NIS2 and ISO 27001:
\n<\/span>How companies can make their ISMS fit for the new requirements<\/h1><\/h1><\/div>The NIS2 Implementation Act (NIS2UmsuCG) has been in force in Germany since December 6, 2025. Compliance and data protection officers who thought they were on the safe side with an existing ISO 27001 certification are now faced with an uncomfortable question: Is that really enough?<\/p>\n
The short answer is: No, not completely. The longer answer explains why a well-established ISMS in accordance with ISO 27001 is nevertheless the best starting point and where specific improvements are needed.<\/p>\n
<\/p>\n<\/div><\/div><\/div><\/div><\/div>
What the NIS2 directive really requires of companies<\/h2><\/div>The EU’s NIS2 Directive is not a recommendation, but applicable law. In the German NIS2 Implementation Act, Section 30 BSIG-neu specifies ten minimum measures for risk management that are directly based on Article 21 of the NIS2 Directive. These include concepts for risk analysis, incident response processes, business continuity management including backup strategies, supply chain security and the use of cryptographic procedures and multi-factor authentication.<\/p>\n
This is particularly important for compliance officers: The law expressly obliges management to implement and monitor these measures and can be held personally liable in the event of violations. Fines can amount to up to 10 million euros. In addition, “particularly important” and “important” institutions must register with the BSI. The corresponding portal has been activated since January 6, 2026.<\/p>\n
Significant security incidents must be reported within 24 hours, an extended report follows within 72 hours and a final report after one month. This is not a bureaucratic side issue, but an operational requirement that affects processes and documentation in equal measure.<\/p>\n<\/div><\/div><\/div>
ISO 27001 as a foundation – but not a free pass<\/h2><\/h2><\/div>Those who already operate an ISMS in accordance with ISO 27001 have a real head start. Both sets of rules follow a risk-based approach: identify, assess and treat risks and continuously review the effectiveness of the measures. The mapping between NIS2 Article 21 and the ISO 27001 controls is solid. Areas such as risk management, asset management, incident management, supply chain security and business continuity are well anchored in the ISO standard.<\/p>\n
Nevertheless, there are structural differences that should not be ignored. ISO 27001 is a voluntary, internationally recognized standard. NIS2 is binding EU law with sectoral requirements, specific reporting deadlines and state supervision by the BSI. While ISO 27001 allows exceptions with justification for certain controls, NIS2 leaves much less leeway. Many requirements are simply mandatory, regardless of the internal risk assessment.<\/p>\n
In short: a certified ISMS provides the structure. But it does not automatically cover the NIS2-specific obligations relating to reporting, registration and governance.<\/p>\n<\/div>
<\/div><\/div><\/div>Where the gaps typically lie<\/h2><\/h2><\/div>In practice, a GAP analysis between the existing ISO ISMS and NIS2 repeatedly reveals similar weaknesses. Three of them stand out in particular.<\/p>\n<\/div>
- <\/i><\/span>\n
Reporting processes and deadlines:<\/strong> ISO 27001 does not have any statutory reporting deadlines. However, the 24-hour initial notification in accordance with NIS2 requires established, testable processes and a clear assignment of responsibilities in the event of an incident. Anyone who tries to organize this ad hoc in an emergency will fail.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Supply chain security with proof:<\/strong>NIS2 goes much further than ISO 27001 when it comes to the systematic auditing of IT service providers, cloud providers and other third parties. Contractual regulations on information security and reporting obligations, regular due diligence audits, proof of certifications in the supply chain – all of this must be documented and auditable.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Management governance and evidence:<\/strong> NIS2 requires management to demonstrably fulfill its supervisory duties. Decisions, approvals, management reviews – all of this must not only take place, but must also be documented with a time stamp and audit trail.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>From standard to proof: Why Excel is reaching its limits<\/h2><\/h2><\/div>Many organizations start their NIS2 compliance journey exactly as they know it from the ISO 27001 implementation: with Excel lists, loose document collections and manually maintained mapping tables. This works to get started, but it doesn’t scale.<\/p>\n
As soon as risk registers, action statuses, supplier assessments, incident logs and management decisions live in different files and directories, versioning problems, responsibility gaps and a nightmare arise with every audit sprint. The BSI expects an “appropriate documented security level” – and that means: traceable, versioned, consistent.<\/p>\n
What authorities and auditors want to see is not a folder full of PDFs. It is a living register that shows which risks are known, which measures have been taken, who is responsible for them and when which decision was made. All in one consistent system, not spread across a dozen files.<\/p>\n<\/div><\/div><\/div>
\n<\/span>How companies can make their ISMS fit for the new requirements<\/h1><\/h1><\/div>
The NIS2 Implementation Act (NIS2UmsuCG) has been in force in Germany since December 6, 2025. Compliance and data protection officers who thought they were on the safe side with an existing ISO 27001 certification are now faced with an uncomfortable question: Is that really enough?<\/p>\n
The short answer is: No, not completely. The longer answer explains why a well-established ISMS in accordance with ISO 27001 is nevertheless the best starting point and where specific improvements are needed.<\/p>\n
<\/p>\n<\/div><\/div><\/div><\/div><\/div>
What the NIS2 directive really requires of companies<\/h2><\/div>The EU’s NIS2 Directive is not a recommendation, but applicable law. In the German NIS2 Implementation Act, Section 30 BSIG-neu specifies ten minimum measures for risk management that are directly based on Article 21 of the NIS2 Directive. These include concepts for risk analysis, incident response processes, business continuity management including backup strategies, supply chain security and the use of cryptographic procedures and multi-factor authentication.<\/p>\n
This is particularly important for compliance officers: The law expressly obliges management to implement and monitor these measures and can be held personally liable in the event of violations. Fines can amount to up to 10 million euros. In addition, “particularly important” and “important” institutions must register with the BSI. The corresponding portal has been activated since January 6, 2026.<\/p>\n
Significant security incidents must be reported within 24 hours, an extended report follows within 72 hours and a final report after one month. This is not a bureaucratic side issue, but an operational requirement that affects processes and documentation in equal measure.<\/p>\n<\/div><\/div><\/div>
ISO 27001 as a foundation – but not a free pass<\/h2><\/h2><\/div>Those who already operate an ISMS in accordance with ISO 27001 have a real head start. Both sets of rules follow a risk-based approach: identify, assess and treat risks and continuously review the effectiveness of the measures. The mapping between NIS2 Article 21 and the ISO 27001 controls is solid. Areas such as risk management, asset management, incident management, supply chain security and business continuity are well anchored in the ISO standard.<\/p>\n
Nevertheless, there are structural differences that should not be ignored. ISO 27001 is a voluntary, internationally recognized standard. NIS2 is binding EU law with sectoral requirements, specific reporting deadlines and state supervision by the BSI. While ISO 27001 allows exceptions with justification for certain controls, NIS2 leaves much less leeway. Many requirements are simply mandatory, regardless of the internal risk assessment.<\/p>\n
In short: a certified ISMS provides the structure. But it does not automatically cover the NIS2-specific obligations relating to reporting, registration and governance.<\/p>\n<\/div>
<\/div><\/div><\/div>Where the gaps typically lie<\/h2><\/h2><\/div>In practice, a GAP analysis between the existing ISO ISMS and NIS2 repeatedly reveals similar weaknesses. Three of them stand out in particular.<\/p>\n<\/div>
- <\/i><\/span>\n
Reporting processes and deadlines:<\/strong> ISO 27001 does not have any statutory reporting deadlines. However, the 24-hour initial notification in accordance with NIS2 requires established, testable processes and a clear assignment of responsibilities in the event of an incident. Anyone who tries to organize this ad hoc in an emergency will fail.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Supply chain security with proof:<\/strong>NIS2 goes much further than ISO 27001 when it comes to the systematic auditing of IT service providers, cloud providers and other third parties. Contractual regulations on information security and reporting obligations, regular due diligence audits, proof of certifications in the supply chain – all of this must be documented and auditable.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Management governance and evidence:<\/strong> NIS2 requires management to demonstrably fulfill its supervisory duties. Decisions, approvals, management reviews – all of this must not only take place, but must also be documented with a time stamp and audit trail.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>From standard to proof: Why Excel is reaching its limits<\/h2><\/h2><\/div>Many organizations start their NIS2 compliance journey exactly as they know it from the ISO 27001 implementation: with Excel lists, loose document collections and manually maintained mapping tables. This works to get started, but it doesn’t scale.<\/p>\n
As soon as risk registers, action statuses, supplier assessments, incident logs and management decisions live in different files and directories, versioning problems, responsibility gaps and a nightmare arise with every audit sprint. The BSI expects an “appropriate documented security level” – and that means: traceable, versioned, consistent.<\/p>\n
What authorities and auditors want to see is not a folder full of PDFs. It is a living register that shows which risks are known, which measures have been taken, who is responsible for them and when which decision was made. All in one consistent system, not spread across a dozen files.<\/p>\n<\/div><\/div><\/div>
The EU’s NIS2 Directive is not a recommendation, but applicable law. In the German NIS2 Implementation Act, Section 30 BSIG-neu specifies ten minimum measures for risk management that are directly based on Article 21 of the NIS2 Directive. These include concepts for risk analysis, incident response processes, business continuity management including backup strategies, supply chain security and the use of cryptographic procedures and multi-factor authentication.<\/p>\n
This is particularly important for compliance officers: The law expressly obliges management to implement and monitor these measures and can be held personally liable in the event of violations. Fines can amount to up to 10 million euros. In addition, “particularly important” and “important” institutions must register with the BSI. The corresponding portal has been activated since January 6, 2026.<\/p>\n
Significant security incidents must be reported within 24 hours, an extended report follows within 72 hours and a final report after one month. This is not a bureaucratic side issue, but an operational requirement that affects processes and documentation in equal measure.<\/p>\n<\/div><\/div><\/div>
ISO 27001 as a foundation – but not a free pass<\/h2><\/h2><\/div>Those who already operate an ISMS in accordance with ISO 27001 have a real head start. Both sets of rules follow a risk-based approach: identify, assess and treat risks and continuously review the effectiveness of the measures. The mapping between NIS2 Article 21 and the ISO 27001 controls is solid. Areas such as risk management, asset management, incident management, supply chain security and business continuity are well anchored in the ISO standard.<\/p>\n
Nevertheless, there are structural differences that should not be ignored. ISO 27001 is a voluntary, internationally recognized standard. NIS2 is binding EU law with sectoral requirements, specific reporting deadlines and state supervision by the BSI. While ISO 27001 allows exceptions with justification for certain controls, NIS2 leaves much less leeway. Many requirements are simply mandatory, regardless of the internal risk assessment.<\/p>\n
In short: a certified ISMS provides the structure. But it does not automatically cover the NIS2-specific obligations relating to reporting, registration and governance.<\/p>\n<\/div>
<\/div><\/div><\/div>Where the gaps typically lie<\/h2><\/h2><\/div>In practice, a GAP analysis between the existing ISO ISMS and NIS2 repeatedly reveals similar weaknesses. Three of them stand out in particular.<\/p>\n<\/div>
- <\/i><\/span>\n
Reporting processes and deadlines:<\/strong> ISO 27001 does not have any statutory reporting deadlines. However, the 24-hour initial notification in accordance with NIS2 requires established, testable processes and a clear assignment of responsibilities in the event of an incident. Anyone who tries to organize this ad hoc in an emergency will fail.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Supply chain security with proof:<\/strong>NIS2 goes much further than ISO 27001 when it comes to the systematic auditing of IT service providers, cloud providers and other third parties. Contractual regulations on information security and reporting obligations, regular due diligence audits, proof of certifications in the supply chain – all of this must be documented and auditable.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Management governance and evidence:<\/strong> NIS2 requires management to demonstrably fulfill its supervisory duties. Decisions, approvals, management reviews – all of this must not only take place, but must also be documented with a time stamp and audit trail.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>From standard to proof: Why Excel is reaching its limits<\/h2><\/h2><\/div>Many organizations start their NIS2 compliance journey exactly as they know it from the ISO 27001 implementation: with Excel lists, loose document collections and manually maintained mapping tables. This works to get started, but it doesn’t scale.<\/p>\n
As soon as risk registers, action statuses, supplier assessments, incident logs and management decisions live in different files and directories, versioning problems, responsibility gaps and a nightmare arise with every audit sprint. The BSI expects an “appropriate documented security level” – and that means: traceable, versioned, consistent.<\/p>\n
What authorities and auditors want to see is not a folder full of PDFs. It is a living register that shows which risks are known, which measures have been taken, who is responsible for them and when which decision was made. All in one consistent system, not spread across a dozen files.<\/p>\n<\/div><\/div><\/div>
Those who already operate an ISMS in accordance with ISO 27001 have a real head start. Both sets of rules follow a risk-based approach: identify, assess and treat risks and continuously review the effectiveness of the measures. The mapping between NIS2 Article 21 and the ISO 27001 controls is solid. Areas such as risk management, asset management, incident management, supply chain security and business continuity are well anchored in the ISO standard.<\/p>\n
Nevertheless, there are structural differences that should not be ignored. ISO 27001 is a voluntary, internationally recognized standard. NIS2 is binding EU law with sectoral requirements, specific reporting deadlines and state supervision by the BSI. While ISO 27001 allows exceptions with justification for certain controls, NIS2 leaves much less leeway. Many requirements are simply mandatory, regardless of the internal risk assessment.<\/p>\n
In short: a certified ISMS provides the structure. But it does not automatically cover the NIS2-specific obligations relating to reporting, registration and governance.<\/p>\n<\/div>
Where the gaps typically lie<\/h2><\/h2><\/div>In practice, a GAP analysis between the existing ISO ISMS and NIS2 repeatedly reveals similar weaknesses. Three of them stand out in particular.<\/p>\n<\/div>
- <\/i><\/span>\n
Reporting processes and deadlines:<\/strong> ISO 27001 does not have any statutory reporting deadlines. However, the 24-hour initial notification in accordance with NIS2 requires established, testable processes and a clear assignment of responsibilities in the event of an incident. Anyone who tries to organize this ad hoc in an emergency will fail.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Supply chain security with proof:<\/strong>NIS2 goes much further than ISO 27001 when it comes to the systematic auditing of IT service providers, cloud providers and other third parties. Contractual regulations on information security and reporting obligations, regular due diligence audits, proof of certifications in the supply chain – all of this must be documented and auditable.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Management governance and evidence:<\/strong> NIS2 requires management to demonstrably fulfill its supervisory duties. Decisions, approvals, management reviews – all of this must not only take place, but must also be documented with a time stamp and audit trail.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>From standard to proof: Why Excel is reaching its limits<\/h2><\/h2><\/div>Many organizations start their NIS2 compliance journey exactly as they know it from the ISO 27001 implementation: with Excel lists, loose document collections and manually maintained mapping tables. This works to get started, but it doesn’t scale.<\/p>\n
As soon as risk registers, action statuses, supplier assessments, incident logs and management decisions live in different files and directories, versioning problems, responsibility gaps and a nightmare arise with every audit sprint. The BSI expects an “appropriate documented security level” – and that means: traceable, versioned, consistent.<\/p>\n
What authorities and auditors want to see is not a folder full of PDFs. It is a living register that shows which risks are known, which measures have been taken, who is responsible for them and when which decision was made. All in one consistent system, not spread across a dozen files.<\/p>\n<\/div><\/div><\/div>
In practice, a GAP analysis between the existing ISO ISMS and NIS2 repeatedly reveals similar weaknesses. Three of them stand out in particular.<\/p>\n<\/div>
- <\/i><\/span>\n
Reporting processes and deadlines:<\/strong> ISO 27001 does not have any statutory reporting deadlines. However, the 24-hour initial notification in accordance with NIS2 requires established, testable processes and a clear assignment of responsibilities in the event of an incident. Anyone who tries to organize this ad hoc in an emergency will fail.<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nSupply chain security with proof:<\/strong>NIS2 goes much further than ISO 27001 when it comes to the systematic auditing of IT service providers, cloud providers and other third parties. Contractual regulations on information security and reporting obligations, regular due diligence audits, proof of certifications in the supply chain – all of this must be documented and auditable.<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nManagement governance and evidence:<\/strong> NIS2 requires management to demonstrably fulfill its supervisory duties. Decisions, approvals, management reviews – all of this must not only take place, but must also be documented with a time stamp and audit trail.<\/p>\n<\/div><\/li><\/ul><\/div><\/div>
From standard to proof: Why Excel is reaching its limits<\/h2><\/h2><\/div>
Many organizations start their NIS2 compliance journey exactly as they know it from the ISO 27001 implementation: with Excel lists, loose document collections and manually maintained mapping tables. This works to get started, but it doesn’t scale.<\/p>\n
As soon as risk registers, action statuses, supplier assessments, incident logs and management decisions live in different files and directories, versioning problems, responsibility gaps and a nightmare arise with every audit sprint. The BSI expects an “appropriate documented security level” – and that means: traceable, versioned, consistent.<\/p>\n
What authorities and auditors want to see is not a folder full of PDFs. It is a living register that shows which risks are known, which measures have been taken, who is responsible for them and when which decision was made. All in one consistent system, not spread across a dozen files.<\/p>\n<\/div><\/div><\/div>
- <\/i><\/span>
![\"NIS2-und-ISO-27001-Themis\"](\"https:\/\/www.bayoosoft.com\/wp-content\/uploads\/sites\/5\/2026\/03\/SOFT_NIS2-und-ISO-27001-Themis_Absatz-1.jpg\" "\\"SOFT_NIS2-und-ISO-27001-Themis_Absatz\\"")
<\/span><\/div><\/div><\/div>![\"BAYOOSOFT](\"https:\/\/www.bayoosoft.com\/wp-content\/uploads\/sites\/5\/2024\/05\/Themis-300x300.png\" "\\"Themis\\"")
<\/span><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>