Many companies are currently grappling with the question of what additional structures they need to put in place for NIS-2. Organizations that already operate an information security management system in accordance with ISO/IEC 27001 are not starting from scratch. Risk management, responsibilities, security policies, supplier management, and incident response are often already well-established components of their ISMS.
However, this does not mean that an ISO 27001 certificate automatically meets all NIS 2 requirements.
This is precisely where the key challenge lies: Companies should not supplement their existing structures with a parallel NIS 2 system, but rather assess which components of their existing ISMS can be utilized and where additional requirements must be addressed.
If implemented correctly, NIS-2 can thus evolve from an additional compliance task into a meaningful enhancement of the existing information security management system.
NIS-2 and ISO 27001 have a similar goal, but they are not the same thing
At first glance, ISO/IEC 27001 and NIS-2 appear very similar. Both deal with information security and cybersecurity, respectively, as well as risks and the question of how organizations can protect their digital infrastructure.
Nevertheless, they serve different functions.
ISO/IEC 27001 is an international standard for establishing and operating an information security management system, or ISMS for short. The standard helps organizations systematically manage information security, assess risks, and continuously implement appropriate measures.
NIS-2, on the other hand, is a regulatory framework. It imposes specific legal obligations on affected organizations that may go beyond simply establishing a management system.
That is why the statement “We are ISO 27001-certified, so we are automatically NIS 2-compliant” would be too simplistic.
It is more accurate to say: A well-established ISMS can serve as a very strong foundation for implementing NIS 2 requirements in a structured manner.
The existing ISMS should serve as the starting point
Those who already operate an ISMS should not view NIS-2 as an entirely new security program.
That is precisely what would often create unnecessary duplication of structures. It results in additional policies, new risk lists, separate areas of responsibility, and possibly even parallel reporting lines. The organization then ends up managing two separate security environments, even though many aspects are closely interrelated.
It makes more sense to start by reviewing the existing ISMS.
Which processes are already in place? Where are risks identified? What are the responsibilities? How are security incidents handled? Which suppliers are evaluated, and how is the effectiveness of security measures verified?
Afterward, it is possible to determine which NIS 2 requirements are already supported and where the existing system needs to be enhanced.
Thus, the ISMS remains the central management structure for information security, while NIS-2 integrates additional requirements into this structure.
Risk management is one of the strongest commonalities
Risk management is a particularly good starting point.
ISO/IEC 27001 requires a systematic approach to managing information security risks. Organizations must understand what risks exist, assess them, and determine appropriate measures to address them.
NIS-2 also follows a risk-based approach. Organizations are expected to implement appropriate technical, operational, and organizational measures that are commensurate with the actual risks.
For organizations with a functioning ISMS, this means that the existing risk management process does not necessarily need to be reinvented.
A much more important question is whether it fully takes into account the risks relevant to NIS-2. These may include, for example, dependencies on suppliers, major business interruptions, cyberattacks, or risks to particularly important network and information systems.
The existing process therefore provides the framework. NIS-2 may require that the scope, perspective, or assessment of individual risks be expanded.
Existing security policies can continue to be used
Policies and internal guidelines are also typically already in place within an established ISMS.
For example, companies have established policies regarding information security, access rights, the handling of security incidents, and the use of technical systems.
These principles are valuable for NIS-2.
Instead of drafting new NIS 2 guidelines separately, it should be determined whether existing documents already adequately address the additional requirements or can be supplemented in a targeted manner.
This has an important practical advantage: Employees do not have to understand multiple sets of rules that sometimes overlap.
Information security should, as much as possible, use a common language within the company.
If NIS 2 requirements are properly integrated into existing security policies, there will be fewer conflicts, and implementation will be significantly easier in day-to-day operations.
Responsibilities must be reviewed
An effective ISMS requires clear roles and responsibilities. Companies that operate in accordance with ISO/IEC 27001 therefore often already have defined responsibilities for information security.
NIS-2 makes this issue even more important.
In particular, the focus is shifting more toward the responsibility of senior management. Information security can therefore no longer be viewed solely as an operational task for an IT or security department.
For companies, this does not automatically mean that all roles must be restructured. Rather, existing responsibilities should be reviewed.
Is it clear who assesses risks? Who decides on measures? Who monitors their implementation? How is management informed? And who takes responsibility if a significant security incident occurs?
An existing ISMS can already provide good support for these decision-making processes. However, NIS-2 provides a useful opportunity to assess whether they actually work in practice and meet regulatory requirements.
Incident Management Is Becoming Increasingly Important
The handling of security incidents is another area where ISO/IEC 27001 and NIS-2 can be effectively integrated.
Many companies have already established procedures for detecting, assessing, and addressing security incidents.
However, for NIS-2, it is not enough to simply have an internal incident response process. In the event of relevant security incidents, legal reporting requirements must also be taken into account.
This means that companies do not necessarily need two separate processes.
Instead, an existing incident management process can be expanded. What matters most is that, in the event of an emergency, it is clear when an incident must be escalated, who assesses its significance, and how necessary external notifications are initiated.
This is precisely where the advantage of existing structures becomes apparent.
If roles, escalation procedures, and communication processes have already been tested, there is no need to reinterpret the specific NIS 2 requirements for every incident.
Business continuity can build on existing structures
Cyber resilience isn't just about preventing attacks. Companies must also be prepared in case systems actually fail or critical services become unavailable.
ISO/IEC 27001 already takes into account the importance of information security during disruptions and the ability to maintain relevant security requirements.
NIS-2 further reinforces this perspective through topics such as business continuity, crisis management, and backup and recovery.
Companies with existing emergency and recovery plans can therefore also build on their existing structures.
The key question, however, is whether these concepts align with today's dependencies. A plan developed several years ago may not adequately account for new cloud services, changes in supply chains, or additional digital services.
NIS-2 should therefore not merely serve as a reason to produce additional documents. Rather, it is an opportunity to verify whether existing resilience structures would actually function under realistic conditions.
Supplier management can be further developed from the ISMS
Today, digital services rely heavily on external providers. Cloud platforms, software vendors, managed services, and technology partners can be indispensable to a company’s operations.
That is precisely why supply chains play an important role in both information security management and under NIS 2.
Companies that already operate in accordance with ISO/IEC 27001 may have processes in place for supplier evaluation or contractual security requirements. These structures provide a good starting point.
However, NIS-2 should be used as an opportunity to take a closer look at the actual dependencies.
Not every supplier poses the same risk. A provider of a less critical support system must be evaluated differently than a cloud service provider on which a core business process depends.
A mature supplier management approach therefore considers not only contract clauses but also the potential impact of a security incident at the service provider.
Training must be part of the safety program
There are also clear connections when it comes to awareness and competence.
An effective ISMS already takes into account the fact that employees need an appropriate level of awareness regarding information security. After all, security rules are only effective if people understand them and can apply them.
NIS-2 reinforces this idea and also emphasizes the importance of management expertise.
This does not mean that companies should simply add another mandatory training course to their existing training structures. A role-based approach makes more sense.
Employees need knowledge to perform their daily work safely. IT and security professionals need in-depth technical expertise. Managers, in turn, must be able to assess risks, make decisions, and fulfill their responsibilities regarding cybersecurity.
This is how awareness turns into systematic skill development.
Audits and monitoring already provide important evidence
A major advantage of a well-functioning ISMS is that information security is regularly reviewed.
Internal audits, management reviews, key performance indicators, and improvement measures help identify weaknesses and evaluate the effectiveness of the management system.
These mechanisms may also be valuable for NIS-2.
This is because regulatory requirements should not simply be implemented once and then considered complete. Companies must continuously ensure that their security measures remain adequate.
Existing audit and review structures can help ensure that NIS 2-related issues are included in regular reviews.
This has an important effect: compliance is not something that is achieved only shortly before an audit.
It will become an integral part of the ongoing management system.
When ISO 27001 Alone Is Not Enough
As helpful as an existing ISMS may be, companies should not underestimate the differences.
ISO/IEC 27001 does not automatically address every specific NIS 2 issue.
First, for example, it must be determined whether an organization is even subject to the national NIS 2 regulations and which category it falls under. This may give rise to specific registration, reporting, and other obligations.
The special responsibility of management must also be taken into account.
In addition, there are regulatory requirements that are not met simply by having one's own ISMS certified.
That is why a company should not try to simply “check off” NIS-2 based solely on its existing ISO certification.
A more sensible perspective is:
What do we already have, and what are we still missing?
It is precisely this gap analysis that prevents both unnecessary duplication of effort and dangerous assumptions about requirements that are believed to have already been met.
Certification and regulatory compliance are two different things
This distinction is particularly important.
Successful ISO/IEC 27001 certification demonstrates that an information security management system meets the requirements of the standard.
NIS-2 compliance, on the other hand, refers to the legal requirements applicable to the respective organization.
The two can complement each other very well, but they are not the same.
A company may therefore have a very well-structured and certified ISMS and still need to supplement it with specific NIS 2 requirements.
Conversely, compliance with NIS 2 requirements does not automatically mean that all requirements of ISO/IEC 27001 are met.
This distinction is important for decision-makers because it prevents certification from being confused with legal compliance.
A gap analysis provides clarity
For companies with an existing ISMS, a structured gap analysis is therefore often the most sensible starting point.
The point is not to reevaluate every existing document. Instead, the existing structures are compared with the additional requirements.
Which NIS 2 topics are already well covered by the ISMS? Where do existing processes need to be expanded? Which regulatory requirements fall outside the scope of the current ISO 27001 frameworks? And what evidence is already available?
Such an analysis provides clarity on where action is actually needed.
That is more efficient than redesigning all processes as a precautionary measure.
At the same time, it becomes clear just how valuable an already established ISMS can be. Organizations that already manage information security systematically often have many of the organizational foundations required for NIS-2.
Do not establish a parallel NIS 2 organization
In the long term, NIS-2 should, if possible, not function as a separate compliance system alongside the information security management system.
Parallel structures create additional work and increase the risk of conflicting decisions.
For example, if risks are assessed once for the ISMS and a second time for NIS-2, this can quickly lead to differing results. The same applies to policies, supplier assessments, or incident response processes.
An integrated approach makes more sense.
The ISMS continues to serve as the organizational framework for information security. NIS 2-specific requirements are incorporated where necessary.
This does not create a separate “NIS 2 world,” but rather strengthens existing information security management.
ISO 27001 Can Turn Compliance into True Resilience
The biggest advantage of this connection is not the documentation.
It lies in sustainability.
Regulatory requirements can lead companies to implement security measures on short notice in order to meet an obligation. A management system, on the other hand, aims to manage and further develop these measures on an ongoing basis.
This is exactly where ISO/IEC 27001 can make an important contribution.
NIS-2 defines additional requirements and increases the pressure to act. The ISMS provides a framework within which risks, measures, responsibilities, and improvements can be addressed on an ongoing basis.
This results in more than just compliance.
The organization is improving its ability to systematically manage cyber risks and adapt to new threats and changes.
That is precisely the foundation of true cyber resilience.
Even companies without certification can benefit
One important point is often overlooked: A company does not necessarily have to be ISO/IEC 27001-certified to benefit from the principles of an ISMS.
Organizations that already use key elements of the standard or are in the process of establishing an ISMS can also use these as a basis for NIS-2.
What matters is not so much the certificate on the wall as whether information security is actually managed systematically.
Are the risks known? Have responsibilities been defined? Are measures being reviewed? Are there effective processes in place for security incidents? Are suppliers taken into account, and are improvements tracked?
If these structures function properly, a valuable foundation is already in place.
Certification can provide additional security and verifiability. However, it should not be confused with the actual goal: effective information security management.
Thinking About NIS-2 and ISO 27001 Together
For many companies, therefore, the decision should not be:
"NIS-2 or ISO 27001?"
The much more meaningful question is:
"How can we use our information security management system to implement NIS 2 requirements efficiently and sustainably?"
This change in perspective prevents duplication of effort.
An existing ISMS already provides processes, roles, and control mechanisms. NIS-2 adds regulatory requirements that can be specifically integrated into these structures.
That said, it remains important to understand the differences.
ISO/IEC 27001 provides a management system. NIS-2 establishes specific legal obligations for affected organizations.
Precisely because both approaches serve different functions, they can complement each other effectively in practice.
Conclusion: Use existing structures instead of starting from scratch
Organizations with an established ISMS have a decisive advantage when implementing NIS-2: Many of the basic structures are already in place.
Risk management, security policies, responsibilities, incident management, business continuity, supplier management, awareness, and continuous improvement do not need to be built from scratch.
However, it is crucial not to assume that these structures are sufficient without first examining them.
NIS-2 comes with its own regulatory requirements. Companies must therefore systematically assess which existing processes already comply and where additional measures are needed.
That is precisely where the most sensible approach lies.
Instead of operating two parallel security systems, we should focus on further developing our existing information security management system.
In this way, NIS-2 can achieve more than simply fulfilling a legal obligation. It can help align an existing ISMS even more closely with the organization’s actual cyber resilience.
Most Recent
To learn how companies can not only initiate change but also embed it permanently in their work processes and services, read the previous post:
“ITIL 5 Transformation: How Companies Can Permanently Embed Change in Service Management”
Training Tip: NIS-2 Foundation at SERVIEW
If you want to understand the requirements that NIS-2 places on companies and how these can be effectively integrated with existing information security structures, the NIS-2 Foundation training course at SERVIEW is the perfect place to start.
This training course covers the fundamentals of the NIS 2 Directive and helps you properly understand the requirements, responsibilities, and necessary security measures. Especially for organizations that already work with ISO/IEC 27001, this knowledge provides the foundation for further developing existing ISMS structures in a targeted manner, rather than establishing parallel processes.
Learn more:
NIS-2 Training Courses at SERVIEW
