A letter mentioned NIS2 and a reporting obligation. Everyone keeps talking to me about ISO 27001. Are these two different projects I now have to run in parallel?
They’re different obligations, but they overlap heavily. You’re not running two separate projects from scratch.
NIS2 is a regulatory duty (it comes with things like incident-reporting deadlines) rather than a certificate you earn. ISO 27001 is a management system you can certify. The good news: most of what you’d build for ISO 27001 (knowing your risks, having controls, keeping evidence, handling incidents on a clock) is exactly what NIS2 asks for. In practice a lot of teams treat NIS2 as a layer over an ISO 27001 base rather than a parallel build.
If NIS2 is your trigger, tag your questions nis2 and say so. The answers can point you at where the two line up and where NIS2 adds something specific (like the reporting windows).