NIS2 vs. ISO 27001: Differences, Similarities, and How Both Fit Together

Two Worlds, One Goal: Implementing Information Security Systematically

If you deal with information security, you will inevitably come across two terms: NIS2 and ISO 27001. Both require an information security management system (ISMS), both speak of risk management, technical measures, and documentation. At first glance, they appear almost interchangeable.

At second glance, fundamental differences emerge. NIS2 is a European law with binding obligations, fines, and personal management liability. ISO 27001 is an international standard that you implement voluntarily and against which you can seek certification. This relationship of obligation and choice shapes everything that follows.

In this article, you will learn where NIS2 and ISO 27001 overlap, what NIS2 additionally requires, and how to strategically combine both frameworks. By the end, you will know whether you need one or both and how to minimise the effort.

The Fundamental Difference: Law vs. Standard

Before we dive into the details, this point must be crystal clear: NIS2 and ISO 27001 operate in different leagues.

NIS2: European Law with National Enforcement Mechanism

The NIS2 Directive (EU 2022/2555) is a European directive that is transposed into national law. In Germany, this happens through the NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG). This means: If your company falls within the scope, you must meet the requirements. This is not a recommendation — it is binding law.

The consequences of non-compliance are significant. For essential entities, fines of up to EUR 10 million or 2% of global annual revenue apply. For important entities, it is up to EUR 7 million or 1.4% of revenue. And here is the point that makes many executives take notice: Management bodies are personally liable for implementing risk management measures. This liability cannot be delegated.

ISO 27001: International Standard with Voluntary Certification

ISO/IEC 27001 is an international standard by the International Organization for Standardization. The current version dates from 2022. You implement it voluntarily — no one forces you to. The motivation typically comes from customer requirements, procurement criteria, or your own quality standards.

Certification by an accredited body confirms that your ISMS meets the standard's requirements. The certificate is valid for three years with annual surveillance audits. Without certification, you can still use the standard as a framework — you just do not get the official seal of approval.

What This Means in Practice

ISO 27001 tells you: "This is how to build a good ISMS." NIS2 tells you: "You must have an ISMS, and if you don't, there are consequences." The standard provides the how, the law provides the why and the or-else. This distinction is not an academic detail — it determines your entire approach.

Where NIS2 and ISO 27001 Overlap

Despite the fundamental difference between law and standard, there is a remarkably large area of overlap. Both frameworks share the same core principle: Information security must be implemented systematically, risk-based, and demonstrably.

Risk Management as the Common Core

Both NIS2 (Article 21) and ISO 27001 (Chapters 6.1 and 8.2) require a risk-based approach. You must identify, assess, treat, and document residual risk. Both largely give you freedom in methodology, as long as it is systematic and traceable.

NIS2 formulates this somewhat more generally than ISO 27001, but the essence is identical: You cannot simply implement arbitrary measures — you must demonstrate that your measures are derived from a sound risk analysis. Anyone already operating risk management under ISO 27001 practically fully meets the NIS2 requirement in this area.

Technical and Organisational Measures

NIS2 Article 21 paragraph 2 lists ten areas where measures are required. When you place this list alongside the controls from ISO 27001 Annex A, you immediately recognise the kinship:

• Access control and authentication can be found in NIS2 Article 21(2)(i) and in ISO 27001 Controls A.5.15 to A.5.18 and A.8.2 to A.8.5.
• Cryptography and encryption is required by NIS2 in Article 21(2)(h), and ISO 27001 addresses it in A.8.24.
• Backup and recovery as part of business continuity is covered by NIS2 in Article 21(2)(c) and ISO 27001 in A.8.13 and A.5.30.
• Vulnerability management and secure development can be found in NIS2 Article 21(2)(e) and ISO 27001 in A.8.8 and A.8.25 to A.8.28.
• Training and awareness is required by NIS2 through the cyber hygiene provisions in Article 21(2)(g), and by ISO 27001 through A.6.3 and A.7.2.

The overlap is estimated at 70 to 80 percent. Anyone operating an ISMS under ISO 27001 has already implemented the majority of the technical and organisational measures that NIS2 requires.

Documentation and Evidence Requirements

Both frameworks insist on comprehensive documentation. ISO 27001 requires documented information for the ISMS, risk analysis, Statement of Applicability, policies, and procedures. NIS2 requires evidence that measures are implemented and effective.

In practice, this means: Policies, process descriptions, risk assessments, action plans, training records, and audit reports are needed for both. If you structure your documentation to meet both sets of requirements, you save considerable effort.

Continuous Improvement (PDCA)

ISO 27001 is explicitly based on the Plan-Do-Check-Act cycle. NIS2 does not require a PDCA cycle by name, but it does require regular review and updating of measures (Article 21 paragraph 1). It also mandates assessment of the effectiveness of the measures deployed. This is essentially the same concept, just differently worded.

What NIS2 Additionally Requires: The Deltas from the Standard

This is where it gets interesting. Because despite the large overlap, there are areas where NIS2 goes significantly beyond ISO 27001. These deltas are why an ISO 27001 certification alone does not automatically equal NIS2 compliance.

Reporting Obligations with Fixed Deadlines

This is arguably the most striking difference. NIS2 defines in Article 23 a three-stage reporting system with binding deadlines:

1. Early warning within 24 hours after becoming aware of a significant security incident. This initial report must be made to the BSI and includes initial assessments of whether the incident is attributable to unlawful or malicious actions and whether cross-border effects exist.
2. Detailed report within 72 hours with an assessment of the incident, its severity, impact, and, where available, indicators of compromise (IoCs).
3. Final report within one month with a detailed description of the incident, root cause analysis, remediation measures taken, and cross-border impact.

ISO 27001 requires incident management in Controls A.5.24 to A.5.28, but no specific reporting deadlines to authorities. You define yourself how quickly you communicate internally and externally. Under NIS2, the timeframe is legally prescribed and non-negotiable.

Supply Chain Security

NIS2 Article 21 paragraph 2 letter d explicitly requires supply chain security. This goes beyond typical supplier assessment: You must consider the specific vulnerabilities of your direct suppliers and service providers, assess the overall quality of products and cybersecurity practices, and contractually anchor cybersecurity requirements.

ISO 27001 addresses supplier relationships in A.5.19 to A.5.23, but the focus is more on contractual safeguards. NIS2 requires a more active engagement with the actual security posture of your supply chain, including the sub-contractors of your service providers.

Management Liability and Governance

Article 20 of the NIS2 Directive makes clear: Management bodies must approve risk management measures, oversee their implementation, and can be held personally liable for violations. They must also attend training to acquire sufficient knowledge and skills for risk identification and assessment.

ISO 27001 also requires top management commitment in Chapter 5 (Leadership). But the personal liability component that NIS2 introduces does not exist in the standard. Management can delegate operational implementation — responsibility for approval and oversight remains with them.

Registration Obligations

Affected entities must register with the competent authority (in Germany, the BSI) and provide certain information: name and contact details, industry and sub-sector, IP address ranges, and other technical details. This registration obligation does not exist under ISO 27001, as there is no regulatory oversight.

National Oversight and Enforcement

NIS2 establishes a supervisory regime. The BSI can conduct on-site inspections, request evidence, and issue orders in case of violations. Under ISO 27001, an auditor of your choice examines you against the standard. This is a cooperative process, not a sovereign act. The dynamics are fundamentally different.

How ISO 27001 Helps with NIS2 Implementation

Despite the deltas mentioned, ISO 27001 is the best foundation for NIS2 implementation. The BSI is clear, however: an ISO 27001 certificate is a good foundation but does not count as proof of NIS2 compliance, because it does not cover, for example, reporting obligations, registration and management responsibility. How to document your evidence instead is explained in [NIS2 Evidence and Audits](/en/blog/nis2-evidence-audits-bsi).

Structured Framework Instead of Patchwork

NIS2 tells you what you must do but not in detail how. Article 21 lists ten measure areas but remains vague on concrete implementation. ISO 27001 provides exactly this framework: A structured management system with defined processes, roles, responsibilities, and 93 concrete controls in Annex A.

Without such a framework, there is a risk that you implement individual NIS2 requirements in isolation without building a coherent system. A tool like ISMS Lite includes both frameworks with pre-configured cross-mappings, so you can see from the start which measure covers which requirement. And this is exactly what an auditor or the BSI will question.

Proven Risk Management Methodology

Risk management under ISO 27001 (in conjunction with ISO 27005 as a guide) gives you a proven approach: asset identification, threat analysis, vulnerability assessment, risk treatment with four options (avoidance, reduction, transfer, acceptance), and documented residual risk assessment. This approach fully meets the NIS2 requirement for comprehensive risk management.

Documentation That Works for Both

A well-structured ISMS under ISO 27001 produces exactly the documentation you also need for NIS2: the information security policy, risk analysis and risk treatment plan, Statement of Applicability (SoA), policies for access control, cryptography, and incident management, training records, internal audit reports, and management reviews. If you structure these documents from the start to serve both frameworks, you avoid duplicate work.

Maturity Evidence for Authorities

An existing ISO 27001 certification signals to the BSI that your company practises information security systematically. This does not replace the NIS2-specific requirements such as reporting obligations and registration, but it demonstrates that the foundation is in place. In practice, this is likely to work significantly in your company's favour during supervisory measures.

Cross-Mapping: NIS2 Requirements and ISO 27001 Controls

The following table shows how the ten measure areas from NIS2 Article 21 paragraph 2 map to the controls in ISO 27001:2022 Annex A. This mapping is not exhaustive but gives you solid guidance for implementation.

What immediately stands out: Only for (b) reporting obligations and (d) supply chain security does a noticeable gap remain. For all other measure areas, ISO 27001 offers largely to fully complete coverage. This confirms the role of ISO 27001 as the ideal foundation for NIS2 implementation.

Do I Need Both? Recommendations for Different Scenarios

The question "NIS2 or ISO 27001?" rarely arises so binary in practice. Depending on your starting position, different strategies make sense.

Scenario 1: You Fall Under NIS2 and Do Not Yet Have an ISMS

If you fall within the scope of NIS2 and do not yet operate a formal ISMS, the dual approach is recommended: Build your ISMS according to ISO 27001 and address the NIS2-specific requirements in parallel. This gives you a structured framework that meets NIS2 requirements, and you can optionally pursue certification as well.

The advantage: You are not just building the legally required minimum but a complete ISMS that also helps with customer requirements, procurement bids, and as a market signal.

Scenario 2: You Already Have ISO 27001 Certification

Congratulations — you have already completed the bulk of the work. Your focus lies on the NIS2 deltas: Set up the three-stage reporting processes with the prescribed deadlines, deepen your supply chain assessment beyond previous supplier management, ensure that management demonstrably fulfils its approval and oversight obligations, and register with the BSI.

The effort for these additions is manageable, especially if your existing ISMS is well documented and actively practised.

Scenario 3: You Do Not Fall Under NIS2, but Customers Require an ISMS

Then ISO 27001 is your path. You do not need the NIS2-specific elements but benefit from a recognised standard that your customers and partners know. Certification opens doors, especially with larger customers and in the public sector.

Keep in mind, however: NIS2 supply chain requirements may also affect you indirectly. If your customers fall under NIS2, they will increasingly demand security evidence from their suppliers. An ISO 27001 certification is then the cleanest answer.

Scenario 4: You Are a Small Company Under 50 Employees

Small companies generally do not fall directly under NIS2 unless they belong to particularly critical sectors. Nevertheless, an ISMS based on ISO 27001 can be worthwhile, especially if you work as a supplier for NIS2-affected companies. In this case, a pragmatic approach is recommended: Orient yourself to the core principles of ISO 27001 without necessarily pursuing full certification. Document your risk management and measures so that you can provide evidence to customers.

The Practical Challenges of Dual Compliance

Anyone who must serve both frameworks faces typical challenges that can be well resolved with the right approach.

Avoiding Duplicate Documentation

The greatest danger is building separate documentation universes for NIS2 and ISO 27001. This leads to inconsistencies, double maintenance effort, and the question of which version governs in case of doubt. The solution: A unified documentation system with one policy that references both requirements. Your information security policy covers both ISO 27001 Chapter 5.2 and NIS2 Article 21. One document, two pieces of evidence.

Operationalising Reporting Deadlines

The 24-hour deadline for the NIS2 initial report sounds manageable but becomes challenging if you have not practised the process beforehand. You need clear escalation paths, prepared reporting forms, a 24/7 reachability plan, and regular exercises. ISO 27001 gives you the framework for incident management, but the NIS2-specific reporting chain must be built and tested separately.

Systematically Assessing the Supply Chain

The in-depth supply chain assessment that NIS2 requires presupposes that you know your critical service providers, assess their security practices, and anchor contractual cybersecurity requirements. This also includes assessing dependencies: What happens if a critical cloud provider fails? What sub-contractors does your IT service provider use? This depth goes beyond typical supplier management under ISO 27001.

Engaging Management

The personal liability of management under NIS2 is not a theoretical construct. In practice, it means: Management must demonstrably participate in training, approve risk management measures (with date and signature), be regularly informed about ISMS status, and make and document strategic information security decisions. The management review under ISO 27001 is a good framework for this, but it must be supplemented with NIS2-specific governance requirements.

The Optimal Approach: Both Frameworks in One Hub

The most efficient strategy is an integrated approach that uses ISO 27001 as the structural foundation and seamlessly layers NIS2 requirements on top. This works best with a tool that understands both frameworks and automatically establishes the connections.

Statement of Applicability as the Central Control Element

The Statement of Applicability (SoA) is the central document in ISO 27001 that shows which controls are applicable, how they are implemented, and why certain controls were excluded. If you extend the SoA with NIS2 requirements and use cross-mappings, you can see at a glance which measures serve both frameworks and where you need NIS2-specific additions.

One Risk Management for All Requirements

Do not run two parallel risk analyses. One risk management process that covers both ISO 27001 requirements and the comprehensive NIS2 approach saves you massive effort. The identified risks and derived measures then automatically serve both frameworks.

Incident Response with Integrated Reporting Deadlines

Build your incident management so that NIS2 reporting deadlines are embedded as fixed milestones in the process. When a security incident occurs, the 24-hour countdown for the initial report starts automatically. This simultaneously fulfils the ISO 27001 requirement for structured incident management and the NIS2 reporting obligation.

How ISMS Lite Connects Both Frameworks

ISMS Lite was built for exactly this integrated approach. As a turnkey ISMS platform for mid-market companies, ISMS Lite includes both NIS2 and ISO 27001 as pre-configured frameworks, including all 93 ISO 27001 controls and all NIS2 requirements. The cross-mappings between both frameworks are already in place.

Specifically, this means for you:

• One SoA for all frameworks: For each control, you see which NIS2 articles and which ISO 27001 controls it covers. One implementation record automatically serves all assigned requirements.
• Integrated incident management: Security incidents are displayed with NIS2 reporting deadlines as a live countdown. The BSI initial report can be generated directly from incident data.
• Service provider management: The in-depth supply chain assessment that NIS2 requires is integrated as its own module, including criticality assessment and sub-contractor tracking.
• Management review with governance evidence: The management review module automatically aggregates ISMS metrics and documents management approval as NIS2 requires.
• Practical guidance for every control: Instead of cryptic standard text, you get a concrete action guide for each control with minimum implementation and practical examples for mid-market companies.

All modules run self-hosted on your own server. Your compliance data never leaves your company. This makes sense not only from a GDPR perspective but is also a strong signal to auditors and the BSI.

Further Reading

• NIS2 for SMEs: What You Need to Know and What to Do Now
• Which Frameworks Do I Need? NIS2, ISO 27001, BSI IT-Grundschutz, TISAX Compared
• Building an ISMS: The Complete Guide for Companies with 50 to 500 Employees
• Creating a Statement of Applicability (SoA): Selecting and Justifying Controls
• NIS2 Reporting Deadlines at a Glance: 24h, 72h, 1 Month — What Is Due When

Conclusion: Not Either/Or, but Both/And

NIS2 and ISO 27001 are not competing requirements but complementary perspectives on the same goal: systematic information security. ISO 27001 provides the structural foundation and internationally recognised methodology. NIS2 adds the legal guardrails — particularly for reporting obligations, supply chain security, and management governance.

The smart path is the integrated approach. Build your ISMS once and build it right, use ISO 27001 as the framework, and incorporate NIS2-specific requirements from the start. With cross-mappings and a tool that understands both frameworks, you avoid duplicate effort and have a clean evidence base for both the certification body and the BSI.

Because in the end, it is not about ticking off two frameworks. It is about actually making your company more secure. And that works best with an end-to-end system.