ISO 27001 and NIS2: where they overlap and where they do not

Organisations with an ISO 27001 certificate often ask us whether that makes them ready for NIS2. The answer: you are a long way there, and the last pieces are exactly the ones nobody arranges by default.

What ISO 27001 already does for you

The standard asks for a management system: scope, risk assessment, measures, internal audit and management review. That covers a large part of the NIS2 duty of care, and more importantly it produces the records the law asks for.

In practice a working ISO system already contains: access management, change management, incident management, supplier management, backup, logging, awareness and an improvement cycle. That is the core of what a regulator wants to see.

Where NIS2 goes further

Three points fall outside what a standard ISO implementation delivers:

• Reporting duty with deadlines. ISO asks for an incident process, not for a report within 24 and 72 hours to a specific authority. You have to set that process up explicitly.
• Supply chain responsibility. NIS2 looks at your suppliers and at what you as a supplier have to demonstrate. That is broader than the supplier assessment in many ISO systems.
• Board accountability. Directors must understand the risks and be able to demonstrate oversight. In many organisations information security lives one layer lower.

The pitfall: a system that only exists on paper

We come across management systems that are neatly written down and not used. The policy says patching happens monthly, while the reporting from the management system shows something else. That is already awkward at an ISO audit; under NIS2 it is riskier, because after an incident you have to show measures actually worked.

The solution is less documentation, not more. Let the records come out of daily work: tickets, monitoring, patch reports and on- and offboarding checklists. Then the audit is a matter of exporting.

A practical route if you are already certified

Four steps, usually a matter of weeks rather than months:

• Hold your scope against the law: does your ISO scope cover the systems and processes NIS2 applies to?
• Add the reporting process: roles, criteria for significance, contact details for the authority and a rehearsed timeline.
• Extend supplier management to the chain, including what you can demonstrate to your own customers.
• Put information security on the board agenda at a fixed rhythm and record decisions.

And if you do not have a certificate yet?

Then ISO 27001 is a good framework, even without certifying. You do not have to do the audit to use the structure. At customers we often set it up so that certifying later is a small step, should a client ask for it.