NIS2 and ISO 27001: what carries over, what needs its own review
An ISO 27001 certificate can give you useful evidence for a NIS2 review. It does not establish that your entity meets NIS2. Compare the scope of your ISMS with the services and systems covered by national law, then review the remaining obligations.
Updated
Side-by-Side Comparison
| Evaluation Criterion | NIS2 | ISO 27001 |
|---|---|---|
| Status | EU directive implemented through national law | International ISMS standard |
| Scope | Specified entity types, size rules and exceptions | The defined scope of the ISMS |
| Outcome | Compliance with applicable legal obligations | Independent certification of the ISMS |
| Incident handling | Reporting duties under Article 23 and national rules | Controls and processes selected for the ISMS |
| Evidence reuse | Check each obligation and service scope | Risk, access, supplier and recovery records may support both |
Start with scope
An ISMS certificate may cover one product or location while NIS2 applies to a wider service. List the legal entities, services, systems and dependencies in both reviews. Resolve differences before reusing a control assessment.
Reuse evidence after checking it
Risk assessments, access reviews, incident exercises and restore-test records may support both reviews. Check whether they cover the required systems and period. A mapping is a guide to related evidence, not a percentage of compliance already achieved.
Treat reporting separately
Build a reporting procedure around the applicable incident thresholds, recipients and deadlines. Having an ISO incident-management process does not demonstrate that it covers NIS2 notifications. Practise the decision and escalation path, including when information is incomplete.
Keep management involved
Review who approves measures, oversees implementation and receives unresolved risks. NIS2 management obligations and national accountability provisions need explicit attention even if an ISMS management review already takes place.
Plan the work from the gaps
Keep legal applicability, certification scope and operational remediation visible as distinct decisions. Use the mapping guide to organise a review, then assign the missing evidence or changes to a named owner.
Making the decision
Use the ISMS work you already have, but test it against the NIS2 scope and the law that applies to your entity. Concentrate on uncovered services, reporting and management responsibilities. Certification and legal compliance remain separate conclusions.
For a requirement-by-requirement review, use the NIS2 and ISO 27001 mapping guide alongside the NIS2 review workbook. A mapping identifies related evidence; it does not establish legal compliance.