NIS2 and ISO® 27001: What the Certificate Covers and What Is Missing

The short answer: no, an ISO® 27001 certificate is not enough for NIS2. An actively maintained ISMS supplies most of the evidence for the risk management measures in § 30 BSIG. A certificate does not establish full compliance with the BSIG. Check four gaps: the scope, registration, incident reporting and the duties of management.

Not sure whether NIS2 applies to you? Use the NIS2 scope check or read does NIS2 apply to your company.

What the certificate covers

§ 30 BSIG requires appropriate, proportionate and effective technical and organisational measures in ten areas, and you have to document compliance (§ 30(1) sentence 3). The measures should follow the state of the art and take relevant European and international standards into account (§ 30(2)). ISO® 27001 is such a standard: risk assessment, Annex A controls, internal audit, management review.

In our experience, an actively maintained ISMS covers most of the ten areas. The evidence is what counts, not the certificate on the wall. Which evidence each area needs and which ISO® 27001 controls supply it is covered in the ten NIS2 measures under § 30 BSIG.

Within § 30, check these three points separately:

• Multi-factor authentication (no. 10). A.8.5 leaves the method to the risk assessment. The BSIG names multi-factor or continuous authentication explicitly.
• Emergency communication (no. 10). Check how management, IT and the reporting team communicate securely when email and chat are down.
• Risk acceptance. ISO® 27001 lets you accept risks against your own criteria. Under the BSIG, the measures must be proportionate and should follow the state of the art. Justify accepted risks against that standard.

The four gaps

1. Scope

You define the scope of an ISMS yourself (clause 4.3). It may cover only one site or one business unit. The BSIG requires the measures for the whole relevant operation of the entity. Example: the certificate covers software development, but you are in scope because of your production plant with its own IT.

How to close it: compare your scope statement with the services that bring you under NIS2. Extend the scope, or document separately how the parts outside it meet § 30.

2. Registration with the BSI (§ 33)

Entities register with the BSI no later than three months after they first or once again count as an essential or important entity. The registration includes, among other things, the legal form, contact details including public IP address ranges, the sector and the EU member states in which you provide services. Changes must be reported without delay, at the latest within two weeks of becoming aware of them (§ 33(5)). Missing or incomplete information can be fined up to €500,000 (§ 65). ISO® 27001 has no equivalent.

How to close it: keep the registration as a record in the ISMS and assign an owner to report changes within the legal deadline. Check completeness again in the management review.

3. Incident reporting (§ 32)

ISO® 27001 requires incident management (A.5.24 to A.5.28) and contact with authorities (A.5.5), but no deadlines. For significant security incidents, the BSIG requires an early warning within 24 hours and an incident notification within 72 hours of becoming aware, and a final report no later than one month after the notification. If the incident is still ongoing, a progress report replaces the final report at that point (§ 32(2)).

How to close it: add to your incident procedure a decision point (is this significant?), named people who report with cover for weekends and holidays, and BSI portal access set up in advance. Details and a checklist are in NIS2 incident reporting.

4. Management duties (§ 38)

Clause 5.1 of ISO® 27001 asks top management for leadership and commitment. The BSIG goes further. Management must implement the § 30 measures and oversee their implementation (§ 38(1)). It can delegate tasks, but responsibility remains with it (BT-Drs. 21/1501, p. 154). If it breaches these duties, it is liable to the entity for culpably caused damage under corporate law (§ 38(2)). On top of that, management must attend training regularly (§ 38(3)).

How to close it: management receives regular reports on implementation, records its decisions in the management review and documents its own training. See NIS2 management training under § 38 BSIG.

Certified and in scope: the order that works

1. Register with the BSI, if not done yet.
2. Add the BSI deadlines to the incident procedure.
3. Check the scope against the whole entity.
4. Run the gap analysis against the ten areas of § 30 and close the gaps listed above.
5. Schedule the management training and put NIS2 on the management review agenda: registration status, reported incidents, open gaps, training date.

Keep one set of evidence. A policy, a risk or a supplier assessment serves ISO® 27001 and NIS2 at the same time.

ISO® 27001 and NIS2 in Valiido

In Valiido, NIS2 is a framework of its own next to ISO® 27001. In the Valiido Guide, the NIS2 chapters show the ISO® 27001 controls behind them, so the same policies, risks and records serve both. Incidents carry the 24-hour, 72-hour and one-month deadlines. You register and report to the BSI yourself, and AuditMagic checks against ISO® 27001, TISAX® and Valiido best practices, not against NIS2. How Valiido implements NIS2.

Frequently Asked Questions

Does NIS2 require ISO® 27001 certification?

No. The BSIG requires measures and their documentation, not a certificate. ISO® 27001 is a common way to structure those measures.

Does the BSI check our ISO® 27001 certificate?

The BSI checks compliance with the BSIG. For essential entities it can order audits, inspections or certifications by independent bodies and request the results (§ 61(1), (3)). Separate evidence requests under § 61(3) sentence 1 are possible no earlier than three years after the Act entered into force; approved hospitals have a separate rule. For important entities it acts when facts suggest a breach (§ 62). Operators of critical facilities submit evidence every three years (§ 39). A certificate can be part of that evidence, but only for its scope.

Does our certification body audit NIS2 as well?

No. The certification audit checks the ISMS against ISO® 27001 within the defined scope. Relevant legal duties can be considered within the ISMS (A.5.31), but the certificate is not a separate confirmation of BSIG compliance.

Can one ISMS cover ISO® 27001, TISAX® and NIS2?

Yes. All three build on risk management, policies and evidence. Maintain the evidence once and map it to each framework. For automotive suppliers, see NIS2 for automotive suppliers.