NIS2 and ISO 27001: Why Executives Across Europe Need to Pay Attention
The most successful organisations aren't treating NIS2 and ISO 27001 as separate initiatives. They're using ISO 27001 as an operational foundation upon which NIS2 compliance can be built.
Compliance has traditionally been viewed as a box-ticking exercise. Meet the obligation. Pass the audit. Move on.
However, with NIS2 reshaping cybersecurity requirements across the European Union, that approach no longer works. NIS2 has made compliance a necessity, but resilience is the new standard for organisations across Europe.
Increasingly sophisticated cyber threats, heightened regulatory scrutiny, and greater accountability for executive teams have raised the stakes.
Dan Shaw, UK Account Executive at Resolver, sees that shift playing out in conversations with risk and compliance teams. ‘One question I frequently hear from executives is: “If we’re already ISO 27001 certified, are we covered for NIS2?”’ The answer is simple, Shaw says: ‘No. But you’re likely not far away.’
The most successful organisations aren’t treating NIS2 and ISO 27001 as entirely separate initiatives. They’re using ISO 27001 as an operational foundation upon which NIS2 compliance can be built.
Mature companies have stopped asking, ‘Are we compliant?’ Instead, they ask. ‘Can we absorb, respond to, and recover from disruption?’ Shaw notes.
This represents a fundamental shift in mindset.
Organisations that view NIS2 purely as a compliance project will likely struggle. But those that use NIS2 as an opportunity to strengthen governance, operational resilience, and enterprise risk management can create lasting competitive advantage.
Here’s a deep dive into what NIS2 requires, why it’s critical for companies in the EU, and how organisations can build on their existing ISO 27001 programme to address NIS2 requirements.
Discover Resolver's solutions.
What is NIS2? (and the cost of getting it wrong)
The Network and Information Security Directive 2 (NIS2) is an EU cybersecurity law, not just another compliance framework. Replacing the original NIS Directive, it establishes a common baseline for cybersecurity across EU member states.
NIS2 is mandatory for certain medium-sized and large organisations in designated sectors, including energy, healthcare, transport and digital infrastructure. It also applies to other entities classified as ‘essential’ or ‘important’. Scope depends on the organisation’s size, the type of entity or service provided and national implementation rules.
It also introduces some of the most significant cybersecurity penalties seen in the region since GDPR. According to the NIS2 Directive by the EU, essential entities can face fines of up to €10 million or 2% of global annual turnover, whichever is higher, and important entities can be fined up to €7 million or 1.4% of global annual turnover.
NIS2 puts greater accountability on senior management
Beyond financial penalties, NIS2 gives national authorities a broader set of supervisory and enforcement powers. Most notably, it places greater accountability on senior management. Management bodies must approve cybersecurity risk-management measures and oversee their implementation, and can be held liable for infringements of those obligations, subject to applicable national law.
Authorities also have significant supervisory and enforcement powers. These include on-site inspections and security audits, as well as the ability to issue binding instructions requiring organisations to address deficiencies or infringements. Authorities can also order organisations to make aspects of an infringement public.
While enforcement is still maturing, regulators have already begun issuing fines, remediation orders, audits, and supervisory actions across several EU member states such as France, Ireland, Spain, and the Netherlands.
The message is clear: companies can no longer afford to treat cybersecurity as solely an IT responsibility. It’s a board-level risk that requires ongoing visibility, accountability and demonstrable resilience.
What’s the difference between NIS2 and ISO 27001?
ISO 27001 is the global standard for information security management systems (ISMS). Its risk-based framework can support organisations in addressing requirements under regulations such as GDPR, NIS2, and DORA. Its risk-based framework helps organisations establish, implement, maintain and continually improve an information security management system.
In contrast, NIS2 is a legally binding EU regulatory directive designed to improve cybersecurity resilience across critical and essential sectors for organisations within its scope.
The objectives are similar, but the drivers are different, says Shaw. ‘While ISO 27001 asks if you have a formalised security management framework in place, NIS2 asks you to demonstrate operational resilience and appropriately manage cyber risk in a way that protects society and critical services,’ he clarifies.
How to go beyond ISO 27001 to meet NIS2 requirements
Organisations often make the mistake of assuming certification automatically equals compliance. In reality, ISO 27001 certification does not guarantee compliance with NIS2.
While ISO 27001 provides a strong foundation for information security management, NIS2 introduces additional obligations that go beyond security controls. Your organisation must demonstrate resilience, including robust incident reporting, supply chain risk management, business continuity and operational resilience capabilities, and stronger governance and accountability measures.
‘Ultimately, regulators are focused not only on whether policies and controls are in place, but on whether the organisation can prevent, withstand, respond to and recover from disruptive cyber incidents while maintaining critical operations,’ Shaw says.
Where NIS2 and ISO 27001 align
If you’ve already got mature ISO 27001 programmes, you’re closer to achieving NIS2 compliance than you think because you’ve already covered much of the necessary groundwork. Here’s a breakdown:
Governance and accountability
One of the most significant developments in the industry has been the increased accountability placed on senior leadership. For example, the UK Corporate Governance Code’s Provision 29 requires boards of companies reporting under the UK Corporate Governance Code to make a formal annual declaration on the effectiveness of material internal controls, not just whether they are present.
Similarly, NIS2 recognises that cybersecurity isn’t simply an IT issue, but a governance issue for which executive teams are responsible.
In this regard, both ISO 27001 and NIS2 require executive oversight and defined ownership, along with formal policies and continuous cybersecurity monitoring.
Risk management
Both NIS2 and ISO 27001 place risk assessment at the centre of decision-making. Gone are the days when annual risk assessments would suffice, says Shaw. Now, risk must be treated as a living process that evolves alongside the threat landscape.
As an organisation, you’re expected to identify threats and vulnerabilities, assess potential impacts, determine appropriate controls and continuously monitor risk exposure.
Incident management
Compared to ISO 27001, NIS2 warrants organisations to have stricter incident reporting and response capabilities as well. This is essentially because successful incident management programmes rely on well-defined workflows, accountability structures, and executive visibility.
Organisations must be able to detect incidents quickly and escalate issues appropriately, manage response activities more efficiently, and demonstrate lessons learned from past experience.
Supplier and third-party risk
NIS2 places a strong emphasis on supply-chain resilience. Many organisations understand their internal risks reasonably well. Yet far fewer understand the risks introduced by suppliers, vendors, and technology partners.
For Shaw, three questions can help expose those gaps:
- Which critical services depend on third parties?
- What happens if a supplier suffers a cyber incident?
- How do we continuously assess supplier risk?
‘If you cannot answer these questions, your resilience strategy likely contains significant blind spots that you need to address,’ Shaw clarifies.
Taken together, these areas show where ISO 27001 can provide a strong foundation for NIS2 compliance, but also where organisations may need to strengthen existing practices. The goal isn’t to start again, but to understand the gaps and address them.
The way forward
NIS2 compliance requires more than policies and periodic audits. You’ll need a structured approach to identify, manage and report cyber risk across the enterprise.
Start by mapping your existing controls and management practices against NIS2 to understand what carries across, where NIS2 goes further and which gaps you still need to close. From there, GRC software can make that process easier to manage by connecting regulatory requirements to the risks, controls, suppliers and continuity processes they affect. Your team can see what your existing programme covers, what needs more work, and where to focus next.
NIS2 and ISO 27001 FAQs
Is NIS2 mandatory?
Yes. NIS2 is mandatory for certain medium-sized and large organisations operating in designated sectors within the EU. These sectors include areas such as energy, healthcare, transport, digital infrastructure, and other entities classified as “essential” or “important” under the directive. However, scope depends on factors such as the organisation’s size, the type of entity or service provided, and national implementation rules.
Is ISO 27001 still relevant?
Yes! ISO 27001 remains the global standard for information security management systems (ISMS). The framework can support work relevant to global privacy and security mandates like GDPR, NIS2, and DORA.
How is ISO 27001 different from NIS2?
ISO 27001 sets requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), while NIS2 establishes mandatory cybersecurity and risk management requirements for organisations that fall within its scope. ISO 27001 can provide a strong foundation for meeting many NIS2 requirements, but certification alone does not demonstrate or guarantee NIS2 compliance.
