There is no NIS2 certificate for companies. The directive does not create one, and no certification body is accredited to declare an organisation “NIS2 compliant”. What NIS2 does is let authorities require certified ICT products under EU schemes (Article 24), encourage standards such as ISO/IEC 27001 (Article 25), and audit entities (Articles 32 and 33).
This guide covers what “NIS2 certification” usually means, what Article 24 allows, which EU schemes exist, the role of ISO 27001, the audits an authority can order, national schemes, the January 2026 proposal, and a checklist.
| What people call “NIS2 certification” | What it actually is | Required? |
|---|---|---|
| A “NIS2 certificate” from a consultancy or tool | The provider’s own attestation, with no legal effect | No |
| ISO/IEC 27001 certificate | Accredited certification of your management system, the usual evidence for Article 21 | No, unless national law builds on it |
| EU cybersecurity certificate (EUCC) | Certification of an ICT product under the Cybersecurity Act | Only where a Member State or a Commission delegated act requires it |
| Security audit | A supervisory tool of your competent authority | Essential entities: regular and targeted. Important entities: targeted, after the fact |
| National conformity scheme | A national assessment, such as Belgium’s CyberFundamentals | Where national law requires it |
| EU “cyber posture” certificate | Proposed in COM(2026) 11 and COM(2026) 13 | Not in force |
Is there a NIS2 certification?
No. NIS2 obliges essential and important entities to take “appropriate and proportionate” cybersecurity risk-management measures (Article 21), to report significant incidents (Article 23) and to have their management body approve and oversee those measures (Article 20). Whether you comply is judged by your competent authority, not by a certificate.
That leaves room for a market in badges. A tool or a consultancy can assess you against its own NIS2 checklist and issue a document. That can be a useful gap analysis. It is not a certification in any legal sense, and your authority is not bound by it.
What does Article 24 say about certification?
Article 24 is about certified ICT products, services and processes, not about certifying a company.
- Member States may require essential and important entities to use particular ICT products, ICT services and ICT processes that are certified under European cybersecurity certification schemes adopted under Article 49 of Regulation (EU) 2019/881, the Cybersecurity Act. The purpose is “to demonstrate compliance with particular requirements of Article 21”.
- Member States shall encourage the use of qualified trust services.
- The Commission may adopt delegated acts specifying which categories of entities must use certified products, services or processes, or obtain a certificate under a European scheme. It can do so only where insufficient levels of cybersecurity have been identified, after an impact assessment, and with an implementation period.
- Where no suitable scheme exists, the Commission may ask ENISA to prepare a candidate scheme.
In practice, this means your Member State, or the Commission by delegated act, could one day require, for example, a certified product for a specific function. It does not mean you can buy a certificate that covers NIS2.
Which EU cybersecurity certification schemes exist?
Few, and none certifies an organisation today.
- EUCC, the European Common Criteria-based scheme, set up by Implementing Regulation (EU) 2024/482. It certifies ICT products and protection profiles at two assurance levels, “substantial” and “high”. It applies from 27 February 2025 and certificates are valid for up to five years.
- Cloud (EUCS) and 5G (EU5G) are candidate schemes that have not been adopted. The Commission has said work on them is expected to resume.
- Managed security services. Regulation (EU) 2025/37 amended the Cybersecurity Act so that managed security services can be certified. In April 2025 the Commission asked ENISA to prepare a candidate scheme, which is still being developed.
For most companies in scope, none of these changes what they must do this year.
Does NIS2 require ISO 27001?
No. Article 25 asks Member States to encourage “European and international standards and technical specifications” relevant to the security of network and information systems, “without imposing or discriminating in favour of the use of a particular type of technology”. Article 21(1) says your measures should take into account the state of the art and, where applicable, relevant European and international standards.
ISO/IEC 27001 is the standard most companies use to meet that expectation, because an ISMS covers most of the ten Article 21 measures and gives an auditor something to test. The mapping, and where it falls short, is in ISO 27001 vs NIS2. The measures themselves are explained in the ten Article 21 measures.
One group has more precise requirements. DNS service providers, TLD name registries, cloud, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers must follow Implementing Regulation (EU) 2024/2690. Its annex sets the technical and methodological requirements for each Article 21 measure.
What audits can a NIS2 authority impose?
This is the part of NIS2 that comes closest to certification: an outside party checking your measures, with the authority reading the result.
| Supervisory power | Essential entities (Article 32) | Important entities (Article 33) |
|---|---|---|
| Trigger needed | None | Evidence, indication or information of non-compliance |
| Inspections | On-site and off-site, including random checks | On-site and off-site, after the fact |
| Security audits | Regular and targeted, by an independent body or the authority | Targeted, by an independent body or the authority |
| Ad hoc audits | Yes, for example after a significant incident | Not listed |
| Security scans | Yes | Yes |
| Evidence requests | Documented policies, audit results by a qualified auditor and the underlying evidence | The same |
Targeted audits are based on risk assessments by the authority or the audited entity, or on other risk-related information available. The results go to the authority. The audited entity pays for a targeted audit carried out by an independent body, except where the authority decides otherwise in duly substantiated cases.
Notice what the authority asks for: “evidence of implementation of cybersecurity policies”. A policy set on its own is not evidence. Records that the controls run are.
Do some countries have a national NIS2 conformity scheme?
Yes. Member States can go further than the directive, and some have built a formal conformity assessment into their law.
Belgium is the clearest example. By 18 April 2026, essential entities had to show one of three things: a CyberFundamentals verification at Basic or Important level (obtained, in progress, or contracted with an accredited body), an ISO/IEC 27001 route (scope, Statement of Applicability and latest internal audit report submitted, with full certification by April 2027), or a self-assessment with a request for inspection. The details are in NIS2 in Belgium.
If you operate in several countries, check each national law. The same company can face a formal assessment in one Member State and supervision on request in another.
Will there be an EU-level NIS2 certificate?
Possibly, but not yet. On 20 January 2026 the Commission proposed two linked texts.
- A revision of the Cybersecurity Act (COM(2026) 11). EU schemes could certify an entity’s “cyber posture”, not only ICT products and services. The Commission presents this as a way for companies to demonstrate compliance with NIS2 and other EU laws.
- Targeted amendments to NIS2 (COM(2026) 13). A new Article 24(4) would let Member States require essential and important entities to obtain such a certificate to demonstrate compliance with Article 21. Where a certificate shows compliance with the relevant requirements, authorities could not order additional targeted security audits for the requirements it covers. The certificate would not affect the entity’s own responsibility to comply.
Both are proposals. Until the European Parliament and the Council adopt them, and until an EU scheme for cyber posture exists, nothing changes. Build on what already counts: implemented measures, and evidence that they work.
How much does NIS2 certification cost?
There is no NIS2 certificate to pay for. The cost is the compliance work, and it depends on how far your current controls are from Article 21.
If you use ISO 27001 as your evidence, the ISO 27001 cost breakdown applies: about €12,000 to €22,500 for the certification audit of a company of 26 to 125 people, and roughly €50,000 to €150,000 for the first year all in. Be wary of any offer that sells a “NIS2 certificate” as the product.
What a certificate does not prove
A certificate is a point-in-time judgement on a sample. An ISO 27001 auditor reads your policies, tests a selection of controls and signs. A NIS2 authority asks a different question: are the measures in place and working now, across the services in scope?
That is answered with operational evidence, not with a document. Examples are an asset inventory that matches reality, MFA coverage on every administrative account, patch times for critical vulnerabilities, logs you can search, a tested restore and an incident timeline you can reconstruct to the hour. Most of that can be collected continuously from the systems themselves, which is what the CloudSoul platform does, with a person reviewing what the data does not settle. If you want to know where you stand first, a security audit against Article 21 is the fastest way to find out. The wider programme is on the NIS2 compliance page.
NIS2 certification checklist
- Confirm whether you are in scope, and whether you are an essential or an important entity.
- Check your national law for a mandatory conformity assessment or a recognised scheme.
- Decide what your evidence will be: ISO 27001, a national scheme, or your own documented measures.
- Map your controls to the ten Article 21 measures and close the gaps.
- If you are a cloud, data centre, DNS, managed service or other provider listed in Implementing Regulation (EU) 2024/2690, check your controls against its annex.
- Keep evidence of implementation, not only policies: records, logs, test results.
- Have your management body approve the measures and record that it did (Article 20).
- Ignore offers of a “NIS2 certificate” that no authority recognises.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 24, 25, 32 and 33, EUR-Lex.
- Commission Implementing Regulation (EU) 2024/482 (EUCC), EUR-Lex summary.
- Commission Implementing Regulation (EU) 2024/2690, EUR-Lex.
- ENISA, candidate scheme on managed security services (EUMSS), ENISA certification.
- European Commission, Cybersecurity package questions and answers, 20 January 2026, Shaping Europe’s digital future.
- Proposal for a Directive amending Directive (EU) 2022/2555, COM(2026) 13 final, Council register.
- Centre for Cybersecurity Belgium, “NIS2: 18 April 2026 deadline”, updated 16 April 2026, CCB.
Frequently asked questions
Is there a NIS2 certification?
No. The NIS2 Directive does not create a certificate for companies, and no body is accredited to certify an organisation as NIS2 compliant. A "NIS2 certificate" sold by a consultancy or a tool vendor is that provider's own attestation and binds no authority.
How do I get NIS2 certified?
You cannot, as such. You meet the obligations, mainly the Article 21 risk-management measures and the Article 23 reporting duties, and keep evidence that you do. ISO/IEC 27001 certification is the most common way to show the Article 21 part, and some Member States accept it in national conformity schemes.
What audits does NIS2 require?
Authorities can subject essential entities to regular and targeted security audits by an independent body or the authority itself (Article 32). Important entities face targeted audits after the fact, when there are indications they do not comply (Article 33). A targeted audit by an independent body is paid for by the audited entity, unless the authority decides otherwise.
How much does NIS2 certification cost?
There is no NIS2 certificate to pay for. The cost is the compliance work itself. If you use ISO 27001 as your evidence, the certification audit for a company of 26 to 125 people costs about €12,000 to €22,500, and the first year all in is roughly €50,000 to €150,000.
Will there be an EU-wide NIS2 certificate?
Possibly. In January 2026 the Commission proposed a Cybersecurity Act revision (COM(2026) 11) that would allow EU schemes certifying an entity's cyber posture, and NIS2 amendments (COM(2026) 13) that would let Member States require such a certificate. Both are proposals, not law, and no such scheme exists yet.
