Does ISO 27001 satisfy NIS2 on its own?
NIS2 does not require ISO 27001 certification, and holding ISO/IEC 27001:2022 certification does not by itself prove NIS2 compliance. A customer or regulator asking for NIS2 evidence is asking whether your security program meets the obligations in the Directive as your national law transposes them, not whether your certificate is current. The certificate is useful evidence for some of those obligations, but it was issued against a voluntary standard, and the auditor who issued it tested your management system against that standard, not against the Article 21 measures or the Implementing Regulation (EU) 2024/2690 requirements. Whether the certificate carries weight depends on three things: which Member State's law applies to you, how your scope compares with the NIS2 scope, and which gaps remain after you map your controls to the NIS2 requirements.
Start by pulling the national transposition law for your Member State and confirming which authority supervises you. Some national frameworks may accept assessment or certification by accredited conformity assessment bodies against frameworks equivalent to the implementing regulation, while others will expect evidence in their own format. ENISA's June 2025 technical implementation guidance maps each Implementing Regulation requirement to ISO/IEC 27001:2022 and ISO/IEC 27002:2022, but ENISA states that its mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation. Treat the mapping as a starting worksheet, not as proof. Ask your certification body and your supervisor, in writing, which parts of the certificate they will accept.
Then run a gap review that focuses on the requirements NIS2 adds as law and the Implementing Regulation makes specific. Examples to check include the annual management review of the security policy and risk assessments, the quarterly assessment of recurring incidents, the quantified significant incident thresholds, the staged reporting under Article 23, management body training under Article 20, and registration with authorities. Your ISO 27001 scope statement may not cover all of these, so confirm what the Statement of Applicability and internal audit records actually show. Where gaps remain, the reader should plan the remediation work and the evidence it will produce before the next supervisory request arrives.
Where the two overlap and where they diverge
Both frameworks start from a documented, repeatable risk assessment and a treatment plan that is reviewed over time. An ISO/IEC 27001:2022 risk process covers the clause 6 planning requirements and the risk assessment and treatment steps an organization defines for itself. NIS2 Article 21 asks for measures proportionate to the risks to network and information systems, using an all-hazards approach, and Implementing Regulation 2024/2690 sets more specific expectations for how that risk management is run and reviewed.
- Review cadence: The Implementing Regulation expects at least annual management review of the security policy and of the risk assessments. An ISO 27001 program sets its own review interval, so the cadence must be written down and tested against this requirement.
- Management sign-off: Under NIS2 the management body approves and oversees the Article 21 measures, which makes the review a leadership activity, not only a working-level task.
- Recurring incidents: The Implementing Regulation expects quarterly assessment of recurring incidents, a rhythm that a standard risk process does not set by default.
- Scope of hazards: NIS2 frames risk as all-hazards, so physical, supply and human-error risks need to be visible in the register.
- Evidence: Keep dated risk assessments, approvals and review minutes that an authority can sample.
Before relying on one framework for the other, check with your auditor and your national authority how they expect the review cadence and the recurring-incident analysis to be evidenced.
ISO/IEC 27001:2022 requires a documented information security policy, defined roles and management commitment, and an internal audit and management review cycle. Those requirements overlap heavily with NIS2 governance duties. The divergence lies in who is personally accountable under law and in the specific content the Implementing Regulation expects the policy set to contain.
- Management body liability: NIS2 Article 20 makes management body members responsible for approving and overseeing the measures, and it makes them liable for infringements. An ISO 27001 certificate does not transfer that liability.
- Mandatory training: Management body training is a NIS2 legal obligation. ISO 27001 expects competence and awareness but does not prescribe training for board members.
- Policy coverage: The Implementing Regulation specifies policy areas and content in more detail than the ISO controls, so a policy set mapped to Annex A may still have gaps.
- Management review: The annual review of the security policy in the Implementing Regulation is a fixed point that the ISO management review may or may not meet, depending on how it is scheduled.
- Authority access: Governance records must be presentable to a supervisor, not just to a certification auditor.
Ask the organization which documents it will show a supervisor and confirm each named policy area against ENISA's examples of evidence.
ISO/IEC 27001:2022 requires a process for handling information security incidents, including detection, assessment, response and learning from events. NIS2 builds on that foundation with legally defined reporting timelines and a significance test. The overlap is in the operational process. The divergence is in the clock, the recipients and the thresholds, which the law and the Implementing Regulation set rather than the organization.
- Staged reporting: Article 23 requires an early warning within 24 hours, a notification within 72 hours and a final report within one month of a significant incident. An ISO incident procedure rarely defines these deadlines.
- Significance criteria: The Implementing Regulation sets quantified thresholds for what counts as a significant incident, so the process must classify events against those criteria.
- Recipients: Reports go to the national competent authority or CSIRT, and in some cases service recipients must be informed. Those notification paths need named contacts.
- Exercises: Test the reporting chain through exercises, since a written procedure alone does not show that the deadlines can be met.
- Dual reporting: Where personal data is involved, GDPR breach notification runs in parallel and needs its own record.
Confirm the national reporting portal and the current significance thresholds with your authority before building the procedure around them.
ISO/IEC 27001:2022 expects an organization to manage risks from suppliers and to control information shared with them, and its supplier controls in Annex A cover agreements and monitoring. NIS2 Article 21 lists supply chain security among its minimum measures and asks entities to consider the security practices of direct suppliers and service providers. Both expect supplier risk to be assessed, but NIS2 adds specific obligations for the reporting chain and for the criteria the Implementing Regulation expects in some cases.
- Supplier assessment: Assessments must address the supplier's own security posture and its ability to meet the entity's obligations, not only contract terms.
- Contract clauses: NIS2 expects clauses that support incident notification and cooperation with the entity's reporting deadlines, which may need to be tighter than standard ISO supplier agreements.
- Audit rights: Contracts should preserve the right to audit or receive evidence from the supplier, so the entity can answer supervisors.
- Managed service providers: Where the entity uses managed or cloud services, the Implementing Regulation sets requirements for those providers themselves, which affects how the entity selects them.
- Register: Keep a current list of suppliers and the services they provide, since the entity may need to produce it on request.
Check which supplier criteria apply to your sector and whether each provider falls under the Implementing Regulation.
ISO/IEC 27001:2022 includes controls for ICT readiness for business continuity, backup and redundancy of information processing facilities. NIS2 Article 21 includes business continuity, including backup management and disaster recovery, and crisis management among its minimum measures. Both require tested plans rather than documents on a shelf. The difference is in how the plans link to incident reporting and to the supervisor's view of service continuity.
- Backup and recovery: Both frameworks expect backups and recovery procedures. The Implementing Regulation adds detail on testing and documentation for the services in scope.
- Crisis management: NIS2 expects a defined crisis management approach that connects to the incident reporting chain, so the continuity plan must name who triggers the 24-hour early warning.
- Testing: Plans should be exercised, and results should feed the risk assessment.
- Dependencies: Continuity plans should reflect supplier dependencies, since a failed cloud or managed service may trigger both continuity and reporting duties.
- Recovery targets: Recovery objectives should be set and documented so that they can be shown to a supervisor.
Confirm with your auditor how continuity tests will be evidenced and whether the Implementing Regulation's detail applies to your entity type.
ISO/IEC 27001:2022 covers user access management, privileged access, authentication and access rights reviews. NIS2 Article 21 includes access control policies and asset management, and the Implementing Regulation sets further expectations for how access is governed for in-scope services. The overlap is high in controls and tooling. The divergence is mostly in the depth of expectations for specific service types and in the evidence a supervisor may ask for.
- Policy basis: NIS2 expects access control to follow a documented policy approved at management level, which connects to the governance duties above.
- Privileged accounts: Expect tighter scrutiny of administrative access, including logging and periodic review.
- Multi-factor authentication: Where the Implementing Regulation applies, it sets requirements for strong authentication that must be confirmed against the current text.
- Asset inventory: Access rights only make sense against a current asset inventory, which NIS2 treats as a measure in its own right.
- Evidence: Export access review records, joiner and leaver logs and privileged account lists from the identity system.
Compare your control set against ENISA's examples of evidence for each requirement, and confirm the detailed expectations with your national authority.
What ENISA's June 2025 mapping does and does not say
ENISA's *NIS2 Technical Implementation Guidance*, published on 26 June 2025, is the place to start if you want to see how Implementing Regulation (EU) 2024/2690 lines up with ISO/IEC 27001:2022. The guidance includes an Excel mapping table that links each requirement in the implementing regulation to ISO/IEC 27001:2022 and ISO/IEC 27002:2022, and also to NIST CSF 2.0, ETSI EN 319 401 and CEN/TS 18026:2024. The mapping is useful as a lookup. It tells you which clauses and controls in an ISO-based management system are the likely starting points for each NIS2-specific requirement. It does not tell you that an ISO 27001 certificate proves compliance with the regulation.
ENISA is explicit on this point. The mapping is not a measure of equivalence, and ENISA does not assess whether any standard fully covers the regulation's requirements. In practice, that means a row that points to an ISO control is a pointer, not a finding. Before you rely on it, check each row against the regulation text and the evidence examples in the guidance. Pay particular attention to the requirements that are specific to the implementing regulation, such as the at least annual management review of the security policy and risk assessments, and the quantified significant incident criteria. Ask your certification body or consultant to show you where those points are covered in your own documents, not only where a standard's clause number sits next to them.
ENISA also says entities may build on the standards or frameworks they already use when implementing the requirements. This is the practical benefit of the mapping: an organization with a working ISO 27001 management system can usually reuse its risk assessment, policy set, asset inventory and internal audit programme, and extend them to the NIS2 items the mapping shows as gaps. That can reduce duplication and streamline audits. Confirm the boundary before you count on it, though. Ask which NIS2 items your national authority expects to see as separate, named evidence, and which items your existing ISO scope does not cover at all, such as the 24-hour, 72-hour and one-month reporting cycle or the supplier criteria in the registry.
Which gaps usually remain after an ISO 27001 mapping
An ISO/IEC 27001:2022 certificate covers much of the Article 21 risk management work, but it does not cover the duties that NIS2 imposes as law. The cards below list the areas where entities most often find open items after mapping, with what to check and who confirms each one.
Incident reporting clocks and content
Article 23 sets a 24-hour early warning, a 72-hour notification and a one-month final report, and an ISO 27001 incident procedure rarely builds in those clocks. Check whether the incident process records the time of awareness, names who decides that an incident is significant, and produces each report in the format the national authority expects. Your national competent authority and your incident response lead confirm the reporting channel and content.
Management body approval and training
NIS2 places duties on the management body itself, including approving the cybersecurity risk-management measures, overseeing their implementation and completing training. An ISO 27001 policy signed by a security committee may not show board-level approval or record that directors were trained. Check the minutes, the approval record and the training log, and ask your legal counsel whether personal liability under your national law applies to your board.
Registration and entity list duties
Essential and important entities must register with national authorities, and the registration data must stay current. ISO 27001 scope statements define the information security scope, not the legal entity, sector or contact details that a regulator asks for. Check that someone owns the registration record, that it matches your legal entity structure, and that updates are made when services change. Your national authority and company secretary confirm the details.
Implementing Regulation thresholds and review cadences
Implementing Regulation (EU) 2024/2690 sets specific cadences that a general ISO 27001 review cycle may not match. It requires at least annual management review of the security policy and risk assessments, quarterly assessment of recurring incidents, and quantified thresholds for significant incidents. Check each of these against your calendar and your incident data, and record the figures you chose. Your risk owner and the internal audit function confirm that the thresholds are applied.
Supplier criteria and registries
The implementing regulation sets criteria for supplier assessment and expects entities to keep track of their suppliers and service providers. ISO 27001 supplier controls usually cover assessment and contracts, but they seldom require the specific supplier criteria or a registry of the kind the regulation describes. Check your supplier register against those criteria, then confirm contract clauses on incident notification and audit rights with your procurement and legal teams.
National law layer
NIS2 is a directive, so the obligations that bind you come from your national transposition law, which may add rules or deadlines beyond the Directive. ISO 27001 says nothing about your national authority's expectations for supervision, inspection or fines. Check your national transposition law, the authority's guidance and any sector-specific rules that apply, and confirm with the authority or your counsel which version of the rules governs your entity.
Which path fits: NIS2 only, ISO 27001 first, or both
This table compares three routes: building NIS2 evidence directly from the Article 21 measures, extending an existing ISO 27001 system with a NIS2 layer, or pursuing ISO 27001 certification alongside NIS2 work. Read each row against your own situation, then confirm the open points with your national authority and any certification body before committing budget.
| Decision factor | NIS2 only (direct build) | ISO 27001 first with NIS2 gap layer |
|---|---|---|
| When it fits | No ISO 27001 system exists and customers do not ask for certification | An ISO 27001 system already runs or is planned, and NIS2 adds law-specific duties |
| Starting point | Article 21 measures and Implementing Regulation 2024/2690 requirements mapped directly to controls | Existing Annex A controls, mapped to Article 21 and the implementing regulation using ENISA's mapping |
| Certificate role | No certificate exists under NIS2, so evidence is assembled for supervisors | ISO 27001 certificate from an accredited body is one input, but does not replace NIS2 evidence |
| Law-specific work | Registration, 24-hour, 72-hour and one-month reporting, and management body training are built from scratch | Same NIS2-only duties still need separate build, since ISO 27001 does not cover them |
| Customer demands | Works if customers accept self-declared or assessed evidence rather than a certificate | Helpful where customers require a recognized certificate in contracts or tenders |
| Scope size | Often suits smaller entities with a narrow system boundary | Often suits larger groups with many systems, where one management system reduces duplication |
| Authority expectations | Confirm which evidence the national authority accepts and whether it expects an assessment | Confirm whether the authority accepts ISO 27001 scope and audit results as partial evidence |
| Open points to confirm | Required evidence format, inspection process and national additions to the Article 21 measures | Scope alignment with NIS2 entity boundaries, mapping gaps and whether the auditor will test NIS2-specific items |
Who owns controls, who prepares evidence and who assesses
The organization remains accountable for every NIS2 obligation, whether or not it hires outside help. Under the governance duties in Article 20, the management body approves the Article 21 risk-management measures and oversees how they are carried out. Day-to-day control ownership sits with named internal staff, who decide how each control works and answer to supervisors for it.
- Approval and oversight: The management body approves the security policy, the risk treatment decisions and the budget for the measures, and it keeps the record of those approvals.
- Management review: Internal owners hold the at-least-annual management review of the security policy and risk assessments that Implementing Regulation 2024/2690 requires, and they decide what changes follow.
- Incident decisions: The organization decides whether an incident is significant and signs off each Article 23 report, including the 24-hour early warning, the 72-hour notification and the one-month final report.
- Control operation: Staff run access reviews, patching, backups and monitoring, and they can explain each control to an authority without relying on a consultant's answer.
- Training and accountability: Management body members complete the cybersecurity training that Article 20 requires, and the organization keeps proof of attendance.
Before signing off any partner deliverable, confirm that a named internal owner has read it, accepted the residual risk and can demonstrate the control on request.
An implementation partner such as DeployOpen works on the systems and documentation that the organization's controls run on. Within a written scope, the partner plans, configures, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. It also prepares the mapping workpapers and evidence packs that show how those systems meet NIS2 and ISO/IEC 27001:2022 expectations. The partner does not decide whether a control is adequate or whether the organization is compliant.
- System preparation: The partner deploys and hardens the tools that produce logs, access records, backup results and vulnerability data, and it documents their configuration.
- Mapping workpapers: The partner builds a control-by-control workpaper that links each requirement in ENISA's mapping table to a system, a procedure and an evidence source.
- Evidence and documentation: The partner prepares the policy drafts, runbooks and evidence examples that the organization reviews and adopts as its own.
- Gap and remediation support: Where the agreed scope includes it, the partner identifies technical gaps and implements the agreed fixes.
- Written boundaries: Deliverables, timelines and exclusions are fixed in writing before work starts, and the partner does not issue audit reports, attestations or certificates.
Ask the partner to list in the scope which evidence it prepares, which it only reviews and which the organization must produce itself.
Only an independent party can issue an ISO/IEC 27001:2022 certificate or an audit report. Certification bodies must be accredited to certify, and they test the management system against the standard through an audit that is separate from any consulting work. NIS2 is different: it creates no certificate of compliance, and national competent authorities oversee compliance through inspections, security audits, security scans, information requests and fines. Some Member States may allow compliance to be shown through assessment by accredited conformity assessment bodies, so the national framework decides which route applies.
- ISO 27001 certification: An accredited certification body audits the management system and issues any certificate. The audit is performed by people who did not build the controls for the client.
- NIS2 supervision: National authorities supervise essential entities ex ante and important entities ex post, and they can request evidence, run audits and impose administrative fines.
- Assessment routes: Where the national framework provides for it, an accredited conformity assessment body may assess against frameworks equivalent to Implementing Regulation 2024/2690.
- Independence: Auditors cannot also be the implementation partner for the same scope without creating a conflict that a certification body will examine.
- Timing: Audit dates and scope are set by the certification body or authority, not by the implementation partner.
Confirm with your national competent authority and with any certification body which route applies to your entity before you buy an audit.
How to run a combined NIS2 and ISO 27001 program
The sequence below turns an existing ISO/IEC 27001:2022 management system into NIS2 evidence by confirming the legal scope first, mapping controls to ENISA's requirement set, closing the gaps that remain and keeping the evidence current. Each phase ends with a named output that the next phase depends on.
Confirm scope and the applicable national law
Legal or compliance leads confirm whether the organization is an essential or important entity, which Annex I or II sector applies, which Member State has jurisdiction and whether a sector-specific law displaces NIS2 for any part of the business. The national transposition law, not the Directive alone, sets the obligations that will be tested. Confirm the registration status and the authority's expectations in writing. The output is a scope statement that names the in-scope entities, services and locations, and the national law the program will follow.
Inventory the existing ISO 27001 controls
The ISO 27001 owner lists the current Annex A controls, the statement of applicability, the risk treatment decisions and the internal audit and management review records that already run. Scope the inventory to the same systems and sites identified in the scope statement, because a certificate covering a narrower or different boundary will not transfer cleanly. The output is a controls register that records each control's owner, its operating status and where its evidence is stored.
Map controls to ENISA's requirement set
Working from ENISA's June 2025 technical implementation guidance and its published mapping table, the compliance lead maps each requirement of Implementing Regulation (EU) 2024/2690 that applies to the entity to the existing controls. ENISA states that its mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation, so each mapping line must be read against the regulation text and checked by the assessor who will review it. The output is a traceability matrix that links every applicable requirement to a control, a partial control or nothing.
Identify and rank the gaps
The team reviews every requirement without a fully operating control and records the gap type: missing control, control designed but not operated, evidence not retained, or a scope mismatch. Governance items that the Directive adds in law, such as management body approval, mandatory management training, the 24-hour, 72-hour and one-month reporting cycle, and registration, are checked separately because ISO 27001 does not address them. Gaps are ranked by their effect on the in-scope services. The output is a gap register with an owner and a closure decision for each item.
Build the NIS2-specific items
Owners write or extend the items that exist only under NIS2 or the implementing regulation, such as the incident reporting procedure, the quarterly review of recurring incidents, the annual management review of the security policy and risk assessments, and the quantified significant incident thresholds. Where an ISO 27001 policy already covers the subject, the team extends it instead of creating a parallel document, which reduces duplication. The output is an approved set of policies, procedures and thresholds with version control and named approvers.
Collect evidence against ENISA's examples
For each mapped requirement, the owner gathers the evidence type that ENISA's guidance describes and stores it in a form a supervisor or assessor can sample. Evidence should show that a control operated over time, not only that a document exists, so logs, tickets, test results, training records and review minutes are retained with dates and approvers. Open-source and self-hosted tooling often produces this evidence automatically, but each tool's output must be checked against the requirement it is meant to satisfy. The output is an evidence library indexed to the traceability matrix.
Arrange independent assessment if the entity chooses it
NIS2 does not create a certificate, and an entity is not required to certify against ISO 27001. Where the organization decides to obtain an independent assessment or certification, it selects an accredited conformity assessment body or auditor, confirms in writing which framework and scope will be assessed, and agrees the evidence the assessor will sample. Quotes should state the audit scope, the number of days, the sites covered and the surveillance cycle. The output is a signed engagement letter and an assessment plan. DeployOpen prepares systems and evidence for such an assessment but does not issue any report or certificate.
Maintain evidence through management review
The management body reviews the combined program at the intervals set in the policy, including the annual review required for the security policy and risk assessments, and records decisions on risk acceptance, resourcing and open gaps. Control owners refresh evidence on their scheduled cycles, and the traceability matrix is updated whenever a control, system or supplier changes. Internal audit or the assessor's findings feed back into the gap register. The output is a dated management review record and an updated evidence library that shows the program is still operating.
Questions buyers ask about NIS2 and ISO 27001
Does NIS2 require ISO 27001 certification?
No. NIS2 is EU law enforced by national authorities, and it does not require ISO/IEC 27001:2022 certification or any other certificate. ISO 27001 is a voluntary international standard. Article 21(1) asks entities to take account of relevant European and international standards where applicable, and Article 25 asks Member States to encourage their use without favoring a particular technology. Whether ISO 27001 is useful depends on your entity, your national law and what your supervisor accepts as evidence. Confirm those points with your national competent authority before you scope a certification project, because the national transposition law sets your actual obligations.
Does an ISO 27001 certificate prove NIS2 compliance?
No. An ISO 27001 certificate shows that a certification body found your information security management system conforms to ISO/IEC 27001:2022 within the scope it audited. It does not show that you meet every requirement of Implementing Regulation (EU) 2024/2690 or every obligation in your national law, such as registration, staged incident reporting or management body training. ENISA states that its June 2025 mapping is not a measure of equivalence and does not assess whether a standard fully covers the regulation. Ask your supervisor which evidence they will accept, and check gaps the certificate does not cover.
Can an existing ISO 27001 management system be extended to cover NIS2?
Often yes, and this is the usual starting point. ENISA's guidance says entities may build on their current use of standards or frameworks when implementing the requirements, which can reduce duplication and streamline audits. In practice, the work is to map your Article 21 measures and the Implementing Regulation requirements to the controls and documents you already run, then fill the gaps. Typical additions are NIS2-specific items such as the 24-hour, 72-hour and one-month reporting process, the at least annual management review of policy and risk assessments, the quarterly review of recurring incidents, and quantified significant incident thresholds.
What does ENISA's mapping mean for an audit?
It is a reference, not a shortcut. ENISA's June 2025 technical implementation guidance maps each Implementing Regulation requirement to ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST CSF 2.0, ETSI EN 319 401 and CEN/TS 18026:2024 in a published Excel table, with examples of evidence. The mapping does not say that a control satisfies a requirement in full. Auditors and supervisors still test whether your implementation meets the wording of the regulation and your national law. Read each mapped row, compare the evidence examples with what you can produce, and record where your ISO control is narrower than the NIS2 requirement.
What does the work need from our internal staff?
Most of the effort falls on people who own the systems and decisions. Your management body must approve the Article 21 measures and take the training Article 20 requires. Asset owners must confirm inventories, configurations and access records. Your incident response lead must agree the reporting workflow and who signs each stage. Your risk owner must review the risk assessment and treatment decisions. An implementation partner can prepare documents, configurations and evidence, but the organization owns the controls, the decisions and the sign-off. Ask any partner to name the internal roles and time commitments in the written scope before work starts.
Can a partner close the gaps without an auditor?
A partner can do the preparation, but not the independent conclusion. DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your infrastructure, and it prepares systems, controls and evidence for assessments. It does not issue audit reports, attestations or certifications. An ISO 27001 certificate can only be issued by an accredited certification body, and any NIS2 demonstration of compliance depends on your national framework, which may involve an accredited conformity assessment body or your authority. Scope the preparation work in writing, and agree with your auditor or assessor in advance which evidence they will test.
What to check before hiring a partner for both frameworks
NIS2 and ISO/IEC 27001:2022 overlap in practice, so one partner often helps with both. Before signing, confirm that the partner keeps implementation separate from independent assessment, knows the law as well as the standard, and commits to a written scope. The four checks below apply to any partner, whether a consultant, an integrator or a managed security provider.
Implementation separate from assessment
Ask whether the partner will prepare systems, controls and evidence, and whether it will also issue any report or certificate. Only an independent auditor, assessor or certification body can issue an ISO 27001 certificate or a conformity assessment result under the national NIS2 framework. A partner that offers to sign off its own work or to act as your assessor has a conflict of interest. Ask who the independent assessor will be and when that party is engaged.
Experience with Article 21 and the implementing regulation
Ask for examples of work on the ten Article 21(2) measures and on the requirement areas of Implementing Regulation (EU) 2024/2690 that apply to the entity's sector. Check whether the partner knows which rules apply to digital providers and which apply to other in-scope entities. A partner that only knows ISO 27001 may miss NIS2 duties such as the 24-hour, 72-hour and one-month reporting steps, or the management body training duty.
Familiarity with ISO 27001 and ENISA's mapping
Ask the partner to walk through ENISA's June 2025 mapping of the implementing regulation to ISO/IEC 27001:2022 and ISO/IEC 27002:2022. The partner should explain that ENISA says the mapping is not a measure of equivalence, so an existing ISO 27001 certificate does not prove NIS2 compliance on its own. Ask how the partner would identify the gaps that remain, such as management reviews at the frequency the regulation sets or quarterly recurring incident assessments.
Written fixed scope and deliverables
Ask for a written scope that names the entities, systems, sites and cloud accounts covered, the frameworks addressed, and each deliverable with its acceptance criteria. A fixed scope lets you compare quotes and shows which evidence the partner will produce. Ask what happens if the scope changes, who owns the policies and evidence at the end, and which items remain your responsibility after handover, such as management approval and training.
What to confirm with your authority and your auditor
The first thing to confirm is which rules actually bind you. NIS2 is a directive, so its obligations reach your organization through the national law of the Member State where you fall under jurisdiction, and that law may add requirements, set its own registration steps or name a different competent authority. Ask the authority whether it expects evidence in a particular form, whether it recognizes ISO/IEC 27001:2022 certification as supporting evidence for the Article 21 measures and the Implementing Regulation 2024/2690 requirements, and whether it wants a mapping table of your own. ENISA's June 2025 mapping is non-binding and states that it does not assess whether a standard fully covers the regulation, so a national authority's view on how far a certificate reaches is the answer that matters for your file.
The second thing to confirm is the scope of any certificate. An ISO 27001 certificate covers the information security management system and the boundary you define, which may not match the entities, sites, services or systems that NIS2 reaches, particularly if you run a group or serve several Member States. Ask your certification body to state the scope in writing and check it against the entity and service list you will give your authority. Confirm also whether the body is accredited for the work and whether its report or certificate is recognized by the authority in your country. Ask what the audit will and will not test, and whether any Implementing Regulation 2024/2690 requirements fall outside the certified scope.
The third thing to confirm is the status of the rules themselves. On 20 January 2026 the Commission proposed targeted amendments to NIS2 in COM(2026) 13, including a new small mid-cap category. That is a proposal, and it needs approval by the European Parliament and the Council before it changes anything. Record the version of the national law and the proposal status you relied on, date your mapping, and schedule a review of both the national transposition and the amendments before any audit or authority inspection. Your auditor and your authority should each confirm, in writing, the points they will accept as evidence.
How DeployOpen prepares systems and evidence for both frameworks
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. We prepare systems, controls and evidence so that one set of records can serve both a NIS2 review and an ISO/IEC 27001:2022 assessment, while the organization keeps ownership of its controls and an independent auditor or certification body issues any report or certificate.
How we scope
- We agree the scope in writing before work starts, covering systems, sites, and the NIS2 and ISO 27001 requirements in play.
- The written scope names which ENISA mapping rows and which Annex A controls the work will evidence, so overlaps are explicit.
- Ask us to confirm which obligations stay with your team, such as management approval and NIS2 registration.
How we build
- We configure and harden the open-source platforms in your cloud accounts, data centers or air-gapped networks.
- We set up logging, access control, backup and change records so they produce evidence tied to each control.
- Security testing of applications, APIs and infrastructure can be included in scope to check that controls work as described.
How we hand over
- We document the control design, configuration baselines, procedures and evidence locations in a form your assessors can follow.
- The handover maps each evidence item to the relevant ISO 27001 control and, where in scope, to the NIS2 requirement it supports.
- Your team receives the records and runbooks needed to maintain the evidence after the engagement ends.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the fixed-scope work is delivered.
- Retainers can keep evidence current for periodic reviews, management review cycles and supervisory or certification audits.
- Ask us to confirm the retainer scope, response arrangements and which audit preparation tasks it includes before you sign.
