This guide shows where the two meet, what NIS2 adds and how to extend an ISMS in six steps. It follows German law, that is the BSI Act (BSIG), which implements the NIS2 Directive.
The two frameworks compared
| Question | ISO/IEC 27001:2022 | NIS2 (BSIG) |
|---|---|---|
| Type | International standard | Law |
| For whom | Voluntary, often through customer requirements | Essential and important entities |
| Scope | You define it yourself | The entire relevant operation of the entity |
| Core | Management system with risk assessment and Annex A | Ten minimum measures plus reporting, registration and management duties |
| Certificate | From an accredited certification body | Not provided for by NIS2 |
| Evidence | Audit by the certification body | Your own documentation, presented on request |
Where the two meet
- Risk-based approach. The standard requires risk assessment and risk treatment (clauses 6.1.2 and 6.1.3). Section 30(2) BSIG names risk analysis concepts first.
- Documented decisions. The standard calls for documented information, Section 30(1) BSIG for documentation of the measures. One set of records can serve both.
- Checking effectiveness. Measurement, internal audit and management review (clause 9) fit the procedures for assessing effectiveness under Section 30(2) no. 6 BSIG.
- Technical and organisational measures. Incidents, backup, suppliers, cryptography and access appear in both, in Annex A as reference controls.
- Reference to standards. Under Section 30(2) BSIG the measures should take relevant European and international standards into account. The BSI does not prescribe a particular standard.
The ten minimum measures and their counterparts
The table maps the ten measures of Section 30(2) BSIG to the standard. The examples are a selection from the BSI's simplified overview. A mapping shows where to start; it does not prove that a requirement is met.
| No. | Topic in the BSIG | ISO/IEC 27001:2022 (examples) |
|---|---|---|
| 1 | Risk analysis and security concepts | 6.1.2, 6.1.3, A.5.1 |
| 2 | Handling security incidents | A.5.24 to A.5.28, A.6.8 |
| 3 | Operations, backup and crisis management | A.5.29, A.5.30, A.8.13, A.8.14 |
| 4 | Supply chain security | A.5.19 to A.5.22 |
| 5 | Acquisition, development, maintenance, vulnerabilities | A.8.8, A.8.25, A.8.29, A.8.32 |
| 6 | Assessing effectiveness | 6.2, 9.1, 9.3 |
| 7 | Training and awareness | 7.2, 7.3, A.6.3 |
| 8 | Cryptography | A.8.24 |
| 9 | Personnel, access and assets | A.5.9, A.5.15 to A.5.18, A.6.1 |
| 10 | MFA and secured communication | A.8.5, A.8.21 |
What NIS2 adds
The BSI names three legal duties that the standard does not contain. It sees two further differences in the scope and in risk acceptance.
- Reporting duty (Section 32 BSIG). You report significant security incidents in stages: early warning within 24 hours, notification within 72 hours, final report at the latest one month after that notification.
- Registration (Section 33 BSIG). Entities in scope register with the BSI and keep their details up to date.
- Management (Section 38 BSIG). Management implements the measures, oversees their implementation and takes part in training regularly.
- Scope. In an ISMS you define it yourself, for example as one site. The BSIG looks at the entire relevant operation, which in industry usually includes production.
- Risk acceptance. The standard allows acceptance and transfer as treatment. In the BSI's view the BSIG rules out blanket acceptance or blanket transfer.
The BSI also names a wider view of the supply chain and documented processes for communicating with authorities as typical additions.
Some entities face more. Operators of critical facilities prove implementation regularly on their own initiative (Section 39 BSIG). For providers such as cloud computing services and managed service providers, Implementing Regulation (EU) 2024/2690 takes precedence (Section 30(3) BSIG).
Six steps from ISMS to NIS2
- Clarify whether you are in scope. Check whether and how your company is classified, and record the result with the key figures.
- Compare the scope. Compare the scope of the ISMS with the relevant operation. Extend it where needed, or cover the gap outside the certificate.
- Run a gap analysis against Section 30 BSIG. Go through the ten measures, using your Statement of Applicability as the starting point. Check excluded Annex A controls as well.
- Review risk decisions. Look at accepted and transferred risks: does Section 30 BSIG call for implementation here?
- Add what is missing. This usually means the reporting process, registration, management training, the supply chain and communication with authorities.
- Document it traceably. Record decisions for and against measures in an auditable form and assign responsibility in management clearly.
Still planning your certification? Then settle these points at the very start. That way the ISMS is built as a foundation for NIS2 from day one.
Example from an industrial company
This example is invented. A machine builder is certified to ISO/IEC 27001, with a scope covering development and office IT. The assessment shows that it counts as an important entity. The gap analysis brings up three points:
- Production outside the scope. The control network and remote maintenance were only an interface so far. The company brings both into the risk analysis and the measures.
- Accepted risk. A remote maintenance access without MFA had been accepted as a risk. In view of Section 30(2) no. 10 BSIG it becomes a measure with a due date.
- Incident process without reporting channels. The process worked well internally but knew no authority. The company adds the check for significance, the reporting stages and a deputy.
The certificate remains valuable. Most of the work lies in extending what exists, not in starting over.
Checklist
- Whether you are in scope of the BSIG has been checked and documented.
- Registration with the BSI is done, or the reason it is not needed is recorded.
- The scope of the ISMS has been compared with the relevant operation.
- The ten measures of Section 30(2) BSIG have been assessed one by one.
- Accepted and transferred risks have been reviewed.
- The reporting process with stages, deadlines and deputies is in place and has been practised.
- Management oversees implementation and has been trained.
- Requirements for suppliers and service providers are settled.
- Decisions are documented traceably.
ISO 27001 and NIS2 in Complass
Two frameworks in two spreadsheets mean the same state maintained twice. In Complass you run both as projects and reuse what you have implemented.
- Guided projects. Both frameworks come with phases, steps and catalogues. The NIS2 catalogue is organised by the ten minimum measures.
- Implement once, use several times. "Also required in" shows where the same measure is required elsewhere. With "Link" you take over status, evidence text and files on an ongoing basis from the other project.
- Framework overview. Each row is a cross-framework measure, each column a project. You see the state and the gaps per framework, also as Excel.
- Incidents with reporting stages. Questions lead to the decision on the reporting duty, and deadlines run as a countdown. You submit the report itself in the authority's portal.
- Cockpit for management. Resolve on the measures, oversee implementation every quarter, prove training. Each member confirms personally.
The mapping between frameworks is professional orientation and does not replace an assessment of the individual case. Certification is carried out by an accredited certification body; Complass prepares you for it.
Frequently asked questions
Is an ISO 27001 certificate enough for NIS2?
No. In the BSI's view it does not prove conformity with Section 30 BSIG, but it is a good basis. You compare scope and measures and add what is missing.
Do we have to get ISO 27001 certified for NIS2?
No. NIS2 does not provide for certification, and the BSI does not prescribe a particular standard. What counts is that the legal duties are met.
Is there a NIS2 certificate?
According to the BSI there is no general certificate for it. That also applies when a customer asks: you show the measures you have implemented and, if you have one, your ISO 27001 certificate with its scope.
How do we prove implementation?
You document the measures and present them when the BSI orders it. As evidence the BSI names internal documentation, certifications, training records and audit reports. Operators of critical facilities provide proof on their own initiative.
How much of NIS2 does ISO 27001 cover?
We know of no official percentage. The answer depends on your scope and your Statement of Applicability. Only a check measure by measure is reliable.
In a demo we show you how ISO 27001 and NIS2 come together in Complass.
Request a demo Try it for 14 days
Read more
- Whitepaper "ISO 27001: the road to certification – for companies in every sector"
- Whitepaper "NIS2 for companies in every sector: directly in scope or via your customers"
- ISO/IEC 27001 in Complass: from project mandate to certification audit
- NIS2 and the BSIG in Complass: applicability, duties and implementation
- Incident management: record incidents and check the reporting duty
- Free applicability check
Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case. The wording of the law and of your licensed copy of the standard is authoritative.