The Most Common NIS2 Misconception in the Market
The most common question ROOTKey's enterprise team hears from compliance professionals is this: 'We have ISO 27001. Does that cover NIS2?'
The short answer: no. ISO 27001 certification is a significant asset in a NIS2 compliance programme, and it demonstrates a mature approach to information security management. But it does not cover NIS2's regulatory obligations, and organisations that assume it does will face gaps - some of them material.
This is not a criticism of ISO 27001 - it remains the most rigorous internationally recognised framework for information security management. It is a clarification of what NIS2 requires that ISO 27001 does not.
Understanding the differences will save compliance teams significant time by focusing effort on genuine gaps rather than duplicating work already done.
What ISO 27001 and NIS2 Share
The substantial overlap between the two frameworks means that ISO 27001-certified organisations have a significant head start on NIS2 compliance:
Risk management. Both require systematic risk identification, assessment, and treatment. ISO 27001's risk treatment plans map closely to NIS2's Article 21 security measures.
Technical controls. ISO 27001 Annex A controls cover access control, cryptography, physical security, operations security, and communications security - all of which are required by NIS2.
Documentation. ISO 27001's documentation requirements (policies, procedures, records) align with NIS2's requirement to demonstrate that appropriate measures are in place.
