> NIS2 vs ISO 27001: Article 21 mapped to Annex A, what an ISMS covers, which obligations apply on top and whether ISO 27001 is enough for NIS2. Source: [https://docxpert.io/en/guides/nis2-vs-iso-27001](https://docxpert.io/en/guides/nis2-vs-iso-27001) # NIS2 vs ISO 27001: differences and mapping | docxpert ## Two different kinds of requirements Simplified overview; the directive, national law and the standard prevail. | Feature | NIS2 | ISO/IEC 27001:2022 | | --- | --- | --- | | Type | EU Directive (EU) 2022/2555, transposed into national law | International standard | | Binding force | Legal obligation for entities in scope | Voluntary, often required by customers in contracts | | Who is affected? | Entities in certain sectors above a size threshold, classed as essential or important | Any organization that wants an ISMS | | Scope | Network and information systems used to provide the services | Defined by the organization itself | | Evidence | Supervision by national authorities, in Germany the BSI | Certification by accredited bodies | | Sanctions | Fines of at least up to EUR 10 million or 2% of worldwide turnover for essential entities | None; loss of certificate for serious shortcomings | Not legal advice Whether your company falls under NIS2 and which obligations apply in detail follows from the national transposition law. In Germany this is the revised BSI Act. This guide provides a professional overview and does not replace a legal assessment. ## Management system versus list of measures The most important difference in substance lies in the approach. ISO 27001 describes a management system: determine the context, assess risks, select controls, operate them, measure and improve. You justify which Annex A controls you implement in the Statement of Applicability. NIS2, by contrast, starts from specific areas of measures that entities in scope must at least cover and combines them with reporting and supervisory duties. In practice the two complement each other well: the ISO 27001 management system ensures that measures are not implemented once and forgotten but steered, reviewed and improved. NIS2 ensures that certain measures cannot be argued away and that authorities are informed quickly about significant incidents. ## Article 21 compared with ISO 27001 Article 21(2) of the directive lists ten areas that risk management measures must at least cover. The mapping below shows where ISO/IEC 27001:2022, with its clauses and the controls in Annex A, applies. It is our own orientation, not an official correspondence table. Our own mapping for orientation. | NIS2 Art. 21(2) | Content | ISO/IEC 27001:2022 (selection) | Coverage | | --- | --- | --- | --- | | a | Risk analysis and security policies | 6.1.2, 6.1.3, A.5.1 | largely | | b | Incident handling | A.5.24 to A.5.28 | largely, without reporting deadlines to authorities | | c | Business continuity, backup, crisis management | A.5.29, A.5.30, A.8.13, A.8.14 | partly; crisis management often needs adding | | d | Supply chain security | A.5.19 to A.5.23 | largely | | e | Security in acquisition, development and maintenance, vulnerability handling | A.8.8, A.8.25 to A.8.29 | largely; check vulnerability disclosure | | f | Assessing effectiveness | 9.1, 9.2, A.5.35 | largely | | g | Cyber hygiene and training | 7.2, 7.3, A.6.3, A.8.7 | largely | | h | Cryptography and encryption | A.8.24 | largely | | i | Human resources security, access control, asset management | A.5.9 to A.5.18, A.6.1 to A.6.5 | largely | | j | Multi-factor authentication, secured communications | A.5.14, A.8.5 | partly; implement MFA explicitly | “Largely” means that an effectively implemented ISMS usually contains the measure. What matters, however, is not the certificate but whether the measure actually applies across all relevant systems. An ISMS covering only part of the company covers NIS2 only partly. ## What ISO 27001 does not cover - **Reporting obligations:** early warning within 24 hours, incident notification within 72 hours and a final report within one month to the competent body for significant incidents. ISO 27001 requires incident management but no notification to authorities with deadlines. More in the guide [NIS2 incident reporting](https://docxpert.io/en/guides/nis2-incident-reporting). - **Registration:** entities in scope must register with the competent authority. - **Management accountability:** management must approve the measures, oversee their implementation and take part in training; it can be held liable for breaches. ISO 27001 requires leadership and commitment but no personal liability. - **Scope:** under NIS2 you cannot freely choose which systems are included. The measures apply to the systems you use for your services. - **Risk acceptance:** ISO 27001 allows risks to be consciously accepted. Under NIS2, measures must be appropriate to the state of the art and the risk, which narrows that leeway. ## Approach with and without an ISMS ### You already have an ISO 27001 ISMS 1. 1 Check the scope Does your ISMS cover all systems used for the services in scope? Extend it if needed. 2. 2 Go through the mapping Check the ten areas of Article 21 against your Statement of Applicability and risk treatment. 3. 3 Add the reporting chain Define criteria for significant incidents, responsibilities, deadlines and channels, and rehearse the process. 4. 4 Involve management Have management approve the measures and document their training. ### You do not have an ISMS yet Then ISO 27001 is a proven framework for building the NIS2 measures in a structured way, even without certification. Start with the scope check, registration and the reporting chain, because these obligations apply regardless of maturity. Then build risk analysis, policies and measures by priority. The [NIS2 checklist](https://docxpert.io/en/checklists/nis2) and the [ISO 27001 checklist](https://docxpert.io/en/checklists/iso-27001-readiness) help you get started. ## Is an ISO 27001 certificate sufficient evidence? NIS2 does not require a certificate. An ISO 27001 certificate is, however, strong evidence that an information security management system exists and works. Authorities and customers look at whether the scope fits and whether the NIS2-specific obligations are also met. A certificate covering a small part of the company therefore helps little if the services in scope lie outside it. Conversely, anyone who implements NIS2 carefully has already done much of the work for ISO 27001 certification. Many companies therefore follow a joint approach and decide later whether to certify the ISMS. ## Example: a managed service provider A managed service provider with 90 employees has been ISO 27001 certified for three years. The scope covers the data centre but not the remote management tool technicians use to access customer systems. The NIS2 review shows that this very tool is central to the services. The company extends its scope, introduces multi-factor authentication for all remote access, defines a reporting chain with on-call duty and has management trained. More on this industry under [NIS2 for managed service providers](https://docxpert.io/en/use-cases/it-service-providers). ## Timeline and priorities The directive has applied since January 2023 and had to be transposed into national law by October 2024. In Germany the transposition law entered into force at the end of 2025; the obligations have applied since then largely without a transition period. If you are only starting now, prioritise: first clarify scope and register, then make the reporting chain operational, then implement the risk management measures step by step according to risk. Building an ISO 27001 ISMS typically takes six to twelve months in mid-sized companies until it is ready for certification. Do not let that time pass before meeting the legal obligations that apply regardless of maturity. ## Common mistakes - Presenting the ISO 27001 certificate as NIS2 evidence without checking the scope. - Describing the reporting chain only on paper and never rehearsing it; in an emergency, responsibilities outside working hours are missing. - Only informing management instead of having it approve the measures. - Limiting supply chain security to questionnaires without actually evaluating critical service providers. - Not documenting the scope check and not repeating it when the company grows or adds services. ## NIS2 and ISO 27001 in docxpert docxpert includes requirement catalogues for NIS2 and ISO/IEC 27001:2022. One document, such as an access control policy, can be mapped to requirements of both frameworks. The [gap analysis](https://docxpert.io/en/features/gap-analysis) shows per framework which requirements are covered and where evidence is missing. For reporting obligations, [NIS2 incident management](https://docxpert.io/en/features/nis2-incident-reporting) calculates the deadlines for early warning, notification and final report from the time of detection and documents every stage; the notification itself goes through the authority's channels. Templates for NIS2 applicability, risk assessment, Statement of Applicability, technical controls, security incidents and business continuity are in the template library. ## Sources - [EUR-Lex: Directive (EU) 2022/2555 (NIS2)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) - [ISO: ISO/IEC 27001:2022](https://www.iso.org/standard/27001) ## Frequently asked questions Is ISO 27001 enough for NIS2? Not completely. An ISMS covers many Article 21 measures but not the reporting obligations, registration and management's specific duties. The scope must also include all relevant systems. Do I need ISO 27001 certification to comply with NIS2? No. NIS2 does not require a certificate. ISO 27001 is a proven framework; certification remains voluntary. What are the NIS2 reporting deadlines? Early warning within 24 hours of becoming aware of a significant incident, incident notification within 72 hours and a final report within one month. Is there an official mapping between NIS2 and ISO 27001? Various bodies have published mappings. The table in this guide is our own orientation and does not replace a case-by-case review. What about ISO 27001:2013? The transition period for certificates to the 2013 edition ended on 31 October 2025. The 2022 edition is the relevant one. ## Read next [NIS2Implement risk management measures, management training duties and reporting deadlines.Learn more](https://docxpert.io/en/standards/nis2) [ISO 27001ISMS documentation, policies, Statement of Applicability and awareness training under control.Learn more](https://docxpert.io/en/standards/iso-27001) [NIS2 incident reportingWhen an incident is significant and what to report in 24 hours, 72 hours and one month.Learn more](https://docxpert.io/en/guides/nis2-incident-reporting) [IT service providers and MSPsNIS2 obligations, ISO 27001 and customer requirements in one management system.Learn more](https://docxpert.io/en/use-cases/it-service-providers) [NIS2 checklistScope, registration, risk measures, reporting channels and management training.Learn more](https://docxpert.io/en/checklists/nis2) Free checklist ## NIS2 checklist Scope, registration, risk measures, reporting channels and management training. [NIS2 checklist](https://docxpert.io/en/checklists/nis2)[Or try docxpert for 14 days](https://docxpert.io/en/trial)