NIS2 and ISO 27001: what is the difference?
The standard helps, but does not cover it. Where they overlap and where they don't.
A law versus a standard
NIS2 is legislation: you fall under it or you don't, and if you do you have obligations that a supervisor can enforce. ISO 27001 is a standard you can voluntarily have certified by an auditor. No one can compel you to obtain that certificate, and it does not exempt you from the law.
In practice they complement each other. If you are ISO 27001 certified you have already arranged and documented a large part of the ten subjects, and that documentation is precisely where most organizations get stuck.
What the standard does not cover
Three things are missing. The obligation to register with the supervisor does not appear in the standard. Neither does the obligation to report with the timelines of 24 hours, 72 hours and one month. And director liability with the training obligation is a legal construct that no standard can regulate.
Conversely, the standard asks for things the law does not, such as a fully documented management system with internal audits. That is useful, but it is not what you are held accountable for.
What you should do with it
If you have ISO 27001, use it as a basis and add what the law additionally requires. If you don't have it, don't start it for NIS2 reasons: a certification process costs a year and tens of thousands of euros and delivers you legally nothing you cannot also achieve without it.
What does help is doing the same thing the standard does well: documenting what you have arranged, with an owner and a date.
Frequently asked questions
Does my customer ask for ISO 27001?
It happens, especially with larger buyers. It is then a contractual requirement and not a legal one. A well-reasoned dossier of your own is sometimes an acceptable alternative; ask about it before you start a process.
Is NEN 7510 the same?
That is the Dutch standard for information security in healthcare, based on ISO 27001 with healthcare-specific additions. The same relationship to NIS2 applies: it helps, it does not cover it.
Do you conduct audits or certification?
No, and that is deliberate. An audit is the work of an independent party, and whoever builds the dossier cannot also assess it. We structure what you submit, nothing more.
This is explanation, not advice about your own situation. secria.eu does not assess your organization and does not provide assurance.