the boundary of the regulated service, draw the ISMS scope so that it contains it, and build one control set mapped to both frameworks.
