ISO 27001 vs NIS2: How They Overlap and Where They Differ

Organisations preparing for NIS2 often ask whether ISO/IEC 27001 already covers it, or whether they should pursue one before the other. The two are different in nature. ISO 27001 is a voluntary international standard for an information security management system. NIS2 is an EU directive, implemented through national law, that sets legal obligations for covered entities. They overlap substantially, but neither replaces the other. This guide explains how to use them together. It is general information and not legal advice.

What It Is

ISO/IEC 27001:2022 specifies requirements for establishing, operating, and improving an information security management system (ISMS): context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation, and improvement. Its Annex A lists 93 reference controls grouped into organisational, people, physical, and technological themes, selected according to your risk assessment. Organisations may choose to have their ISMS audited by an accredited certification body. NIS2 instead requires covered entities to implement risk-management measures across defined areas, holds management bodies accountable, and adds strict incident reporting to authorities, supervision, and penalties. The overlap is large: risk assessment, policies, access control, cryptography, supplier security, incident management, continuity, and training appear in both. The differences matter too. NIS2 sets legal reporting deadlines, explicit management accountability and training, and national supervision; ISO 27001 lets you define scope, which may not match the services NIS2 cares about.

Who It Is For

This comparison is useful for:

Organisations with an existing ISO 27001 programme assessing NIS2 gaps
Organisations in NIS2 scope deciding whether to build an ISMS as their framework
Suppliers asked by customers for either ISO 27001 alignment or NIS2-related assurances
Management teams allocating budget between frameworks

What It Helps Clarify

Comparing them side by side helps clarify:

Which existing controls and records can be reused as NIS2 evidence
Whether your ISMS scope covers the services and systems relevant under NIS2
Which NIS2 obligations, such as reporting timelines, need additional procedures
Whether formal ISO certification is a business requirement or simply a useful framework

What's Included

Compare your ISMS scope with the services and systems that would be relevant under NIS2
Map Annex A controls you have implemented to the NIS2 Article 21 measure areas
Add an incident procedure for the 24-hour, 72-hour, and one-month reporting stages
Document management body approval, oversight, and training explicitly
Extend supplier assessment to cover the ICT suppliers behind critical services
Check national transposition for additional requirements or referenced schemes
Use internal audits and management reviews to show measures are effective over time
Keep evidence of technical controls, not just policies

What's Not Included

ISO 27001 certification or an audit by a certification body
A statement that ISO 27001 certification satisfies NIS2 obligations
Legal interpretation of national NIS2 law
Official titles or accreditations

When to Choose It

Use this comparison when planning your security programme for the next one to two years. If customers require an ISO 27001 certificate, plan for an accredited certification audit as a separate step. If you are in NIS2 scope, use the ISMS structure to organise measures but add the directive-specific elements. If you have neither, starting with a structured gap review against an agreed reference is often more useful than writing policies first. This article is general information and not legal advice.

Our Approach

Treat ISO 27001 as the management structure and NIS2 as a set of legal requirements that the structure must meet. Begin with a single control set mapped to both, so each control has one owner and one set of evidence. Pay particular attention to scope: an ISMS that covers only a head office function will not demonstrate much about the systems behind a critical service. Our Security Baseline Review can help with the technical side: a written, severity-graded view of agreed assets and readiness-gap observations against an agreed reference where included in the confirmed scope. It is readiness and decision support that prepares you for work with accredited certification bodies, auditors, and legal advisers. Where certification is your goal, choose an accredited certification body for the audit and keep the readiness work separate from it.

Security Baseline Review

View the Security Baseline Review service page