What is the actual overlap between ISO 27001 and NIS2?

ISO 27001 certification does not make you NIS2 compliant, but it gives you a meaningful head start. The two frameworks share substantial common ground in information security management, yet NIS2 extends into areas that ISO 27001 does not cover, particularly around incident reporting obligations, supply chain accountability, and direct management liability. If your organisation operates under both frameworks, understanding exactly where they overlap and where they diverge is the most efficient way to close your compliance gaps without duplicating effort. We are happy to help you map that out, so feel free to get in touch if you want to talk through your specific situation.

Does ISO 27001 certification make you NIS2 compliant?

No, ISO 27001 certification does not make you NIS2 compliant. ISO 27001 is a voluntary international standard for information security management systems, while NIS2 is a binding EU directive with mandatory legal obligations. Certification to the standard demonstrates strong security practices, but it does not satisfy NIS2’s specific requirements around incident notification timelines, governance accountability, and enforcement.

That said, the overlap is real and valuable. An organisation with a mature ISO 27001 implementation will already have risk management processes, security controls, business continuity planning, and supplier assessment procedures in place. These directly support NIS2 compliance work. The problem arises when organisations assume that certification alone closes the gap. NIS2 imposes obligations that are simply outside the scope of ISO 27001, and those gaps require deliberate attention rather than assumptions.

The practical implication is this: ISO 27001 is a strong foundation, not a shortcut. Organisations that treat it as one should expect to find meaningful compliance gaps when they conduct a proper NIS2 readiness assessment.

What requirements do ISO 27001 and NIS2 actually share?

ISO 27001 and NIS2 share significant common ground across risk management, security controls, business continuity, and supplier security. Both frameworks require organisations to identify and assess information security risks systematically, implement appropriate technical and organisational measures, and maintain documented processes that are regularly reviewed. This shared territory is where compliance work completed for one framework directly supports the other.

The most substantial areas of overlap include:

Risk management: Both require a structured approach to identifying, evaluating, and treating information security risks on an ongoing basis.
Access control and authentication: ISO 27001 Annex A controls around identity and access management align closely with NIS2’s requirements for access security measures.
Incident management: Both frameworks require organisations to detect, respond to, and document security incidents, though NIS2 adds specific reporting timelines on top of this.
Business continuity and recovery: ISO 27001’s requirements for continuity planning and backup management mirror NIS2’s expectations for resilience.
Supply chain security: Both address the need to assess and manage security risks introduced by third-party suppliers and service providers.
Security awareness and training: Both frameworks expect organisations to build security competence across their workforce.

For organisations already certified to ISO 27001, this shared territory means that a substantial portion of the documentation, processes, and controls required for NIS2 may already exist. The key is conducting a structured gap analysis to confirm what is genuinely in place versus what exists only on paper.

Where does NIS2 go further than ISO 27001?

NIS2 goes further than ISO 27001 in three critical areas: mandatory incident reporting with strict timelines, direct personal liability for senior management, and a broader scope of obligations that extends beyond the information security management system itself. These are not minor extensions but structurally different requirements that ISO 27001 does not address.

Mandatory incident reporting timelines

NIS2 requires essential and important entities to notify their national competent authority within 24 hours of becoming aware of a significant incident, followed by a full report within 72 hours and a final report within one month. ISO 27001 requires organisations to manage and document incidents internally, but it sets no external reporting obligations or regulatory timelines. This distinction is operationally significant and requires dedicated processes that sit outside a standard ISMS.

Management accountability and personal liability

NIS2 explicitly holds senior management personally accountable for the organisation’s cybersecurity posture. Management bodies can be held liable for failures, and in some cases individuals may face temporary bans from management roles. ISO 27001 requires top management commitment and involvement, but it does not create personal legal liability. This distinction means that NIS2 compliance is not purely a technical or operational matter. It is a governance matter that must be owned at board level, with demonstrable evidence of active oversight.

Supply chain and third-party obligations

While both frameworks address supply chain security, NIS2 takes a harder regulatory position. Organisations must actively assess the security practices of their suppliers and service providers and take responsibility for risks introduced through the supply chain. The directive also addresses the security of the supply chain for network and information systems specifically, which goes beyond the general supplier relationship management covered in ISO 27001.

Which organisations need to meet both frameworks?

Organisations that fall within NIS2’s scope and choose to pursue ISO 27001 certification need to meet both frameworks. NIS2 applies to medium and large organisations in sectors classified as essential or important under the directive, including energy, transport, health, digital infrastructure, financial market infrastructure, and a range of digital service providers. ISO 27001, being voluntary, applies to any organisation that chooses to certify.

In practice, the organisations most likely to face both sets of requirements are regulated businesses in the EU that use ISO 27001 certification as a market differentiator or contractual requirement alongside their NIS2 obligations. This includes scale-ups and mid-market companies in sectors like managed IT services, cloud computing, and digital platforms, where customers or procurement processes require certification and regulators require NIS2 compliance simultaneously.

Private equity portfolio companies operating in regulated sectors face particular pressure here. They often need to demonstrate security maturity to investors, customers, and regulators at the same time, making a unified approach to both frameworks both practical and commercially important. Our governance services are specifically designed to support organisations navigating exactly this combination of requirements.

How much of the compliance work can be reused between the two?

A significant portion of the compliance work can be reused between ISO 27001 and NIS2, particularly in risk management, security controls documentation, business continuity planning, and supplier assessments. Industry experience suggests that organisations with a mature ISO 27001 implementation can reuse a large share of their existing work when building toward NIS2 compliance, though the exact proportion depends on how rigorously the standard has been implemented in practice rather than just on paper.

The reusable elements typically include:

Risk assessment methodology and risk register
Information security policies and procedures
Access control and authentication controls
Incident detection and response procedures
Business continuity and disaster recovery plans
Supplier security assessment processes
Security awareness training programmes

The work that cannot be reused and must be built specifically for NIS2 includes the external incident notification process with its regulatory timelines, the governance structures that place documented accountability at senior management level, and any sector-specific security measures required under the directive for your particular industry classification.

The most efficient approach is to treat ISO 27001 and NIS2 as complementary frameworks within a single, continuous governance system rather than two separate compliance projects. This is exactly the logic behind continuous governance as a model: instead of running parallel workstreams that duplicate effort, a unified system maintains both frameworks simultaneously, reduces administrative overhead, and ensures that controls remain operational between certification cycles rather than being refreshed only when an audit approaches.

If you want to understand precisely how much of your existing ISO 27001 work applies to your NIS2 obligations, a structured gap analysis is the right starting point. Get in touch with us and we will help you map your current position and identify the most efficient path to meeting both frameworks without unnecessary duplication.

Frequently Asked Questions

How do I know if my organisation falls under NIS2 scope?

NIS2 applies to medium and large organisations (generally 50+ employees or €10M+ annual turnover) operating in sectors classified as essential or important under the directive, including energy, transport, health, digital infrastructure, financial services, and managed IT and cloud providers. If you are unsure whether your organisation qualifies, the most reliable approach is to review your sector classification against the NIS2 Annex I and Annex II lists and check whether your Member State has expanded scope under national transposition. When in doubt, a short scoping exercise with a compliance specialist will give you a definitive answer quickly.

What is the best way to get started if we have ISO 27001 but have not yet assessed our NIS2 position?

The right starting point is a structured gap analysis that maps your existing ISO 27001 controls and documentation against NIS2's specific requirements, particularly in the three areas where NIS2 goes further: incident reporting timelines, management accountability, and supply chain obligations. This gives you a clear picture of what is already covered, what needs to be extended, and what needs to be built from scratch. Avoid the common mistake of assuming your certification covers more than it does — a documented gap analysis is both a practical planning tool and an early piece of evidence for regulators that you are taking compliance seriously.

What happens if our organisation is NIS2 non-compliant? What are the actual penalties?

NIS2 introduces significantly tougher enforcement than its predecessor, with fines of up to €10 million or 2% of global annual turnover for essential entities, and up to €7 million or 1.4% of turnover for important entities, whichever is higher. Beyond financial penalties, national authorities can issue binding instructions, require specific remediation actions, and in serious cases temporarily prohibit individuals from holding senior management roles. The personal liability dimension is what makes NIS2 enforcement meaningfully different from a standard certification audit — board-level accountability is not just a governance best practice under NIS2, it is a legal requirement.

Our ISO 27001 certification is due for renewal soon. Should we align that renewal with our NIS2 compliance work?

Yes — aligning your ISO 27001 renewal cycle with your NIS2 compliance work is one of the most efficient approaches available to you. Renewal involves a thorough review of your ISMS, which creates a natural opportunity to extend documentation, update policies, and introduce the governance structures required by NIS2 at the same time rather than running two separate workstreams. This is the practical application of treating both frameworks as a unified governance system: you reduce audit preparation overhead, avoid duplicating documentation effort, and ensure your controls are genuinely operational rather than refreshed only under audit pressure.

How should we handle the 24-hour incident notification requirement operationally?

The 24-hour early warning obligation under NIS2 requires a dedicated, pre-built notification process that sits outside your standard internal incident management workflow. In practice, this means identifying in advance which incidents qualify as 'significant' under the directive, knowing exactly which national competent authority to notify and how, and having a named, accountable individual responsible for triggering that notification. Many organisations discover during readiness assessments that their existing incident response procedures stop at internal escalation — building the external reporting layer, including templates, contact details, and decision criteria, is one of the most operationally specific pieces of work NIS2 requires.

Does NIS2 compliance require us to audit our suppliers, and how deep does that obligation go?

NIS2 requires organisations to assess and manage cybersecurity risks introduced through their supply chain, which in practice means having a structured process for evaluating the security practices of suppliers and service providers that are material to your network and information systems. The directive does not prescribe a specific audit methodology, but you need to be able to demonstrate that you have assessed supplier risk, applied proportionate contractual and operational controls, and that you review this on an ongoing basis rather than as a one-time exercise. Organisations with an existing ISO 27001 supplier assessment process have a strong foundation here, but may need to extend their criteria and documentation to meet the more prescriptive regulatory expectations of NIS2.

Can we use a single set of policies and documentation to satisfy both ISO 27001 and NIS2 auditors?

Yes, in most areas a single, well-structured set of policies and documentation can satisfy both frameworks simultaneously, which is precisely the efficiency gain of treating them as a unified governance system rather than separate compliance projects. The key is ensuring your documentation is written to meet the higher bar where the two frameworks diverge — for example, your incident management procedure should cover both ISO 27001's internal requirements and NIS2's external notification timelines within the same document. Where NIS2 introduces obligations with no ISO 27001 equivalent, such as management liability governance and sector-specific measures, you will need standalone documentation, but these additions are targeted rather than wholesale duplication of your existing ISMS.

Navigation