Learn
The short answer
ISO 27001 is a voluntary certification. NIS2 is law. Holding the certificate does not discharge the legal duty, and no supervisor accepts it as a substitute. What it does is cover a large share of the Article 21 measures already, so a certified organisation is usually most of the way there. The four things certification leaves open are national registration, the Article 23 reporting clocks, the management body's personal duty, and per-country variation.
On this page
The core difference: law against certification
NIS2 is Directive (EU) 2022/2555, transposed into national law in each Member State. It applies to you by virtue of your sector and size, it is supervised, and non-compliance carries administrative fines and other sanctions, covered in NIS2 fines and penalties. Access control is one of the measures both regimes share; user access review software covers how to evidence it once for both. Supply chain security is one of the shared measures, worked through in how to perform a third-party risk assessment.
ISO 27001 is a standard you can be certified against by an accredited body. Nobody compels it. Its value is that it is recognised, it structures the work, and customers understand it.
The category error to avoid: treating the certificate as compliance. A supervisor examining you under national NIS2 law will ask whether your measures are appropriate and proportionate and whether you can evidence them. A certificate is useful supporting evidence in that conversation and it is not the answer to it.
Where the overlap is genuinely large
Article 21 lists ten areas of cybersecurity risk-management measures. Most map closely onto ISO 27001 Annex A.
| NIS2 Article 21 measure | Covered by an ISO 27001 ISMS? |
|---|---|
| Risk analysis and information system security policies | Yes, this is the core of the management system |
| Incident handling | Yes, Annex A covers incident management |
| Business continuity, backup management, crisis management | Largely, though NIS2 emphasises crisis management explicitly |
| Supply chain security | Yes, supplier relationship controls |
| Security in acquisition, development and maintenance | Yes |
| Policies to assess effectiveness of measures | Yes, internal audit and management review |
| Basic cyber hygiene and security training | Yes, awareness controls |
| Cryptography and encryption | Yes |
| Human resources security, access control, asset management | Yes |
| Multi-factor authentication and secured communications | Largely, though NIS2 names MFA explicitly |
If you hold a current certificate with a scope that covers the relevant services, most of this is evidencing work rather than building work. That is the good news and it is real.
The four gaps ISO 27001 leaves
- Registration. NIS2 requires in-scope entities to register with the competent authority, per country. No certification does this for you.
- The Article 23 reporting clocks. An early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month, filed into a national route. An ISMS incident process is a good starting point and it is not the same obligation.
- The management body's duty. Under NIS2 the management body approves the risk-management measures, oversees implementation, can be held liable, and must undertake training. ISO 27001 requires leadership commitment; it does not create personal exposure.
- Per-country variation. NIS2 binds you through national transposition, so thresholds, registration duties and reporting routes differ by Member State. A single certificate does not track twenty-seven implementations.
Does ISO 27001 help with a NIS2 inspection?
Yes, materially, in three ways. It gives you a documented management system a supervisor can follow. It gives you evidence that measures are tested for effectiveness, which Article 21 requires explicitly. And it gives you an external opinion that your controls operate, which is worth more than self-assertion.
What it will not do is answer the question of whether you registered, whether you met the reporting deadlines, or whether your management body approved the measures and can show it. Those are the questions that produce findings.
The efficient order to do them in
For an organisation facing both, doing them separately is the expensive path.
- Scope NIS2 first. Determine whether you are essential or important, in which countries. This sets everything else. Start with what NIS2 is and who must comply.
- Build one control set. Map the Article 21 measures and Annex A to shared controls so one piece of evidence answers both.
- Add the NIS2-only items. Registration, the reporting clocks, and the management body record.
- Certify if it earns its keep commercially. Certification is a customer-facing asset; treat the decision as a commercial one rather than a compliance one.
Do this in Venvera
Venvera maintains NIS2 and ISO 27001 as separate control sets that share evidence, so an artefact collected once answers both wherever the requirements overlap, and the NIS2-only items are tracked explicitly. Per-country transposition differences are modelled rather than averaged. See the NIS2 workspace and the ISO 27001 workspace, or start with the free NIS2 compliance checklist.
Frequently asked questions
Does ISO 27001 make you NIS2 compliant?
No. ISO 27001 is a voluntary certification and NIS2 is law, so the certificate cannot discharge the legal duty. It does cover a large share of the Article 21 measures, so a certified organisation is usually most of the way there on the technical and organisational side.
What does NIS2 require that ISO 27001 does not?
Registration with a national competent authority, the Article 23 reporting deadlines of 24 hours, 72 hours and one month, the management body's duty to approve and oversee the measures with personal liability attached, and tracking of per-country transposition differences.
Should we get certified if we are already doing NIS2?
Treat it as a commercial decision. Certification is a recognised signal to customers and it makes a supervisory conversation easier, but it is not required by the Directive.
Can one control set serve both?
Yes, and it is the main saving available. Most Article 21 measures map onto Annex A controls, so shared evidence answers both. The NIS2-only obligations then sit on top as a smaller, separate list.
