An ISO 27001 certificate demonstrably supports compliance with the NIS2 risk management obligations, but does not fully cover them. The standard describes how an organization systematically addresses information security through a management system; the NIS2 Directive (in particular Article 21) describes which concrete measures an essential or important entity must take, and Article 23 requires the reporting of incidents to a competent authority. The latter is not regulated by any ISO standard, however good the certificate otherwise is.
The difference therefore lies not in quality but in purpose. ISO 27001 is a voluntary standard that an organization can have certified to demonstrate that it has information security in order. NIS2 is legislation with a statutory risk management obligation, a registration obligation and a reporting obligation, which has been transposed into national law in each country — in the Netherlands in the Cybersecurity Act. A company can therefore be certified for ISO 27001 and still need to take steps to comply with statutory obligations, and conversely a company can work towards its statutory risk management obligations without ever wanting a certificate.
Where the overlap exists
ISO 27001 works with a risk assessment and a list of control measures (the so-called Annex A) that closely resemble the ten measures that the NIS2 risk management obligation describes: access control, encryption, backups, supplier assessment, incident handling and more appear in both. An organization that seriously maintains its ISO system already has evidence and an owner in place for many of these measures. This saves considerable work in building a file for the risk management obligation, and it is also precisely why customers who send a security questionnaire often regard an ISO 27001 certificate as a strong signal.
The scope is somewhat different, however. ISO 27001 allows an organization to determine the scope of the management system itself — for example only the IT department or only one location. The NIS2 risk management obligation applies to the entire entity that falls under the law, as defined by the legislator and the sector. A certificate with a limited scope therefore does not automatically say anything about the rest of the organization. Anyone who wants to check how that definition applies to their own sector will find it set out more clearly by searching the topics by situation than in the standard itself.
Where ISO 27001 has no coverage
Two obligations from the law have no equivalent in the standard. The first is the registration obligation: essential and important entities must register with the national competent authority, with information about the organization and its contact persons. ISO 27001 asks nothing about this — it is a certification standard, not a statutory portal.
The second is the obligation to report incidents. Article 23 of the Directive describes a phased process of reporting to the competent authority, with an initial notification shortly after discovery and follow-up steps thereafter. ISO 27001 does require a process for incident handling, but that process is internally focused: it describes how an organization handles an incident itself, not to whom and when it must report externally. Anyone who wants to understand this distinction clearly can review how these timeframes are structured in the earlier article on the reporting obligation on this site.
The way in which suppliers are assessed also differs in emphasis. ISO 27001 pays attention to supplier relationships as part of the broader risk assessment. The NIS2 risk management obligation makes supply chain assessment an explicit part of Article 21, which explains why obliged organizations place so much emphasis on this subject with their SME suppliers through questionnaires and contractual requirements.
What this means in practice
For an organization that is already ISO 27001-certified, this usually means that much of the evidence already exists, but it needs to be reorganized differently: per risk management measure a status, a piece of evidence and an owner, plus the texts for registration and reporting that the standard does not prescribe. For an organization without certification, it means they do not necessarily need to start an ISO process to work on compliance with the obligation to manage risks — the law requires the measures, not the certificate as such.
Whether and how this applies in practice to a specific organization depends on the sector, the size and the role in the supply chain, and this is ultimately assessed by the competent supervisory authority or a lawyer, not by this article. You get an initial indication by answering a few questions to see where you stand, and anyone who wants to know how the information on this site is structured and where the sources come from, can read that on the page about how secria.eu compiles the information.
If you have a concrete question about your own situation after reading, for example about what a certificate does and does not prove to a customer? Check the answers to frequently asked questions, or start the free check to see which next step is right for your organization.