[et_pb_section fb_built=”1″ _builder_version=”4.26.0″ _module_preset=”default” da_disable_devices=”off|off|off” global_colors_info=”{}” theme_builder_area=”et_body_layout” da_is_popup=”off” da_exit_intent=”off” da_has_close=”on” da_alt_close=”off” da_dark_close=”off” da_not_modal=”on” da_is_singular=”off” da_with_loader=”off” da_has_shadow=”on”][et_pb_row _builder_version=”4.26.0″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”et_body_layout”][et_pb_column type=”4_4″ _builder_version=”4.26.0″ _module_preset=”default” global_colors_info=”{}” theme_builder_area=”et_body_layout”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n
The EU’s new NIS-2 Directive<\/strong> raises cybersecurity requirements to an entirely new level. From October 2024, significantly more companies will have to meet strict requirements – including medium-sized industrial companies, IT service providers, critical suppliers, and organizations from energy, transport, healthcare, and many other sectors. <\/p>\n At the same time, we observe that many organizations are already considering implementing an Information Security Management System (ISMS) according to ISO 27001<\/strong> – or are already certified. But is an ISO 27001 certification sufficient to comply with NIS-2? And how should companies strategically connect the two regulatory frameworks? <\/p>\n In this article, we provide practical insights into how NIS-2 and ISO 27001 are related – and why a properly implemented ISMS is the best path to NIS-2 compliance.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n With the NIS-2 Directive, the EU aims to strengthen the resilience of digital infrastructure in Europe. The focus is on companies whose failure or compromise would have significant impacts on society, the economy, or security of supply. <\/p>\n The directive affects, among others:<\/p>\n What’s new: Numerous medium-sized enterprises<\/strong> are also falling under this regulation for the first time.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ol_line_height=”1.8em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n NIS-2 defines eleven security areas, including:<\/p>\n In addition, there are extensive requirements for:<\/p>\n For many companies, this means: a structured management system is almost indispensable<\/strong>.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ul_line_height=”1.7em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n ISO 27001 is the globally recognized standard for implementing an effective Information Security Management System (ISMS). It defines: <\/p>\n The parallels to NIS-2 are no coincidence.<\/p>\n ISO 27001 already covers ~80–90% of NIS-2 requirements.<\/strong><\/p>\n Key Overlaps:<\/p>\n Thus, ISO 27001 is one of the most efficient ways to comply with NIS-2.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ul_line_height=”1.7em” ol_line_height=”1.7em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n NIS-2 goes beyond ISO 27001<\/strong> in some aspects:<\/p>\n NIS-2 mandates compulsory reporting to authorities (e.g., ENISA, national CSIRTs within 24h\/72h).<\/p>\n → These requirements must be explicitly supplemented.<\/p>\n The management bears personal responsibility for implementation.<\/p>\n → ISO 27001 requires management involvement, but not legal liability.<\/p>\n NIS-2 demands minimum contractual, technical, and organizational requirements for external partners.<\/p>\n → A Supplier Security Framework becomes necessary.<\/p>\n some sectors (e.g., energy or health) have additional regulations.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ul_line_height=”1.7em” ol_line_height=”1.7em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n The most successful approach is an Integrated ISMS<\/strong>, where ISO 27001 serves as the foundation and NIS-2 extensions are built upon it.<\/p>\n Recommended Steps:<\/strong><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ul_line_height=”1.7em” ol_line_height=”1.7em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n A well-implemented ISMS is not just an obligation, but a competitive advantage.<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” text_font_size=”17px” ul_line_height=”1.7em” ol_line_height=”1.7em” hover_enabled=”0″ global_colors_info=”{}” theme_builder_area=”et_body_layout” sticky_enabled=”0″]<\/p>\n Companies already working with ISO 27001 have a clear advantage – they already meet a large part of the NIS-2 obligations.<\/p>\n For all others, now is the right time to build an ISMS. Not only to be compliant with the law, but to sustainably strengthen their own cyber resilience. <\/p>\n <\/p>\n [\/et_pb_text][et_pb_button button_url=”@ET-DC@eyJkeW5hbWljIjp0cnVlLCJjb250ZW50IjoicG9zdF9saW5rX3VybF9wYWdlIiwic2V0dGluZ3MiOnsicG9zdF9pZCI6IjIxNTYifX0=@” button_text=”Contact” button_alignment=”center” _builder_version=”4.27.4″ _dynamic_attributes=”button_url” _module_preset=”default” custom_button=”on” button_text_size=”14px” button_text_color=”#ffffff” button_bg_color=”#9f172c” button_bg_color_gradient_direction=”90deg” button_bg_color_gradient_stops=”#ffa727 0%|#FF8A3D 100%” button_bg_color_gradient_start=”#ffa727″ button_bg_color_gradient_end=”#FF8A3D” button_border_width=”0px” button_border_radius=”100px” button_letter_spacing=”5px” button_font=”Open Sans|700||on|||||” button_use_icon=”off” custom_padding=”23px|24px|23px|24px|true|true” animation_style=”slide” animation_direction=”left” locked=”off” global_colors_info=”{}” button_bg_color__hover=”#004872″ button_bg_color__hover_enabled=”on|hover” button_border_radius__hover=”100px” button_border_radius__hover_enabled=”on” button_letter_spacing__hover=”5px” button_letter_spacing__hover_enabled=”on” theme_builder_area=”et_body_layout”][\/et_pb_button][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Meeting NIS-2 Directives with ISO 27001 – How Companies Should Now Take a Strategic Approach The EU’s new NIS-2 Directive raises cybersecurity requirements to an entirely new level. From October 2024, significantly more companies will have to meet strict requirements – including medium-sized industrial companies, IT service providers, critical suppliers, and organizations from energy, transport, […]<\/p>\n","protected":false},"author":3,"featured_media":3130,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[55,50],"tags":[],"ppma_author":[70],"class_list":["post-3099","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nis2-en","category-information-security-and-data-protection"],"authors":[{"term_id":70,"user_id":0,"is_guest":1,"slug":"christoph-klecker","display_name":"Christoph Klecker","avatar_url":"https:\/\/advaso.com\/wp-content\/uploads\/2024\/04\/Christoph_Klecker_Portrait.jpg","author_category":"","first_name":"Christoph","last_name":"Klecker","user_url":"","job_title":"","description":"As a start-up manager, Christoph Klecker has implemented many successful market entries of foreign IT companies in the D.A.CH. region. His passion for the past 30 years has been sales, where he has worked as a consultant to put well-known IT companies with sales problems back on the road to success. Christoph is one of the managing directors of ADVASO GmbH."}],"_links":{"self":[{"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/posts\/3099","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/comments?post=3099"}],"version-history":[{"count":5,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/posts\/3099\/revisions"}],"predecessor-version":[{"id":3134,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/posts\/3099\/revisions\/3134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/media\/3130"}],"wp:attachment":[{"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/media?parent=3099"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/categories?post=3099"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/tags?post=3099"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/advaso.com\/en\/wp-json\/wp\/v2\/ppma_author?post=3099"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}What is NIS-2 – and whom does it affect?<\/h2>\n
\n
What exactly does NIS-2 require?<\/h2>\n
\n
\n
How does ISO 27001 fit in?<\/h2>\n
\n
\n\n
\n NIS-2 Requirement<\/strong><\/td>\n ISO 27001 Coverage<\/strong><\/td>\n<\/tr>\n<\/thead>\n\n \n Risk Analysis<\/td>\n Annex A.8, ISMS Processes<\/td>\n<\/tr>\n \n Incident Response<\/td>\n Annex A.5.25–27<\/td>\n<\/tr>\n \n Business Continuity<\/td>\n Annex A.5.30–34, ISO 22301<\/td>\n<\/tr>\n \n Supply Chain Security<\/td>\n Annex A.5.19–23<\/td>\n<\/tr>\n \n Access Management<\/td>\n Annex A.5.17<\/td>\n<\/tr>\n \n Security Awareness<\/td>\n Annex A.6.3<\/td>\n<\/tr>\n \n Technical Controls (Patch, Logging, Monitoring)<\/td>\n Annex A.8<\/td>\n<\/tr>\n \n Documentation & Evidence<\/td>\n Fundamental component of the ISMS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Where ISO 27001 alone is not yet sufficient<\/h2>\n
\n
\n
\n
\n
How Companies Efficiently Combine NIS-2 & ISO 27001<\/h2>\n
\n
<\/strong>Which NIS-2 requirements are already met by ISO 27001?
Which are missing?
→ The result is a clear roadmap.<\/li>\n
<\/strong>Companies without existing ISO certification should act now – time is running out by 2024\/25 at the latest.<\/li>\n
<\/strong>Since management is personally liable, training is mandatory.<\/li>\n
<\/strong>Conduct regular internal audits, risk reviews, and external examinations.<\/li>\n<\/ol>\n<\/ol>\n
<\/ol>\n
Advantages of an ISO 27001-based NIS-2 Program<\/h2>\n
\n
Summary: ISO 27001 is the Most Efficient Path to NIS-2 Compliance<\/h2>\n