Noru

ISO 27001 and NIS2: How Far an ISMS Takes You, Measure by Measure

How ISO 27001 maps onto the ten NIS2 Article 21 measures and the implementing regulation's requirements, where the ENISA mapping comes from, and the obligations an ISMS leaves open.

Bip Thelin4 min readPublished

A running ISO 27001 ISMS covers most of the ten cybersecurity risk-management measures in NIS2 Article 21(2), because each measure has Annex A controls and management system clauses behind it, and the Commission's implementing regulation for digital entities was drafted with ISO/IEC 27001 and 27002 as references. ENISA's technical implementation guidance maps every requirement of that regulation to ISO 27001:2022 controls. What the ISMS does not give you is the rest of NIS2: the incident reporting clock in Article 23, the management body's approval, oversight and training duties in Article 20, registration with the national authority, and the national law that applies the directive to you. ISO 27001 certification is evidence of the measures, not NIS2 compliance.

The most common question from ISO 27001-certified companies that fall under NIS2 is whether the certificate is enough. The honest answer is that it is most of the work and none of the paperwork: the measures are largely the same controls, while the duties NIS2 adds, reporting, management liability and registration, have no equivalent in the standard. This article goes measure by measure.

Article 21(2), measure by measure

NIS2 Article 21(2)Where ISO 27001 covers itWhat NIS2 adds or expects beyond the ISMS
(a) Risk analysis and information system security policiesClauses 6.1.2 and 8.2 (risk assessment), 5.2 and A.5.1 (policies)The risk analysis must consider the all-hazards approach of Article 21(1), including physical and environmental threats
(b) Incident handlingA.5.24 to A.5.28, A.6.8The Article 23 reporting clock: early warning within 24 hours, notification within 72 hours, final report within a month
(c) Business continuity, backup, disaster recovery, crisis managementA.5.29, A.5.30, A.8.13, A.8.14Crisis management as an explicit capability, with roles and communication, which ISO leaves to the continuity plan
(d) Supply chain securityA.5.19 to A.5.23Supplier assessment must consider the supplier's own vulnerabilities and development practices and the results of EU coordinated risk assessments
(e) Security in acquisition, development and maintenance, including vulnerability handling and disclosureA.8.8, A.8.25 to A.8.34Coordinated vulnerability disclosure as a policy, not only internal handling
(f) Assessing the effectiveness of measuresClauses 9.1, 9.2, 9.3; A.5.35, A.5.36Nothing material; the internal audit and management review are the evidence
(g) Cyber hygiene and trainingA.6.3, A.8.7, A.8.8, A.8.9Training extends to the management body under Article 20(2)
(h) Cryptography and, where appropriate, encryptionA.8.24A documented policy on when encryption is used; ISO treats it as risk-driven, NIS2 expects it as a stated policy
(i) Human resources security, access control and asset managementA.5.9 to A.5.18, A.6.1 to A.6.7, A.8.2, A.8.3Nothing material; the closest mapping of the ten
(j) Multi-factor or continuous authentication, secured communications and emergency communicationsA.8.5, A.5.14, A.8.20 to A.8.22MFA is named in the directive; an ISMS may have assessed it as unnecessary for some systems, and a supervisor will not accept that

The NIS2 framework page sets out each measure in full, and the Annex A guide lists the controls referenced above.

The implementing regulation and the ENISA mapping

For DNS service providers, TLD registries, cloud, data centre and content delivery providers, managed service and managed security service providers, online marketplaces, search engines, social networks and trust service providers, the Article 21 measures are specified at EU level by Commission Implementing Regulation (EU) 2024/2690. Its annex turns the ten measures into detailed requirements, and its recitals name ISO/IEC 27001, ISO/IEC 27002 and related European standards as the basis. ENISA's Technical Implementation Guidance, published on 26 June 2025, gives practical advice and examples of evidence for each requirement and includes a mapping table from every requirement to ISO/IEC 27001:2022 and other frameworks. If you are one of those entities, that table is the crosswalk to use; if you are not, it is still the best public indication of how supervisors read the measures against the standard.

What the ISMS does not cover

  • Incident reporting under Article 23: the 24-hour early warning, the 72-hour notification and the final report within a month, to the CSIRT or competent authority. The ISMS has an incident process; NIS2 adds a regulatory clock and recipients.
  • Management accountability under Article 20: the management body approves the measures, oversees their implementation, can be held liable, and must follow training. ISO 27001's leadership clause does not create personal liability or mandate training for directors.
  • Registration and identification: entities register with their national authority, and some sectors must notify specific details.
  • National transposition: NIS2 reaches you through national law, which can add sector rules, supervisory powers and penalties. Sweden's Cybersecurity Act (2025:1506) has applied since 15 January 2026.
  • Supply-chain pull-through under Article 21(2)(d): NIS2 entities must assess their suppliers, so a certified supplier helps its customers; the entity still has to run the assessment.

Using the certificate with supervisors and customers

An ISO 27001 certificate, with its scope statement and the Statement of Applicability behind it, is the most concise evidence that the Article 21 measures exist and are audited. Supervisors treat it as evidence, not as a finding of compliance, and will still ask for the reporting procedure, the management body's approval and the training records. Customers that are NIS2 entities will ask for it under Article 21(2)(d) and may ask for the SoA to see whether the controls they depend on are included. Keep the scope wide enough to cover the services those customers buy. Noru maps NIS2's requirements onto the same control library as ISO 27001, so the evidence collected for one serves the other; the regulatory compliance solution describes that setup.

Primary sources

Framework overviews

Related reading

FAQ

ISO 27001 questions answered

Talk to us

Does ISO 27001 certification make us NIS2 compliant?

No. It covers most of the Article 21 measures, which is the bulk of the technical work, but NIS2 also requires incident reporting on a fixed clock, management body approval, oversight and training, registration with the national authority, and compliance with the national law that transposes the directive. Those need their own procedures and records.

Which NIS2 measures does an ISMS not cover?

Article 23 incident reporting, Article 20 management accountability and training, and registration. Within Article 21 itself, multi-factor authentication and a stated encryption policy are expected rather than risk-assessed, and crisis management and coordinated vulnerability disclosure are named explicitly.

Is the ENISA mapping to ISO 27001 official?

It is ENISA's guidance for the entities covered by Implementing Regulation (EU) 2024/2690, published with a mapping table to ISO/IEC 27001:2022 and other frameworks. It is not binding on supervisors, but it is the most authoritative public crosswalk and the regulation's own recitals name ISO/IEC 27001 and 27002 as its basis.

Does NIS2 require ISO 27001 certification?

No. NIS2 requires the measures, not a certificate. Article 24 lets member states require certified ICT products, services or processes under the Cybersecurity Act, which is different from ISMS certification. An ISO 27001 certificate is the common way to evidence the measures to supervisors and customers.

We are certified. What should we add first for NIS2?

The Article 23 reporting procedure with the CSIRT contact and the three deadlines, the management body's documented approval of the measures and its training, registration with your national authority, and a check that multi-factor authentication and encryption are in place where the directive expects them rather than where the risk assessment chose them.