ENISA's mapping table (version 1.2, 21 August 2025) links each requirement of Implementing Regulation (EU) 2024/2690 to ISO/IEC 27001:2022 clauses or controls. So an ISMS is a strong base for NIS 2, but ENISA says the mapping is not a measure of equivalence.
This guide is for CISOs and ISMS managers who hold or plan ISO/IEC 27001 certification and now fall under NIS 2, including Gulf digital providers with EU customers. For the ISMS basics, see our guide to ISO/IEC 27001:2022.
Which ISO/IEC 27001 controls does ENISA map to each NIS 2 measure?
Article 21(2) of NIS 2 lists ten measures, points (a) to (j), as a minimum. For cloud, data-centre, managed-service and the other listed digital providers, the Annex to the Regulation turns them into 13 sections and, by our count, 161 numbered requirements. Recital 3 says the Annex is based on standards such as ISO/IEC 27001 and ISO/IEC 27002.
ENISA's NIS2 Technical Implementation Guidance of 26 June 2025 maps each Annex requirement to ISO/IEC 27001:2022, NIST CSF 2.0, ETSI EN 319 401 and national frameworks. The mapping is a separate Excel file, advisory and not legally binding. We grouped it by Article 21(2) point. The Regulation assigns section 11 to points (i) and (j) and section 13 to (c), (e) and (i), and the split of their sub-sections is ours.
| NIS 2 Article 21(2) measure | Regulation Annex sections | ISO/IEC 27001:2022 clauses and Annex A controls mapped by ENISA (v1.2) | What the ISMS does not settle |
|---|---|---|---|
| (a) Risk analysis and information system security policies | 1, 2 | 5.2, 5.3, 6.1, 6.1.2, 6.1.3, 6.2, 8.2, 8.3, 9.2, 9.3, 10.1. A.5.1-A.5.4, A.5.7, A.5.19-A.5.21, A.5.31, A.5.35, A.5.36, A.8.34 | Annual policy review by management bodies (1.1.2), annual risk review (2.1.4), one person reporting to them (1.2.3) |
| (b) Incident handling | 3 | A.5.24-A.5.28, A.6.8, A.8.15-A.8.17 | A defined list of logged assets (3.2.3). The Article 23 clock sits outside the Annex |
| (c) Business continuity and crisis management | 4, 13.1 | A.5.26, A.5.29, A.5.30, A.7.11, A.8.13, A.8.14 | Crisis communication with competent authorities (4.3) |
| (d) Supply chain security | 5 | A.5.19-A.5.22, A.8.30 | Supplier contract terms (5.1.4) and each supplier's specific vulnerabilities (Article 21(3)) |
| (e) Acquisition, development and maintenance, including vulnerability handling | 6, 13.2 | 6.3, 8.1. A.5.21, A.5.23, A.5.32, A.7.3, A.7.5, A.7.13, A.8.7-A.8.9, A.8.16, A.8.20, A.8.22, A.8.25, A.8.29, A.8.31-A.8.34 | Protocol and e-mail standard plans, DNS and routing hygiene (6.7.2) |
| (f) Assessing the effectiveness of the measures | 7 | 6.2, 9.1, 9.3 only. No Annex A control | Evidence comes from objectives, measurement and management review |
| (g) Basic cyber hygiene and training | 8 | 7.2, 7.3. A.6.3, A.8.7 | Board training is a separate duty (Article 20(2)) |
| (h) Cryptography | 9 | A.5.31, A.8.24 | State-of-the-art review of cryptography (9.3) |
| (i) Human resources security, access control, asset management | 10, 11.1-11.6, 12, 13.3 | 7.1, 7.2. A.5.3, A.5.9-A.5.18, A.6.1-A.6.5, A.7.1, A.7.2, A.7.4, A.7.7, A.7.10, A.8.2, A.8.3, A.8.18, A.8.21, A.8.24 | Annual review of who holds security roles (10.1.3) |
| (j) Multi-factor authentication, secured communications | 11.7 | A.8.5 | No Annex point on secured voice, video, text or emergency communications |
Outside Article 21 entirely: management-body duties (Article 20), incident reporting (Article 23), registration (Articles 3 and 27), the EU representative (Article 26(3)) and supervision and fines (Articles 32 to 34).
Point (f) is the only measure with no Annex A control in ENISA's map. For point (j), the Annex covers multi-factor or continuous authentication (11.7). On our reading, it has no point on the secured communications that Article 21(2)(j) lists where appropriate. For point (c), our ISO 22301:2019 guide covers business continuity systems in full.
What does ISO/IEC 27001 not settle under NIS 2?
Clause 5.1 asks top management for leadership and commitment. Article 20 goes further. Management bodies must approve the Article 21 measures, oversee them and follow training, and they can be held liable. The Directive sets no training frequency, and management review minutes alone will not show board approval.
Article 23(4) sets the clock for a significant incident. You send an early warning within 24 hours of becoming aware of it, a notification within 72 hours and a final report within one month of that notification, to the CSIRT or competent authority. Because the Annex covers Article 21 only, ENISA maps nothing to Article 23. Controls A.5.5 and A.5.24 to A.5.26 support the process but set no deadline.
Registration is outside the ISMS too. Member States had to list their essential and important entities by 17 April 2025 (Article 3). The listed digital providers had to send their details to the competent authority, for ENISA's registry, by 17 January 2025 (Article 27). Those offering services in the EU with no establishment there must name an EU representative (Article 26(3)).
Where is Implementing Regulation 2024/2690 stricter than an ISMS?
ISO/IEC 27001 leaves review intervals to you. The Regulation fixes some. Management bodies review the security policy at least annually and after significant incidents or changes (1.1.2). Risk assessment results and the treatment plan are reviewed at least annually (2.1.4), and so are the people assigned to security roles (10.1.3).
At least one person must report directly to the management bodies on network and information system security (1.2.3).
Point 6.7.2 asks for a documented network architecture and an implementation plan for full transition to latest-generation network-layer protocols. It also asks for a plan for internationally agreed modern e-mail security standards, and for best practices in DNS security and routing hygiene. Point 3.2.3 asks for a list of assets subject to logging and sets what the logs cover, where appropriate.
Statement of Applicability exclusions need a second look. Under Article 2(2), a point marked "where appropriate", "where applicable" or "to the extent feasible" may be left unapplied only if you document your reasoning in a comprehensible manner. Other points are not optional. An exclusion your certification body accepted may not satisfy a NIS 2 supervisor.
Scope is the last trap. Under clause 4.3 you choose the ISMS scope. Article 21(1) covers the network and information systems you use for your operations or to provide your services, whatever the certificate covers.
Does an ISO/IEC 27001 certificate count as NIS 2 evidence?
It helps, but it is not proof on its own. Recital 7 of the Regulation says European and international standards can support you in demonstrating compliance. The duty to identify and document risks and implement the Annex stays with you.
Article 24 lets Member States require ICT products, services and processes covered by European cybersecurity certification schemes. ISO/IEC 27001 certification is not one of those schemes.
How a certificate counts depends on the Member State. In Belgium, the Centre for Cybersecurity Belgium (CCB) accepts an ISO/IEC 27001:2022 certificate toward a presumption of conformity only on conditions. The scope must cover the whole organisation, unless IT and OT environments are physically or technically separated. The Statement of Applicability must be equivalent to the CyberFundamentals (CyFun) level that applies.
Essential entities taking the ISO route face fixed dates. By 18 April 2026 they had to send the CCB the planned certification scope, covering all their networks and information systems, plus the Statement of Applicability and latest internal audit. By 18 April 2027 they need the certificate, from an accredited body the CCB has authorised, and a Statement of Applicability equivalent to CyFun Essential, unless their risk assessment justifies a lower level.
A transitional option accepts equivalence to CyFun Important plus a plan to reach Essential by 18 April 2028. The CCB says showing equivalence takes additional work and interpretation. Other Member States set their own rules, and a non-EU digital provider answers to the Member State of its EU representative.
Could the 2026 NIS 2 proposal change how certificates count?
COM(2026) 13, proposed on 20 January 2026, would make implementing acts under Article 21(5) maximum harmonisation. It would also allow certificates under organisational cyber-posture schemes of the European cybersecurity certification framework. It is still at committee stage in Parliament. We found no source linking ISO/IEC 27001 certification to those schemes.
ENISA has revised its table twice since June 2025, so check the version before you rely on a row.
How AGS can help
The NIS 2 & ISO/IEC 27001:2022 Integrated Management System holds 368 editable documents: 218 Word and 150 Excel files. Its NIS 2-to-ISO-IEC 27001 Annex A Control Matrix is our own article-level map, not ENISA's table. A Regulation 2024-2690 Requirement Matrix covers all 161 Annex points. It also has an ISO-IEC 27001 Statement of Applicability and five completed fictional examples, including a cloud provider.
Frequently asked questions
Do we need a separate NIS 2 management system alongside the ISMS?
No rule requires one. ENISA says entities may build on the standards they already use. Each Annex point and each duty outside Article 21 still needs an owner and evidence.
What percentage of NIS 2 does ISO 27001 cover?
No primary source gives a figure. Vendor pages quote coverage percentages without citing one, and ENISA's mapping does not assess coverage.
Can we still map NIS 2 to ISO/IEC 27001:2013?
No. The transition from the 2013 edition ended on 31 October 2025. ENISA's mapping table version 1.1 of 10 July 2025 removed references to the older edition from rows 11.1 to 11.3.
AGS provides independent documentation toolkits. This guide and the referenced kit are not affiliated with, endorsed by or approved by the European Commission, ENISA, ISO, IEC, the Centre for Cybersecurity Belgium or any national authority. It is general information, not legal advice.
Reviewed October 2026. Facts checked against the sources current at publication.
