ISO 27001 and NIS2: similarities and key differences

ISO 27001 and NIS2 approach the same area from two perspectives: the standard structures information security management, while the legislation establishes operational and reporting obligations. The differences between NIS2 and ISO 27001 begin with operational evidence — continuous monitoring, reporting deadlines and service recovery capabilities. A certificate confirms that a system exists and has passed an independent assessment. People, processes and rapid response are what put obligations into practice.

Key information:

• The standard is a starting point — both share a core of risk assessment, policies, roles and improvement.
• Certification covers the declared scope — statutory obligations concern specified services and systems regardless of that scope.
• The gap lies in operational evidence — our first checks cover continuous monitoring, timely reports, recovery tests and team exercises.
• Accountability rests with management — leadership approves measures, assigns tasks and oversees execution even after delegation.
• Gap analysis precedes procurement — first establish entity status and map obligations, then decide on tools and staffing.

What is ISO 27001?

ISO/IEC 27001 specifies requirements for an information security management system and remains voluntary: organisations adopt it to manage risk and demonstrate maturity to customers or contracting authorities. At its core is an ISMS (Information Security Management System), a system for managing information security. It comprises:

• risk assessment,
• policies,
• assigned roles,
• effectiveness measurement,
• continual improvement.

An ISO 27001 certificate is issued after an audit by an independent body within the organisation’s declared scope. Controls are selected through risk assessment and recorded in the Statement of Applicability. Therefore, the certification scope determines what has been confirmed: two organisations with the same certification may cover different systems. ISO 27001 treats cybersecurity as part of wider information security, alongside personnel and contractual matters.

What is NIS2?

NIS2 is European Union Directive 2022/2555, implemented through national law. In Poland, the amendment to the National Cybersecurity System Act has applied since 3 April 2026. For management, this means obligations, deadlines, public supervision and personal accountability. Coverage depends on sector, activity and organisational size, so the first step is establishing entity status: essential, important or outside the Act’s scope.

Risk management and an NIS2 audit cover ten minimum areas, from incident handling and business continuity to supply-chain security. NIS2 measures should be proportionate to risk, while Polish legislation adds operational requirements: continuous system monitoring, continuity and recovery plans, tests and execution records. Organisational capability, demonstrated through operational evidence, is decisive. Learn more here: NIS2 and security monitoring.

What do ISO 27001 and NIS2 have in common?

An organisation with a functioning ISMS begins regulatory preparation with a foundation because both use the same risk-based thinking. In ISO 27001 and NIS2 comparisons, 'compliance’ causes much confusion despite their many shared elements.

The shared core of the standard and regulation:

• A risk-based approach — measures are selected for identified threats and their organisational impact.
• Policies and documentation — written rules, procedures, registers and execution records.
• Roles and responsibilities — individually assigned tasks, with management approving measures.
• Incident handling and business continuity — reporting, classification, service restoration and lessons learned.
• Supplier security — requirements for subcontractors and oversight of external services.
• Continual improvement — reviews, tests and adjustments following audits and incidents.

Risk analysis, asset registers and management reviews can therefore support preparation without being rewritten from scratch. Differences emerge in the level of detail and evidence expected by the supervisory authority.

The key differences

The comparison below organises five areas where NIS2 and ISO 27001 differ most. Each creates a different type of organisational work.

Comparison area	ISO 27001	NIS2 and Poland’s National Cybersecurity System Act
Nature of the document	an international standard specifying ISMS requirements	a directive implemented through national legislation
Basis for application	voluntary certification within a selected scope	an obligation for essential and important entities
Objective	structured information security management	service cyber resilience: detection, response and continuity
Nature of requirements	management-focused, with controls selected through risk assessment	operational, including reporting deadlines and execution records
Verification	certification-body audits and a recertification cycle	obligations to authorities, supervision and statutory audits

Certification provides a strong start: risk analysis, policies, assigned roles and regular reviews. Operational requirements add continuous observation, reporting deadlines and test evidence — often the areas addressed after an initial gap analysis.

What ISO 27001 does not provide

Certification shows that the management system operates within its declared scope and has passed an independent assessment. The standard includes logging, activity monitoring and incident-management controls, but their scope, frequency and configuration follow the risk assessment. NIS2 compliance is demonstrated through operational evidence: monitoring records, timely reports and recovery test results. Each arises when someone observes, assesses and responds within the required timeframe.

Area	What ISO 27001 usually covers	What NIS2 and Poland’s National Cybersecurity System Act add
Risk management	methodology, risk register and treatment plan	linking measures to the regulated service
Monitoring	controls within the Statement of Applicability scope	continuous operation with system records
Incident handling	reporting, classification and lessons-learned procedures	for a significant incident under the Directive: early warning within 24 hours, notification within 72 hours and a final report within one month
Business continuity	continuity plans, backups and recovery	testing plans and demonstrating recovery capability
Responsibility	roles, management engagement and review	leadership accountability, training and regulatory supervision

A typical scenario: an organisation certified for several years commissions a compliance assessment and learns that its ISMS works, yet continuous out-of-hours observation is missing, along with exercises and a documented reporting route to the authority. A capability-focused IT security audit helps establish who receives signals, how response works and what records remain.

SecureVault delivers recovery testing and post-incident continuity support, while VigilHorizon provides detection and initial incident response.

How should an ISO 27001 organisation prepare for NIS2?

Whether ISO 27001 is sufficient is often asked after the first review of statutory obligations. The practical answer begins by identifying what is regulated. That decision defines subsequent work: preparation is organised around the services covered by the Act.

A time-efficient sequence:

1. Establish entity status — check whether and to what extent Poland’s National Cybersecurity System Act applies.
2. Compare scopes — compare certification coverage with regulated services and systems.
3. Perform a gap analysis — map each obligation to existing controls and identify uncovered areas.
4. Complete operational capabilities — continuous monitoring, event classification, escalation and duty coverage.
5. Set up the reporting process — significant-incident criteria, authority contacts, deadlines and templates.
6. Test and document — response exercises, recovery tests, records and lessons. VigilHorizon runs incident response exercises; SecureVault tests data recovery and continuity plans.

At VigilHorizon, the difference between a document and a capability often becomes visible on the first night of service. A procedure says who responds; the first after-hours alert shows whether someone receives it, classifies it and has authority to decide without waiting until morning. We therefore define roles and playbooks before selecting technology to support the required actions.

Compliance is tested on the day of an incident: who receives the report, which playbook is activated and how quickly the organisation can document events.

VigilHorizon expert

Common organisational mistakes

Recurring mistakes are most costly when exposed during an inspection or incident. In ISO and compliance discussions, two things are easily confused: system certification and fulfilment of an obligation.

Mistake	What happens in practice
Equating certification with full compliance	obligations outside certification scope remain without an owner
Skipping entity-status assessment	work begins without knowing which services are regulated
Monitoring without continuity or escalation	overnight events wait until morning while the relevant clock is already running
Missing Incident Response procedures and exercises	the team learns the process during the incident
Purchasing before gap analysis	tools arrive before the process that would use them

All share a cause: the review stops at documentation before examining operational records. Gap analysis works best after reviewing the actual environment, because mapping obligations requires current system knowledge. This is where an IT security audit is useful.

Is your organisation ready?

Operational questions provide a quick readiness check: who observes, who decides and how quickly. They also begin the NIS2 compliance auditing. The answer to the first depends on the service model: an internal team, administrator duties or a round-the-clock SOC (Security Operations Center).

Six questions before gap analysis:

• Continuous observation. Are events from regulated systems monitored without interruption, regardless of time or day?
• The alert path. Is there a documented route from signal through triage to a decision, with named owners on each side?
• Incident classification. Is it clear who determines that an event is significant and which criteria apply?
• Response procedures. Are the playbooks Incident Response documented, current and familiar to those on duty?
• Exercises and tests. Has a response exercise and service recovery test been performed in the past year, with results recorded?
• Records for the authority. Can the documentation reconstruct the event and demonstrate that deadlines were met?

Every 'no’ on this list identifies an area for gap analysis and helps prioritise spending. Where capabilities cannot be maintained internally, some organisations outsource detection and response, for example through a SOC 24/7 package.

ISO 27001 certification as a starting point for NIS2 compliance

ISO 27001 structures information security management and remains a strong component of organisational maturity. Regulatory compliance is established separately through: entity status, obligation mapping and evidence that the organisation detects, responds and restores services within agreed times. A document describes intent; people, process and prompt response deliver results.

At VigilHorizon, readiness discussions start with existing assets: a working ISMS, certification and policies. The question then shifts to evidence: can this be demonstrated during an inspection? An NIS2 compliance assessment and gap analysis provide the answer and are worth discussing with our experts.

Contact us

Frequently asked questions (FAQ)

Is ISO 27001 certification sufficient to meet NIS2 requirements?​

Certification does not settle the question: it covers the organisation’s declared scope, while regulation covers specified services. Missing records of the last report or recovery test can indicate a gap.

Does NIS2 require ISO 27001 certification?​

The Directive encourages recognised standards without mandating a particular certificate. The organisation chooses its standard but remains accountable for statutory obligations.

Should ISO 27001 be implemented before regulatory preparation?​

The standard can shorten later work by providing risk analysis, policies and roles. When statutory deadlines are close, addressing obligations first and then organising the wider system may be faster.

How does a certification audit differ from a compliance audit?​

A certification audit assesses a management system against the standard and leads to a certification-body decision. A compliance audit examines statutory obligations for a specific service, with consequences in regulatory supervision.

Does a certified organisation need a SOC?​

Regulations require appropriate monitoring, detection and response capabilities, but do not prescribe SOC as the only organisational model. It is one option alongside internal duties and hybrid arrangements.

Does ISO 27001 cover Incident Response?​

The standard includes incident-management controls, with depth determined by risk assessment. Evidence from the latest exercise shows implementation; a procedure in the ISMS describes intent.

Who is accountable for compliance?​

Management approves measures and oversees execution. A common mistake is assigning sole ownership to a technical employee without authority to enforce deadlines across other departments.

How quickly must an incident be reported?​

For significant incidents, the Directive provides for early warning within 24 hours, notification within 72 hours and a final report within one month. Timing begins when the organisation becomes aware; delayed recognition reduces practical response time.

Is every certified company subject to the legislation?​

Scope depends on sector, activity and size, not certification. Conversely, a company without certification may be an essential entity.

Where should you start if certification exists but compliance is unconfirmed?​

First establish entity status and the regulated services. This rarely belongs to IT alone: without understanding the business model, it is easy to misidentify covered services.

Learn more:

• NIS2 compliance audit — how to prepare your organisation
• NIS2 and security monitoring—which requirements really apply?
• What is SOC 24/7? How a Security Operations Center works and why monitoring is not enough
• The first 60 minutes of a cyberattack — what really happens and why every minute matters