What certification demonstrates
ISO 27001 sets requirements for establishing, implementing, maintaining and continually improving an information security management system. An accredited certification body audits the system against the standard, surveillance audits follow each year, and recertification takes place every three years. Together they give independent assurance that the system operates and improves over time, based on what the auditors examine at each visit.
Both ISO 27001 and NIS2 require risk-based security management, and their security measures overlap. ENISA's technical implementation guidance, published in June 2025, maps the security requirements for the digital infrastructure and digital provider sectors to standards including ISO 27001. Entities in those sectors can use it as the basis for an evidence-based comparison.
Check what the certificate actually covers
Management should first identify which legal entities and services fall within NIS2 scope, the national requirements that apply and when those obligations take effect. For a group operating across borders, this assessment needs to distinguish the obligations of individual entities from assurances presented at group level.
It should then compare that assessment with the certificate's documented scope. A certificate covering one business unit or service does not establish assurance over other operations. For example, certification covering a customer platform may leave a separate service or subsidiary outside the audited scope, even though it is relevant to the organisation's NIS2 obligations.
The board should receive a clear account of where certification provides relevant evidence, where further evidence is needed and who owns the outstanding work. A difference in scope shows where the certificate cannot support the assurance being claimed. Operations outside it may still be secure and compliant, and need their own evidence.
Three areas to verify
A certified system may already address each of these, and each needs its own evidence.
- Board oversight
- NIS2 requires the management body to approve the cybersecurity risk-management measures and oversee their implementation, and its members must follow training. Members can be held liable for infringements of those measures. The evidence is a record of approval, the reporting the management body receives on implementation, and completed training.
- Incident reporting
- A significant incident requires an early warning without undue delay and within 24 hours of becoming aware of it, an incident notification within 72 hours and a final report normally within one month of that notification. Reports go to the CSIRT or, where applicable, the competent authority, and some providers, including trust service providers, face shorter deadlines. The evidence is a reporting process tested against those deadlines.
- Supplier assurance
- NIS2 requires supply chain security measures that take account of each direct supplier's vulnerabilities, product quality and secure development practices. ISO 27001 supplier controls may already cover this, and the comparison should confirm whether they do. The evidence is supplier assessments, agreed security requirements and records of how identified weaknesses are addressed.
Questions for the board
The comparison should allow management to answer four questions.
- Coverage
- Which regulated entities, services and systems sit outside the certificate's scope, and what assurance covers them?
- Evidence
- Which applicable obligations are supported by evidence, and which remain unresolved?
- Accountability
- Can management demonstrate approved measures, management body oversight and training, and tested reporting arrangements?
- Closure
- Who owns each gap, and when will it close?
