NIS2 vs ISO 27001
NIS2 vs ISO 27001: a law versus a certifiable standard. One may be mandatory for your company, the other is a way to show and structure good security.
NIS2 vs ISO 27001 is a comparison of a law and a standard. NIS2 is an EU directive that requires organisations in covered sectors to manage cyber risk, report incidents and answer to national authorities. ISO/IEC 27001 is an international standard for an information security management system, which organisations adopt voluntarily and can have certified.
They are not alternatives. If NIS2 applies to you, compliance is a legal duty, and ISO 27001 is a well-known way to build the management system behind it. Holding an ISO 27001 certificate does not by itself prove NIS2 compliance.
Side by side
| Capability | NIS2 | ISO 27001 |
|---|---|---|
| What it is | EU directive (2022/2555), turned into national law | International standard for an information security management system |
| Mandatory | Yes, if you are an in-scope entity | No, voluntary unless a client or contract requires it |
| Who it applies to | Organisations in listed sectors above a size threshold, plus some smaller ones | Any organisation, any size or sector |
| Enforced by | National authorities | Independent certification bodies |
| Certificate | None, you are compliant or not | Yes, issued after an audit, valid for three years with yearly checks |
| Incident reporting | Required, with strict early-warning deadlines | Requires an incident process, but sets no authority deadlines |
| Management accountability | Explicit, leaders can be held responsible | Top management must support and review the system |
| Penalties | Fines up to 10 million euros or 2% of turnover for essential entities, up to 7 million or 1.4% for important entities | None, the risk is losing the certificate |
| Current version | In force, national laws vary | ISO/IEC 27001:2022, transition from the 2013 edition ended in October 2025 |
What each one is good at
NIS2
- Sets a common legal baseline across the EU
- Pushes security up to management level
- Clear incident reporting duties
- Supply chain security is part of the rules
- Details depend on each country's national law
- No certificate to show customers
- Penalties are significant if you miss it
ISO 27001
- Gives a proven structure for managing security
- Independent certificate that clients recognise
- Works for any organisation and sector
- Covers much of what NIS2 expects in risk management
- Takes time and effort to build and audit
- Certificate depends on defined scope
- Does not cover every NIS2 duty, such as authority reporting
Focus on NIS2 when
- Your sector and size put you in scope under your country's law
- You supply a company that is covered and must pass on requirements
- You need to set up incident reporting to authorities
- Management needs to understand its personal duties
- You want to know what you legally must do first
Focus on ISO 27001 when
- Clients or tenders ask for an ISO 27001 certificate
- You need a structured way to run security day to day
- You want proof of security that goes beyond a self-declaration
- You are preparing for NIS2 and want a framework to build on
- You want one system that also supports GDPR work
Questions people ask
Does ISO 27001 make me NIS2 compliant?
Is NIS2 vs ISO 27001 an either-or choice?
Is ISO 27001 mandatory under NIS2?
Which ISO 27001 version should I use?
Not sure how this applies to you?
A senior engineer walks your site, your search presence and the way enquiries reach you, then writes down the three things worth fixing first. You keep the document either way.