NIS2 & ISO 27001: a shared basis

Both NICHE 2 if ISO 27001 have a clear goal: to protect organizations against cyber threats, data leaks and disruptions. Both take a risk-driven approach and emphasize the importance of continuous improvement. Think about:

• Risk analyses
• Incident Management
• Access control
• Information Security Policy
• Continuity Plan

However, there are also significant differences — and these are the ones that determine that your ISO 27001 certification is not yet sufficient to NIS2 compliance to reach.

Key differences between NIS2 and ISO 27001

Obligation versus voluntary standard

‍

• NICHE 2 is European legislation. Certain organizations are legally required to take measures.
• ISO 27001 is a voluntary standard for information security. Certification shows that you are serious about security, but in itself is not a legal requirement.

‍

Administrative responsibility

NIS2 not only looks at technology, but also explicitly sets requirements for the board. Directors can liable are negligent. The ISO 27001 standard does not make any firm statements about this.

‍

Suppliers and chain responsibility

One NIS2 organization is not only responsible for its own security, but also that of suppliers. ISO 27001 does mention supplier management, but NIS2 goes one step further: for example, suppliers of NIS2 organizations must go through an information security policy or the NIS2 Supply Chain Certificate can demonstrate that they work securely.

‍

Incident reporting: stricter under NIS2

NIS2 has an obligation to report: you must report it within 24 to 72 hours with CISR in the event of a security incident. ISO 27001 requires the registration and evaluation of incidents, but has no hard deadlines.

‍

Crisis Management and Continuity

NICHE 2 requires clear procedures for backup management, crisis communication and business continuity. While ISO 27001 remains primarily policy-oriented, NIS2 also requires practical implementation and testing.

‍

Zero Trust as standard

NIS2 explicitly names Zero Trust Principles such as microsegmentation, least privilege access, and continuous authentication. In short, Zero Trust is based on the idea: “Never trust, always verify”.

Three important parts of this are:

‍

• Microsegmentation: here you divide your network into small pieces (segments). As a result, even when an attacker comes in, cannot just access everything; he remains “stuck” in a small part of the network.
• Least privilege access: users and systems only get access to what they really need, and nothing more. This way, you can limit damage if something goes wrong.
• Continuous authentication: Instead of logging in once, it is constantly checked that the user is still who they say they are. For example, through behavior, location, or device recognition.

‍

ISO 27001 does provide frameworks, but less detailed and normative.

ISO 27001 as a stepping stone to NIS2 compliance

Do you already have an ISO certificate (ISO 27001)? Then you have a good foundation. But: ISO 27001 is not sufficient to fully comply with NIS2. Additional measures are needed, such as:

• Administrative anchoring of security
• Comprehensive chain analysis
• Setting up incident response and reporting procedures
• Comply with stricter documentation and reporting requirements

Combining NIS2 & ISO 27001? Download the white paper

Do you want to know how to use ISO 27001 smartly as a basis for your NIS2 implementation? Then download our comprehensive white paper: 👉 Download

The white paper includes:

‍

• A practical mapping between NIS2 and ISO 27001:2022
• Examples of measures
• A comprehensive NIS2 checklist

NIS2 compliance without ISO 27001?

Of course, you can also choose to start a NIS2 implementation without the ISO 27001. Through our NICHE 2 GAP analysis (also known as an NIS2 check or NIS2 quick scan), we concretely map out where you are now and what steps you still need to take.

Are you a supplier to a NIS2 organization?

Then it might be an idea to delve into the NIS2 Supply Chain Certificate (also known as NIS2 SC: an NIS2 label for suppliers). This is how you, as a supplier, show that you have cybersecurity in order according to NIS2.

Finally: don't wait too long

The deadline for NIS2 is fast approaching. By starting with an integrated approach now, you can prevent panic football and reduce the risk of fines or damage to your image. Looking for a NIS2 consultant? Let us help you with a clear approach without unnecessary complexity. Contact us for an informal, free consultation.

‍