NIS2 vs ISO 27001: Compliance Mapping Guide
In the ever-evolving landscape of cybersecurity, financial institutions in Europe are required to maintain compliance with various regulatory frameworks. Two of the most prevalent and impactful frameworks are the Network and Information Security (NIS2) Directive and the International Organization for Standardization (ISO) 27001 standard. The NIS2 Directive, which replaces the NIS Directive from 2016, aims to enhance cybersecurity across the EU, focusing on essential and important entities. Meanwhile, ISO 27001 provides a comprehensive framework for establishing, implementing, and maintaining an Information Security Management System (ISMS). This article will explore these two frameworks, mapping the key requirements of NIS2 to ISO 27001 controls, and identify the additional measures needed for full NIS2 compliance.
Key Requirements or Concepts
NIS2 Requirements
The NIS2 Directive, Directive (EU) 2022/2555, had to be transposed by the member states by 17 October 2024. It introduces more stringent cybersecurity requirements for essential and important entities. The directive is aimed at achieving a harmonized approach to cybersecurity across the EU, with specific requirements focusing on risk management, incident reporting, and cooperation among member states.
Some of the key requirements of NIS2 include:
Risk Management: NIS2 requires organizations to identify, assess, and manage risks to their network and information systems (Article 21). The management body must approve and oversee these measures (Article 20).
Incident Reporting: NIS2 requires an early warning on significant incidents within 24 hours of becoming aware of them, an incident notification within 72 hours and a final report within one month (Article 23).
Cooperation and Information Sharing: NIS2 lets entities share cyber threat information in information-sharing arrangements (Article 29).
Security Measures: NIS2 specifies that entities must implement security measures that are proportionate to the risk, with at least the ten measures in Article 21(2).
ISO 27001:2022 Structure
ISO/IEC 27001 has two parts. Clauses 4 to 10 set the rules for the management system: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 controls in four themes:
- A.5 Organisational controls (5.1 to 5.37)
- A.6 People controls (6.1 to 6.8)
- A.7 Physical controls (7.1 to 7.14)
- A.8 Technological controls (8.1 to 8.34)
The 2013 edition used 14 domains with other numbers. Certificates against the 2013 edition expired on 31 October 2025. Use the 2022 numbers below.
Mapping NIS2 Article 21(2) and Article 23 to ISO 27001:2022
| NIS2 requirement | ISO 27001:2022 clauses and Annex A controls | Gap to close for NIS2 |
|---|---|---|
| Art. 21(2)(a) Risk analysis and information system security policies | Clauses 6.1.2, 6.1.3, 8.2, 8.3; 5.1 Policies for information security | Cover all hazards, including physical events (Art. 21(2) first paragraph). |
| Art. 21(2)(b) Incident handling | 5.24 to 5.28 (incident planning, assessment, response, learning, evidence); 6.8 Information security event reporting; 8.15 Logging; 8.16 Monitoring activities | Add the NIS2 "significant incident" test. |
| Art. 21(2)(c) Business continuity, backup, disaster recovery, crisis management | 5.29 Information security during disruption; 5.30 ICT readiness for business continuity; 8.13 Information backup; 8.14 Redundancy of information processing facilities | Write a crisis management plan. ISO 27001 does not name it. |
| Art. 21(2)(d) Supply chain security | 5.19 to 5.22 (supplier relationships, agreements, ICT supply chain, monitoring); 5.23 Information security for use of cloud services | Include the results of EU coordinated supply chain risk assessments (Art. 22). |
| Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling and disclosure | 8.8 Management of technical vulnerabilities; 8.9 Configuration management; 8.25 to 8.29 (secure development and testing); 8.32 Change management | Add a coordinated vulnerability disclosure process (Art. 12). |
| Art. 21(2)(f) Assess the effectiveness of measures | Clauses 9.1, 9.2, 9.3; 5.35 Independent review of information security; 5.36 Compliance with policies, rules and standards for information security | Mostly covered. |
| Art. 21(2)(g) Basic cyber hygiene and cybersecurity training | Clauses 7.2, 7.3; 6.3 Information security awareness, education and training; 8.7 Protection against malware; 8.8; 8.9 | Train the management body too (Art. 20(2)). |
| Art. 21(2)(h) Cryptography and encryption | 8.24 Use of cryptography | Mostly covered. |
| Art. 21(2)(i) Human resources security, access control, asset management | 6.1 to 6.5 (screening to post-employment duties); 5.15 to 5.18 (access control, identity, authentication information, access rights); 8.2 Privileged access rights; 8.3 Information access restriction; 5.9 to 5.11 (asset inventory, acceptable use, return of assets) | Mostly covered. |
| Art. 21(2)(j) Multi-factor authentication, secured communications, secured emergency communication | 8.5 Secure authentication; 5.14 Information transfer; 8.20 to 8.22 (network security) | Plan secured emergency communication. ISO 27001 does not name it. |
| Art. 23 Reporting to the CSIRT or authority | 5.24 to 5.26; 6.8; 5.5 Contact with authorities | Add the 24-hour early warning, 72-hour notification and one-month final report. |
Two more controls help with NIS2. 5.7 Threat intelligence supports information sharing under Art. 29. 5.31 Legal, statutory, regulatory and contractual requirements is where you record the national NIS2 law that applies to you.
Implementation Guide or Practical Steps
If you already hold an ISO 27001 certificate, map your existing controls to NIS2. Use these steps:
Check your Statement of Applicability against the table: Confirm that each control in the table is in scope and implemented. Pay attention to 5.23, 5.30 and 8.24. Teams often scope them out.
Add NIS2 incident reporting to your incident process: Controls 5.24 to 5.26 give you a process. They do not give you the NIS2 deadlines. Add the 24-hour, 72-hour and one-month steps, a significance test and a named contact for the authority.
Close the named gaps: Write a crisis management plan, a coordinated vulnerability disclosure process and a plan for secured emergency communication. Add management body training to your training plan.
Set proportionality in your risk assessment: NIS2 requires measures that are proportionate to the risk, the size of the entity and the impact of incidents (Art. 21(1)). Record this reasoning in your risk treatment plan (clause 6.1.3).
Audit both frameworks together: Add the NIS2 items to your internal audit programme (clause 9.2) and your management review (clause 9.3).
Common Mistakes or Pitfalls to Avoid
Assumption of Full Alignment: Assuming that ISO 27001 certification automatically satisfies NIS2 requirements can lead to non-compliance. NIS2 introduces specific obligations that may not be fully covered by ISO 27001 controls.
Neglecting Proportionality: Failing to adjust security measures according to the risk level can lead to non-compliance with NIS2. It's crucial to perform a detailed risk assessment to ensure the appropriate level of security.
Ignoring Incident Reporting Requirements: Overlooking the specific reporting requirements of NIS2 can result in significant penalties. Ensure that your incident management process complies with the directive's timelines and content requirements.
Lack of Cooperation and Communication: Underestimating the importance of cooperation and information sharing with national authorities can lead to non-compliance. Establish clear communication channels and protocols to facilitate this process.
How Matproof Helps
Matproof's compliance management platform simplifies the process of aligning your organization with both NIS2 and ISO 27001 requirements. Our platform provides a comprehensive mapping of regulatory requirements to ISO controls, ensuring that your compliance efforts are efficient and effective. With Matproof, you can track your compliance progress, automate incident reporting, and ensure that your security measures are proportionate to the risk, helping you maintain compliance with both frameworks.