In short: ISO 27001 and the NIS 2 directive overlap strongly, but are not identical. In our assessment, companies certified to ISO 27001 already cover a large part of the NIS 2 measures. The gaps typically lie in registration, reporting deadlines and management duties. An integrated program saves effort and reduces risk.

Why the question matters

Many companies under NIS 2 already have ISO 27001 implemented or certified. The temptation is to think: “We are ISO-certified, NIS 2 is covered.” That is only partly true. Anyone relying on it runs toward an expensive surprise, because NIS 2-specific duties on board liability and reporting channels are not covered by ISO 27001.

Other companies start with NIS 2 without ISO history. For them, the question runs the other way: is ISO 27001 worth as a foundation, or is a NIS 2-specific program enough?

What both have in common

The two frameworks overlap substantially in content. ISO/IEC 27001:2022 Annex A defines 93 controls across organizational, people, physical and technological themes. The ten measures from NIS 2 Article 21 can mostly be mapped onto these controls:

  • Risk management (NIS 2 Art. 21(2)(a)) → ISO 27001 Clause 6.1 and A.5
  • Incident management (Art. 21(2)(b)) → ISO 27001 A.5.24 to A.5.30
  • Backup, crisis management (Art. 21(2)(c)) → A.5.29, A.5.30
  • Supply-chain security (Art. 21(2)(d)) → A.5.19 to A.5.23
  • Secure development and maintenance (Art. 21(2)(e)) → A.8.25 to A.8.34
  • Effectiveness assessment (Art. 21(2)(f)) → Clause 9
  • Cyber hygiene and training (Art. 21(2)(g)) → A.6.3
  • Cryptography (Art. 21(2)(h)) → A.8.24
  • Personnel security, access control (Art. 21(2)(i)) → A.6 and A.8.1 to A.8.18
  • MFA, secure communication (Art. 21(2)(j)) → A.5.17, A.8.5

A well-run ISO 27001 ISMS largely covers the substance of the NIS 2 measures.

Where NIS 2 goes beyond ISO 27001

Three areas where NIS 2 sets additional or more specific duties:

Reporting duties with strict deadlines. ISO 27001 requires an incident-management procedure. NIS 2 prescribes concrete deadlines: 24 hours for the early warning, 72 hours for the notification with an initial assessment, one month for the final report (Article 23 NIS 2, § 32 BSIG). The addressee is the BSI. Registration with the BSI is also required (§ 33 BSIG). ISO 27001 does not state to whom and when to report.

Management duties and liability. ISO 27001 requires management responsibility (Clause 5.1) and a management review (Clause 9.3). NIS 2 goes further: management must approve the measures, oversee their implementation and take part in training (Article 20 NIS 2, § 38 BSIG). If it breaches these duties, it is personally liable to the entity. For essential entities, authorities may as a last resort temporarily exclude individuals from managerial functions (Article 32 (5) NIS 2).

Legal binding force. ISO 27001 is voluntary. Certification is a market promise. NIS 2 is law. Violations lead to fines (up to EUR 10 million or 2 percent of global annual turnover for particularly important entities, up to EUR 7 million or 1.4 percent for important entities, § 65 BSIG) and supervisory orders.

Additionally, NIS 2-specific supply-chain requirements are ISO-conformant but in practice go deeper than what many certified companies live today.

What ISO 27001 has that NIS 2 does not

In the other direction, ISO 27001 brings tools that NIS 2 does not provide by default:

  • Certifiability by accredited bodies, with annual surveillance audits
  • Structured ISMS framework with clear clauses and internationally recognized audit logic
  • Market relevance: ISO 27001 is widespread in tenders and supplier evaluations; NIS 2 compliance is a legal duty, not a competitive differentiator

For most organizations, taking ISO 27001 as foundation and building NIS 2 on top makes sense.

Integrated program: what it looks like

An integrated compliance program runs ISO 27001 and NIS 2 in one stack:

  1. One risk assessment, two views. ISO-compliant risk management per Clause 6.1, extended with NIS 2-specific threat scenarios (especially supply chain and availability).
  2. One control catalog, two mappings. ISO 27001 Annex A controls additionally mapped to NIS 2 Article 21 measures. Gaps are closed.
  3. One board resolution, both duties. Management responsibility per ISO 27001 Clause 5.1, extended with NIS 2 duties for active approval and training.
  4. One reporting process, strict deadlines. ISO incident management extended with the 24-hour, 72-hour and one-month deadlines and the BSI reporting channel.
  5. One documentation, two audits. ISO auditor and BSI supervision draw from the same evidence base, with clear mapping.

This approach avoids duplicate work, keeps audit-readiness high, and makes the compliance program manageable for the board.

Where to start

  • ISO 27001 in place, NIS 2 new: gap analysis against Article 21, add reporting process, establish board training. Estimated additional effort: 3 to 6 months, depending on maturity.
  • Both new: start with ISO 27001 as foundation, think NIS 2 from the outset. Timeline 9 to 18 months to certification, with NIS 2 compliance reachable earlier.
  • NIS 2 without ISO plan: functional, but strategically short-sighted. Anyone targeting B2B tenders will need ISO 27001 anyway.

How GermanAI Defense supports

We guide companies through both frameworks in one program. ISO 27001 certification support, NIS 2 gap analysis and implementation, reporting under § 32 BSIG, audit-ready documentation. We are ISO/IEC 27001:2022 certified ourselves, based in Frankfurt am Main.

→ Applicability, obligations and our approach: NIS 2 consulting

→ More on our GRC and compliance services: GRC & Compliance Consulting