The one idea
NIS2 is a set of legal duties; ISO 27001 is a management system you can certify. And they overlap heavily. Most of what you build for ISO 27001 (know your risks, put proportionate controls in place, keep evidence, handle incidents on a clock) is exactly what NIS2 Article 21 asks for. In practice a lot of EU teams treat NIS2 as a layer over an ISO 27001 base, not a parallel project.
The trap is running them as two separate programmes and doing the work twice. This hub is the map that stops that.
The crosswalk (starting map)
NIS2 Article 21(2) risk-management measures ↔ ISO/IEC 27001:2022 (clauses + Annex A themes). Control numbers/titles verified against ISO/IEC 27001:2022 Annex A; NIS2 measures against Directive (EU) 2022/2555 (see authoritative sources). Still an orientation map, not legal advice. Your scope and national transposition decide the detail.
| NIS2 Art. 21(2) measure | Maps to (ISO 27001:2022) |
|---|---|
| (a) risk analysis & information system security policies | Clause 6.1: 6.1.2 risk assessment, 6.1.3 risk treatment (+ operational 8.2/8.3); Clause 5.2 policy; A.5.1 |
| (b) incident handling | A.5.24–A.5.28 (incident management, learning, evidence) + A.6.8 (event reporting); corrective action Clause 10.2 |
| (c) business continuity, backup, disaster recovery, crisis management | A.5.29–A.5.30, A.8.13–A.8.14 |
| (d) supply-chain security | A.5.19–A.5.23 (supplier relationships, cloud) |
| (e) security in acquisition, development & maintenance; vulnerability handling & disclosure | A.8.8, A.8.25–A.8.29 |
| (f) policies to assess effectiveness of measures | Clause 9.1 (monitoring/measurement) + 9.2 (internal audit) |
| (g) basic cyber hygiene & security training | A.6.3 (awareness), A.8.7 (malware), A.8.19 |
| (h) cryptography & encryption | A.8.24 |
| (i) human resources security, access control, asset management | A.6.1–A.6.6, A.5.9–A.5.18, A.8.1–A.8.5 |
| (j) MFA / continuous authentication, secured voice/video/text comms | A.8.5, A.8.20–A.8.21 + A.5.14 (information transfer, covers voice/video/messaging) |
Plus the NIS2-specific bits ISO doesn’t force: Article 23 incident-reporting deadlines (early warning 24h → notification 72h → final report 1 month) and Article 20 management-body accountability + training.
A downloadable spreadsheet version (each Annex A control mapped, filterable) is a planned companion asset. See Open items.
How to use it
- If you’re building ISO 27001 already, use the right-hand column as your NIS2 evidence. You’ve likely done most of it.
- If NIS2 is your trigger, build in dependency order (scope → risk → controls → evidence → incidents),
and tag your questions
nis2so answers point at where ISO overlaps and where NIS2 adds something. - Don’t rebuild what you have. The point of a shared compliance brain behind your tooling is that one understanding of your business serves both frameworks. You’re not re-mapping every cycle.
Where are you starting from: an ISO 27001 base you’re extending to NIS2, or NIS2 from scratch? Drop it below and people who’ve mapped the two will tell you the shortest path.
Tags: nis2, iso27001, reference