NIS2 vs ISO 27001: Differences and Overlaps

NIS2 is EU law, ISO/IEC 27001 a voluntary standard: how the ten Article 21 measures map to Annex A, what a certificate proves and which duties remain.

The law decides who must act, by when and under whose supervision; the standard describes how an organisation runs its security management.

Directive (EU) 2022/2555 entered into force on 16 January 2023 and has applied through national law since 18 October 2024 (Articles 45 and 41(1)). The Directive is addressed to the Member States (Article 46), so an organisation meets the obligations of the NIS2 Directive through the national act of its Member State.

The two instruments differ in who they cover, overlap in the ten Article 21(2) measures that ENISA maps to ISO/IEC 27001:2022 clauses and Annex A controls, and part ways on five groups of legal duties that no standard creates. A certificate is evidence, not proof, and one management system can carry both. The table below compares the two instruments point by point.

Point	NIS2 (Directive (EU) 2022/2555)	ISO/IEC 27001:2022
Nature	Directive addressed to Member States (Art. 46), applied through national law	Voluntary international standard
Who	Annex I and II entity types, medium-sized or larger, plus entities covered regardless of size (Art. 2)	Any organisation that chooses it
Content	Ten minimum measures (Art. 21(2)), incident reporting (Art. 23), registration (Art. 3(4), Art. 27), management body duties (Art. 20)	ISMS requirements (clauses) and Annex A controls
Proof	National supervision, audits and inspections (Art. 32, 33)	Voluntary certification audit
Consequences	Fines with a maximum of at least EUR 10,000,000 or 2 % (essential) and EUR 7,000,000 or 1.4 % (important) of worldwide annual turnover, whichever is higher (Art. 34(4), (5))	None in law
Link between them	Art. 21(1) standards clause; recital 3 of Regulation (EU) 2024/2690	Named as a basis of the Annex to Regulation (EU) 2024/2690

What Is the Difference Between NIS2 and ISO/IEC 27001?

The difference is legal force: Directive (EU) 2022/2555 sets minimum cybersecurity obligations that Member States must impose on entities in 18 sectors, while ISO/IEC 27001:2022 sets requirements an organisation of any type may choose to meet and have certified. Law and standard therefore answer two different questions: the Directive asks whether an entity has met its legal duties, and the standard asks whether an organisation's management system conforms to the standard's own requirements.

Three consequences follow. The national law decides whether an entity is in scope, while an ISO/IEC 27001 user defines its own scope. A competent authority checks NIS2 compliance under Articles 32 and 33, while a certification body checks conformity with the standard at the organisation's request. A NIS2 breach can lead to enforcement measures and to fines under Article 34, while the outcome of a certification audit has no legal consequence of its own. The same split between law and voluntary framework runs through every page of NIS2 and other laws and standards compared.

Law versus Voluntary Standard: Who Is Bound and How

The Directive is addressed to Member States (Article 46), and an entity is bound by the national law that transposes it, not by the Directive's text. Each national act names the competent authority, sets the registration route and fixes penalties whose maximums reach at least the levels of Article 34.

ISO/IEC 27001:2022 is edition 3.0 of the standard, published in October 2022 and developed by the joint technical committee ISO/IEC JTC 1/SC 27. Amendment ISO/IEC 27001:2022/Amd 1:2024, "Climate action changes", was published on 23 February 2024. The standard has no legal force of its own: it binds an organisation only where a national law or a contract refers to it. No precedence rule is needed between the two instruments, because a law and a voluntary standard do not compete. Where they differ, the law prevails, and the standard serves as evidence of how the legal duty is met.

Where the Directive and Its Implementing Act Refer to Standards

Article 21(1) of NIS2 requires measures that take into account the state of the art and, where applicable, relevant European and international standards, without naming ISO/IEC 27001. The same sentence of the Directive text on EUR-Lex adds the cost of implementation, and proportionality turns on the entity's exposure to risks, its size and the likelihood and severity of incidents.

Article 25(1) requires Member States to encourage the use of European and international standards and technical specifications, without imposing or discriminating in favour of a particular type of technology. Under Article 25(2), ENISA advises on the relevant standards. Recital 79 of the Directive refers to the ISO/IEC 27000 series, the family to which ISO/IEC 27001 belongs.

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 names ISO/IEC 27001 directly. It has been in force and directly applicable since 7 November 2024 for the 11 entity types of Regulation (EU) 2024/2690, from DNS service providers to trust service providers. Recital 3 of the Regulation text states that its Annex requirements are based on ISO/IEC 27001, ISO/IEC 27002, ETSI EN 319401 and CEN/TS 18026:2024, and the detailed requirements are set out under Implementing Regulation (EU) 2024/2690.

Who Each Instrument Covers

NIS2 covers public or private entities of an Annex I or Annex II type that are medium-sized or larger and operate in the Union, plus entities covered regardless of size, while ISO/IEC 27001 is open to any organisation that chooses it. The Directive's coverage follows from Article 2(1) and its exceptions in Article 2(2) to (4); the standard's coverage follows from the organisation's own decision. The table below sets out the five scope questions side by side.

Question	NIS2	ISO/IEC 27001:2022
Who decides scope	Art. 2(1) and the national law; see who NIS2 applies to	The organisation
Category	Essential or important (Art. 3); see essential entities under NIS2	None
Geographic reach	Entities providing services or carrying out activities in the Union	Worldwide
Sectors	18 sectors: 11 in Annex I, 7 in Annex II	Any
Size	Medium-sized or larger; size-independent cases in Art. 2(2) to (4)	Any

Essential and important entities carry the same Article 20, 21 and 23 duties; the categories differ in supervision and in the fine maximums. A certificate does not change an entity's category: an ISO/IEC 27001 holder that is essential under its national law stays essential, with ex ante and ex post supervision under Article 32.

How the Ten Minimum Measures Map to ISO/IEC 27001:2022 Annex A

ENISA's mapping table references each of the ten minimum measures of Article 21(2) points (a) to (j), through the Annex sections of Regulation 2024/2690, to ISO/IEC 27001:2022 clauses and Annex A controls, as an advisory aid rather than a statement of equivalence. Article 21(2) states that the measures "shall include at least" points (a) to (j), based on an all-hazards approach that also protects the physical environment of the systems. The mapping runs per Annex point in 49 rows, and the table below condenses it per letter with representative Annex points for each of the ten cybersecurity risk-management measures.

Art. 21(2) point	Measure (short)	Reg. 2024/2690 Annex section	ISO/IEC 27001:2022 references (ENISA mapping table version 1.2, representative points)	Measure page
(a)	Risk analysis and security policies	1, 2	1.1: clause 5.2, A.5.1, A.5.4, A.5.36, clause 9.3; 2.1: clauses 6.1, 6.1.2, 6.1.3, 6.2, 8.2, 8.3, A.5.7; 2.3: clauses 9.2, 10.1, A.5.35, A.8.34	risk analysis and information system security policies
(b)	Incident handling	3	3.1: A.5.24; 3.2: A.5.28, A.8.15 to A.8.17; 3.3: A.6.8; 3.4: A.5.25; 3.5: A.5.26; 3.6: A.5.27	incident handling
(c)	Business continuity, backup, crisis management	4, 13.1	4.1: A.5.29, A.5.30; 4.2: A.8.13, A.8.14; 4.3: A.5.26, A.5.29, A.5.30; 13.1: A.7.11	business continuity, backup and crisis management
(d)	Supply chain security	5	5.1: A.5.19, A.5.20, A.5.21, A.8.30; 5.2: A.5.22	supply chain security
(e)	Acquisition, development, maintenance, vulnerability handling	6, 13.2	6.1: A.5.21, A.5.23; 6.2: A.8.25, A.8.31; 6.5: A.8.29, A.8.33, A.8.34; 6.6: A.8.31, A.8.32; 6.10: A.8.8	secure development and vulnerability handling
(f)	Effectiveness assessment	7	7: clauses 6.2, 9.1, 9.3 (no Annex A control)	assessing the effectiveness of measures
(g)	Cyber hygiene and training	8	8.1: clause 7.3, A.6.3, A.8.7; 8.2: clause 7.2, A.6.3	basic cyber hygiene practices and cybersecurity training
(h)	Cryptography and encryption	9	9: A.5.31, A.8.24	cryptography and encryption
(i)	HR security, access control, asset management	10, 11, 12, 13.3	10.1: clauses 7.1, 7.2, A.6.2, A.6.3; 10.2: A.6.1; 11.1: A.5.15, A.7.2, A.8.3, A.8.21; 11.2: A.5.3, A.5.18; 12.1: A.5.9, A.5.12, A.5.13; 13.3: A.7.1, A.7.2, A.7.4	human resources security and access control; asset management
(j)	MFA and secured communications	11.6, 11.7	11.6: A.5.17; 11.7: A.8.5; no Annex point for secured voice, video, text and emergency communications	multi-factor authentication and secured communications

Source: ENISA mapping table version 1.2, an advisory mapping by ENISA and not a measure of equivalency. Numbers without "A." are ISO/IEC 27001:2022 clauses, not Annex A controls.

What the ENISA Mapping Table Shows and What It Does Not

The ENISA mapping table version 1.2 maps the 49 rows of the Annex to Regulation 2024/2690 to ISO/IEC 27001:2022, NIST CSF 2.0, ETSI EN 319 401, CEN/TS 18026:2024 and five national frameworks. The 49 rows are the 47 titled Annex subsections plus one row each for sections 7 and 9. The national columns cover Belgium's CyFun 2023, Finland's Kybermittari, Greek Ministerial Decision 1689/2025, Spain's ENS (Royal Decree 311/2022) and a column labelled "FR". The table accompanies ENISA's Technical Implementation Guidance version 1.0 of 26 June 2025, which is itself non-binding and states that following it does not assume compliance.

ENISA states that the mapping "should not be interpreted as a measure of equivalency among standards or frameworks", and the table is not legally binding and only of an advisory character. The table also maps a Regulation that binds only the 11 entity types of Regulation (EU) 2024/2690. For a hospital, an energy company or a manufacturer, the Annex is a reference for the state of the art, not its legal text: the national law of the entity's Member State sets its measures.

Points Where the Mapping Is Partial

Three points in the mapping rest on management-system clauses or have no Annex A counterpart at all. They are listed below in the order of Article 21(2).

Supply chain, point (d): Annex section 5 maps to the supplier controls A.5.19 to A.5.22 and A.8.30, but the Directive limits the duty to the relationships with direct suppliers or service providers, and suppliers are not directly obliged by NIS2. Recital 85 adds that entities could consider risks from other supplier tiers.
Effectiveness, point (f): Annex section 7 maps to clauses 6.2, 9.1 and 9.3, not to an Annex A control. The BSI's effectiveness guidance for German entities uses the same three clauses.
Communications, point (j): multi-factor authentication maps to A.5.17 and A.8.5, but secured voice, video, text and emergency communications have no Annex point and so no mapped control. Article 21(2)(j) requires these solutions "where appropriate"; under Regulation 2024/2690, Annex point 11.7.1 ties MFA to the classification of assets, and Article 2(2) requires a documented reason where a requirement is not applied.

A mapped control is therefore a starting point for a gap review; the Annex text and the national law decide what an entity must actually do.

Obligations Without an ISO/IEC 27001 Equivalent

Five groups of NIS2 obligations have no counterpart in ISO/IEC 27001: registration with the authorities, incident reporting on a legal clock, personal duties of the management body, state supervision and administrative fines. An ISMS may contain processes that support each of them, but the duty itself, its deadline and its addressee come only from the Directive and the national law. The table below sets each duty against its closest ISO/IEC 27001:2022 counterpart.

NIS2 obligation	Legal basis	ISO/IEC 27001:2022 counterpart	What to add	Owner page
Registration data and updates	Art. 3(4); Art. 27 registry for the 11 types of Article 26(1)(b), data by 17 January 2025, changes within three months	None	Registration with the national authority and a change process	NIS2 registration
Incident reporting	Art. 23(1), 23(4): early warning within 24 hours, notification within 72 hours, final report not later than one month after the notification, to the CSIRT or, where applicable, the competent authority	Incident management controls A.5.24 to A.5.28, without an authority clock	Reporting procedure, significance test and timers	NIS2 incident reporting
Management body	Art. 20(1): approval of the measures, oversight of their implementation, liability; Art. 20(2): training	Clauses 5.2 and 9.3 (policy and management review)	Board approval records and training evidence	what management bodies must approve and oversee
Supervision and audits	Art. 32 ex ante and ex post (essential), Art. 33 ex post (important); Art. 32(2)(b) regular and targeted security audits	Voluntary certification audits	Audit-ready evidence for the authority	NIS2 supervision and enforcement
Fines	Art. 34(4): maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover; Art. 34(5): at least EUR 7,000,000 or 1.4 %; whichever is higher in both cases	None	None (consequence, not a process)	NIS2 fines

The Directive sets no training frequency for members of the management body, so the national law or the entity's own policy fixes it. For the 11 entity types of Regulation (EU) 2024/2690, the Regulation adds fixed intervals that an ISMS calendar must absorb: the security policy is reviewed at least annually (Annex point 1.1.2), the risk assessment results and the risk treatment plan at least annually (point 2.1.4), and role assignments at least annually (point 10.1.3). Article 2(2) of the Regulation adds a second rule: where a requirement applies "where appropriate", "where applicable" or "where feasible" and the entity does not apply it, the entity documents its reasoning.

Does an ISO/IEC 27001 Certificate Prove Compliance with the Directive?

No: an ISO/IEC 27001 certificate is evidence of a working management system, but the Directive creates no presumption of conformity for it, and Article 24(1) refers only to European cybersecurity certification schemes under Regulation (EU) 2019/881. Under Article 24(1), Member States may require entities to use ICT products, ICT services and ICT processes certified under schemes adopted under Article 49 of Regulation (EU) 2019/881, the Cybersecurity Act of 17 April 2019, and shall encourage the use of qualified trust services. ISO/IEC 27001 is not such a scheme, and the certificate covers an organisation's management system, not a product.

Supervisors check the measures against the law, not against the certificate. For essential entities, the competent authority may order regular and targeted security audits carried out by an independent body or by the authority itself (Article 32(2)(b)), and the audit tests the national measures. In Germany, the BSI one-pager "ISO/IEC 27001 im Kontext NIS-2/BSIG" (version 1.0 of 1 April 2026, listed on the BSI NIS-2 hub on 2 April 2026) states that an ISO/IEC 27001 certification does not automatically meet all legal requirements of the BSIG. The BSI gives two reasons: an ISMS scope can be defined freely, whereas § 30 BSIG covers the whole regulated entity, and ISO/IEC 27001 allows a risk to be accepted or transferred, whereas the BSIG requires appropriate, effective and proportionate measures.

No EU-wide NIS2 certificate for organisations exists. A certificate still has practical value: according to the same BSI one-pager, a fully implemented ISO/IEC 27001 regularly covers a large part of the § 30 BSIG measures. The EU schemes, the national routes and the pending proposals are set out under NIS2 certification options.

How National Laws and Authorities Use ISO/IEC 27001

The three Member States in the table give ISO/IEC 27001 three different roles: a named conformity framework in Belgium, one possible form of proof for operators of critical installations in Germany, and a comparison reference in France. The table below names the instrument and provision for each.

Member State	Instrument and provision	Role of ISO/IEC 27001	Country page
Germany	§ 39(1) BSIG: operators of critical installations prove their measures every three years by audits, tests or certifications; BSI NIS-2 hub: one-pager "NIS-2 und ISO 27001"	A certification is one possible form of proof; IT-Grundschutz is not mandatory (BSI FAQ)	NIS2 in Germany; new BSIG after NIS2UmsuCG
Belgium	Royal Decree of 9 June 2024, Art. 5 § 1: essential entities use the CyberFundamentals framework (Art. 4) or NBN EN ISO/IEC 27001 (Art. 5 § 1, 2°); important entities may opt for the voluntary assessment (Art. 5 § 2); Art. 22 §§ 1 and 2: deadlines of 18 and 30 months after the entry into force of the NIS2 law or the identification date	A named reference framework next to the CCB framework; under Art. 42 of the Law of 26 April 2024, entities assessed under Arts. 39 and 41 are presumed to comply until proven otherwise	CyberFundamentals (CyFun); NIS2 in Belgium
France	ANSSI MesServicesCyber: comparison tool (lab.cyber.gouv.fr)	Compared against ISO 27001/27002 and the Annex to Regulation (EU) 2024/2690	ReCyF, ANSSI's NIS2 security objectives

The national law of the entity's Member State decides which role, if any, a certificate plays; the three countries above are the ones this comparison covers, and their approaches do not carry over to other Member States. In Belgium, the ISO/IEC 27001 route is a choice for essential entities alongside CyFun, not a duty. In France, the tool compares requirements, and as of 23 October 2026 France has not adopted its NIS2 law.

How to Build One Programme for the Directive and ISO/IEC 27001

Run one information security management system and extend it in six steps, so that every NIS2 obligation has an owner, a control and evidence in the same register. The six steps below follow the order in which the law sets the duties.

Confirm scope and category under the national law with the NIS2 scope check, and extend the ISMS scope to every network and information system the entity uses for its operations or services.
Map existing controls against the Annex points with the ENISA table and record each gap in a NIS2 gap analysis.
Extend the risk assessment to the all-hazards approach of Article 21(2), including the physical environment of the systems.
Add the legal-only processes: registration, the reporting timers of 24 hours, 72 hours and one month after the notification, and board approval and training under Article 20.
Apply the annual review intervals of Regulation (EU) 2024/2690 where the entity is one of its 11 entity types.
Keep audit-ready evidence for NIS2 audits and correct gaps without undue delay, as Article 21(4) requires.

How Does ISO/IEC 27001 Sit Next to Other Standards and Laws?

ISO/IEC 27001 is one reference among the frameworks used to organise NIS2 measures, and its three closest neighbours are a sector law that displaces parts of NIS2 for financial entities and two voluntary frameworks. Each neighbour has its own comparison page, listed below.

DORA: Regulation (EU) 2022/2554 has applied since 17 January 2025 and is lex specialis for financial entities via NIS2 Article 4 and DORA Article 1(2); it displaces the NIS2 measures, reporting and supervision for those entities, while NIS2 Articles 7, 9 and 16 still apply. See NIS2 vs DORA.
NIST CSF 2.0: NIST CSWP 29, published on 26 February 2024, is voluntary, not named in NIS2 and mapped in the same ENISA table. See NIS2 vs the NIST Cybersecurity Framework 2.0.
IEC 62443: a voluntary series for industrial automation and control systems, named neither in NIS2 nor in Regulation (EU) 2024/2690. See NIS2 and OT security vs IEC 62443.

NIS2 and ISO/IEC 27001 Questions

Five questions recur when an ISO/IEC 27001 holder prepares for NIS2.

Does the Directive require an ISO/IEC 27001 certificate?

No: neither the Directive nor Regulation 2024/2690 requires ISO/IEC 27001 certification, and Article 24(1) lets Member States require only certified ICT products, services and processes under EU schemes. A cyber posture certificate, with a scheme under the proposed revision of the Cybersecurity Act (COM(2026) 11), is proposed in COM(2026) 13 of 20 January 2026 and would remove additional Article 32(2)(b) and 33(2)(b) audits for the requirements it covers; as of 23 October 2026 the proposal is pending, with the European Parliament at the stage "Awaiting committee decision" according to the EP Legislative Observatory, as tracked under NIS2 amendments and review.

Which other ISO standards do the Directive and its implementing act name?

Recital 79 of NIS2 refers to the ISO/IEC 27000 series, recital 58 names ISO/IEC 30111 and ISO/IEC 29147 for vulnerability handling and disclosure, and recital 3 of Regulation 2024/2690 names ISO/IEC 27001 and ISO/IEC 27002. ENISA's Technical Implementation Guidance also cites ISO/IEC 27005:2022, point 6.4, for risk criteria.

Can the ENISA mapping be downloaded as a spreadsheet?

Yes: ENISA publishes the mapping table version 1.2 as an .xlsx file next to its Technical Implementation Guidance, free of charge. The file is linked below the mapping table above.

Does an ISMS scope have to cover the whole entity?

For NIS2, yes in effect: the Article 21 measures protect the network and information systems the entity uses for its operations or services, whatever scope an ISO/IEC 27001 certificate declares. A certificate limited to one site or one service leaves the rest of the entity to be covered by the same measures.

Does ISO/IEC 27001:2013 still matter for NIS2?

The current edition is ISO/IEC 27001:2022 (edition 3.0), and it is the edition that the ENISA mapping table uses. Mapping work against NIS2 therefore starts from the 2022 clause and control numbers.

NIS2 vs ISO/IEC 27001: Scope, Obligations and Overlaps Compared

Summary