Most growing technology companies eventually meet the same two acronyms. An enterprise customer's security questionnaire asks for your ISO/IEC 27001 certificate. A prospect in energy or healthcare asks whether you are ready for NIS2. Your board wants to know which is a legal requirement, which is a sales requirement, and how much of the work counts for both.
They are different instruments. ISO/IEC 27001 is a voluntary, certifiable international standard for running an information security management system (ISMS). NIS2 is an EU directive that each member state turns into national law, with supervisors, reporting deadlines and fines. You choose to pursue the first; the second may apply to you whether you choose it or not.
This guide, written for founders, CTOs and security leads, explains both, how to tell whether NIS2 applies, and a roadmap that avoids doing the work twice.
ISO/IEC 27001: A Certifiable Management System Standard
ISO/IEC 27001 specifies the requirements for an ISMS: a repeatable way to assess information security risks, treat them, and prove the treatment works. The current edition, ISO/IEC 27001:2022, was published on 25 October 2022. Amendment 1, published in February 2024, asks organisations to determine whether climate change is a relevant issue. The transition period for the 2013 edition ended on 31 October 2025, so a current accredited certificate should reference ISO/IEC 27001:2022.
Two features shape most readiness projects.
- Annex A is a reference set, not a checklist. It lists 93 controls grouped into four themes: organisational, people, physical and technological. You select controls through risk treatment, then check them against Annex A so nothing necessary is missed.
- The Statement of Applicability (SoA) ties it together. Required by clause 6.1.3 d), it records which controls you need and why, whether they are implemented, and why any Annex A control is excluded.
Certification is optional. An accredited certification body runs a Stage 1 preliminary assessment and a Stage 2 certification assessment, followed by surveillance audits and recertification.
NIS2: An EU Directive Enforced Through National Law
The NIS2 Directive, Directive (EU) 2022/2555, was adopted on 14 December 2022. Member states had to adopt and publish national measures by 17 October 2024 and apply them from 18 October 2024, when the original NIS Directive was repealed.
NIS2 sets a minimum, so member states may go further, and transposition has been uneven: on 7 May 2025 the European Commission sent reasoned opinions to 19 member states for failing to notify full transposition. In January 2026 the Commission also proposed targeted amendments to simplify compliance. Check the current national law in each country where you provide services.
The operative obligations sit in four articles.
- Article 20, governance: management bodies must approve risk-management measures, oversee their implementation and can be held liable for infringements, and their members must follow training.
- Article 21, risk-management measures: appropriate and proportionate technical, operational and organisational measures, based on an all-hazards approach, covering at least ten areas.
- Article 23, reporting: significant incidents must be reported to the national CSIRT or competent authority on a fixed timeline.
- Article 34, fines: for breaches of Articles 21 or 23, maximum fines of at least EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for essential entities, and at least EUR 7 million or 1.4% for important entities.
Does NIS2 Apply to Your Company?
Applicability turns on sector, size and classification. Document your answer to each.
Sector
NIS2 covers 18 sectors. Annex I lists sectors of high criticality, such as energy, transport, banking, health, digital infrastructure and ICT service management. Annex II lists other critical sectors, such as postal services, manufacturing and digital providers. For technology companies, the key entries are these.
- Digital infrastructure (Annex I): internet exchange points, DNS and TLD services, cloud computing, data centres, content delivery networks, trust services and electronic communications.
- ICT service management (Annex I): business-to-business managed service providers and managed security service providers.
- Digital providers (Annex II): online marketplaces, online search engines and social networking services platforms.
Size
The general rule is a size cap: NIS2 applies to entities in those sectors that are medium-sized or larger under Commission Recommendation 2003/361/EC. In practice, you fall below the cap only as a small or micro enterprise, meaning fewer than 50 staff and an annual turnover or balance sheet total of no more than EUR 10 million. Group structure matters, because partner and linked enterprises can count. Some, such as trust service providers, DNS service providers, TLD name registries and electronic communications providers, are in scope regardless of size.
Essential or Important
Essential entities include Annex I entities above the medium-sized ceilings (broadly, 250 or more staff, or turnover above EUR 50 million and a balance sheet total above EUR 43 million). Most other in-scope entities are important. Articles 21 and 23 apply to both; the differences lie in supervision and fines. Essential entities can face proactive supervision, including on-site inspections and random checks, while important entities face ex post supervision.
Being based outside the EU does not settle it. NIS2 applies to entities that provide services in the Union, and certain digital providers without an EU establishment must designate a representative there.
Out of Scope Is Not Out of Reach
Even if NIS2 does not apply to you, it can reach you through your customers. Article 21 requires in-scope entities to consider each direct supplier's vulnerabilities and cybersecurity practices, including secure development procedures. Expect detailed questionnaires, contractual security clauses and evidence requests, which a working ISMS lets you answer from evidence.
Where ISO 27001 and NIS2 Overlap and Differ
NIS2 does not mandate ISO/IEC 27001, but it points in that direction. Article 21 tells entities to take account of relevant European and international standards, and Article 25 asks member states to encourage their use. ENISA's NIS2 Technical Implementation Guidance, published in June 2025, maps each requirement of Implementing Regulation (EU) 2024/2690 to standards including ISO/IEC 27001:2022, ISO/IEC 27002:2022 and the NIST Cybersecurity Framework 2.0.
| Aspect | ISO/IEC 27001:2022 | NIS2 |
|---|---|---|
| Legal nature | Voluntary international standard | EU directive, binding through national law |
| Scope | The ISMS scope you define | Systems used for your operations and services |
| Control basis | Risk assessment, Annex A and the SoA | Minimum measures in Article 21 |
| Leadership | Top management commitment and management review | Management bodies approve, oversee and can be held liable |
| Incident reporting | No statutory deadlines | 24-hour early warning, 72-hour notification, final report within one month |
| Outcome | Certificate from a certification body | Supervision by national authorities |
Article 21(2) requires measures covering at least the following areas, most of which map naturally onto an ISMS.
- Policies on risk analysis and information system security.
- Incident handling.
- Business continuity, including backup management, disaster recovery and crisis management.
- Supply chain security.
- Security in acquisition, development and maintenance, including vulnerability handling and disclosure.
- Policies and procedures to assess the effectiveness of these measures.
- Basic cyber hygiene practices and cybersecurity training.
- Cryptography and, where appropriate, encryption.
- Human resources security, access control policies and asset management.
- Multi-factor or continuous authentication and secured communications, where appropriate.
For cloud, data centre, managed service, managed security service and other digital infrastructure providers, Implementing Regulation (EU) 2024/2690 adds detailed requirements and defines significant incidents, for example direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower.
A Practical Readiness Roadmap
For most growing companies, the efficient path is one ISMS built to ISO/IEC 27001, with NIS2 requirements layered in from day one.
1. Confirm Applicability and Define Scope
Write down your NIS2 position: sectors, group-level size, member states, classification and any registration duty. Then set the ISMS scope, and if NIS2 applies, do not exclude systems your regulated services depend on. You cannot scope what you have not found, so pair this with continuous attack surface discovery to surface forgotten cloud accounts, domains and exposed services.
2. Run a Risk Assessment You Can Defend
Agree a methodology, acceptance criteria and risk owners, then assess risks to information in scope. NIS2 expects an all-hazards approach, so include power, facilities and supplier failure alongside cyber threats. The output is a risk treatment plan with owners and dates.
3. Build the Statement of Applicability
Derive controls from risk treatment, compare them with Annex A and record each decision in the SoA. Add a column cross-referencing the Article 21 measures so one document serves auditors, customers and regulators. ENISA's mapping table is a useful starting point.
4. Implement the Highest-Risk Controls First
Common gaps include patchy multi-factor authentication, unreviewed privileged access, untested backups, thin supplier oversight and inconsistent patching. A zero trust security architecture gives you a coherent model for identity, segmentation and access policy. If you build software, a secure software development lifecycle addresses the development and vulnerability handling measures directly.
5. Prepare for the Reporting Clock
An incident process that satisfies ISO/IEC 27001 can still fail NIS2 if it cannot meet the deadlines. Name who decides whether an incident is significant, who sends the early warning within 24 hours of becoming aware, who prepares the 72-hour notification, and who owns the final report within one month. Our guide to building an incident response plan covers the roles and playbooks behind this.
6. Collect Evidence and Test Effectiveness
Auditors and supervisors both want evidence: approved policies, the risk register, the SoA, training records, access reviews and incident logs. Article 21 also requires procedures to assess whether measures are effective, which is where independent testing earns its place; see how to prepare for a penetration test. Once you run more than one framework, automated evidence collection pays off, as our post on SOC 2 compliance automation explains.
An independent gap assessment before certification shows where you stand. Our cybersecurity audit and penetration testing service includes a compliance gap analysis mapped to your target framework, with control-by-control status and a remediation path for every gap, plus targeted penetration testing where it is warranted. It prepares you for certification; it does not replace the certification body's audit.
7. Close the Loop with Internal Audit and Management Review
ISO/IEC 27001 requires internal audits (clause 9.2) and management reviews (clause 9.3), and your certification body will expect to see both working. Use management review as the point where the management body formally approves the NIS2 measures, and schedule the training Article 20 requires. Then book the Stage 1 and Stage 2 audits.
Where SOC 2 Fits for US Customers
US customers often ask for SOC 2 alongside or instead of ISO/IEC 27001. A SOC 2 report is an examination by a CPA firm under AICPA standards, covering a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy. It is an attestation report, not a certificate.
The work overlaps heavily, so build one control set and evidence trail mapped to ISO/IEC 27001, SOC 2 and NIS2. Which to pursue first is a commercial decision: ask your largest customers what they accept. Neither a SOC 2 report nor an ISO certificate makes you NIS2 compliant.
Common Pitfalls to Avoid
- Treating the certificate as the goal. A thin ISMS turns every surveillance audit into a scramble.
- Scoping too narrowly. It leaves NIS2-relevant systems outside your governance.
- Leaving leadership out. Under NIS2, management bodies approve measures and can be held liable. A briefing is not a decision.
- Ignoring the reporting clock. The 24-hour, 72-hour and one-month deadlines need named owners and templates.
- Assuming one rulebook. Registration, supervision and penalties are set nationally, and the Directive may be amended.
Conclusion
ISO/IEC 27001 asks whether you run a disciplined, risk-based security management system. NIS2 asks whether an entity that matters to the EU economy manages cyber risk to a legal minimum and reports when things go wrong. For growing companies, the practical answer is the same: one ISMS, scoped honestly, with NIS2 measures, reporting and management accountability built in from the start.
Start with the applicability assessment, then build the risk assessment, SoA and evidence trail once and reuse them for every certificate, report and regulator that asks.
Found this useful?
