Does an ISO 27001 certificate mean we meet NIS2?

Not automatically, although it covers much of the ground. ISO/IEC 27001 gives you a risk-based management system and controls that overlap strongly with the cybersecurity risk-management measures NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. requires, such as incident handling, business continuity, supply-chain security, access control and cryptography. But NIS2 is law and the certificate is a voluntary standard, and they differ in places. NIS2 has its own staged incident reporting under Article 23 to a national authority, specific duties for management bodies including training and accountability, registration with the authority, and national rules that can go further. A certificate also covers only its stated scope, which may leave out the very services NIS2 applies to. Use your ISMS as the backbone: map each NIS2 measure to your controls, close the gaps such as the reporting procedure and management training, and make sure the scope includes every in-scope service. Check your national NIS2 law and whether it refers to standards. NetSenX tracks NIS2 reporting deadlines per incident; it does not assess your certificate or your NIS2 status.

← All 15 questions on Security standards: ISO 27001, SOC 2All topics