Implementing Regulation (EU) 2024/2690 · Annex
NIS2, mapped to ISO 27001
Most of what NIS2 asks for technically is the same in every member state, because that part is a Regulation rather than a Directive, and it was written from ISO 27001. If you run a conforming ISMS you have already built most of this. Here is the whole Annex, section by section, and the two places it asks for more.
- Who this is for
- An essential or important entity under NIS2, or a supplier one of them is asking, that already runs or is building an ISO/IEC 27001 management system and wants to know how much of Article 21 it already answers.
- What maps
- All 10 measures of Article 21(2), each to the ISO/IEC 27001 clauses and Annex A controls whose records evidence it: 73 controls and 14 clauses in total, StandardOS's reading, downloadable as a CSV below.
- What does not
- 6 places where the Implementing Regulation asks for something no ISO 27001 record produces, listed further down; and the Directive's own duties, the registration, the management body's training and the incident clocks, which sit beside the ISMS, not inside it.
The ten measures of Article 21(2), mapped
One row per point of the Directive: the measure in plain words, the Directive's own text, and the ISO/IEC 27001 clauses and Annex A controls whose records evidence it. Essential and important entities alike.
| Point | Measure | Clauses | Annex A controls |
|---|---|---|---|
| 21(2)(a) | Have a risk analysis and security policypolicies on risk analysis and information system security | Clause 5.1Clause 5.2Clause 5.3Clause 6.1.2Clause 6.1.3Clause 8.2Clause 8.3 | A.5.1A.5.2A.5.3A.5.4A.5.7A.5.36A.5.35 |
| 21(2)(b) | Handle incidents by a written procedureincident handling | A.5.24A.5.5A.8.15A.8.16A.8.17A.6.8A.5.25A.5.26A.5.28A.5.27 | |
| 21(2)(c) | Keep backups, a recovery plan and crisis managementbusiness continuity, such as backup management and disaster recovery, and crisis management | A.5.29A.5.30A.8.13A.8.14A.5.5A.5.7A.7.11A.7.12 | |
| 21(2)(d) | Secure your supply chain and direct supplierssupply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers | A.5.19A.5.20A.5.21A.5.22A.5.23 | |
| 21(2)(e) | Build, buy and maintain systems securely, vulnerabilities handledsecurity in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure | A.8.26A.5.21A.8.25A.8.27A.8.28A.8.29A.8.30A.8.31A.8.33A.8.9A.8.32A.8.8A.8.19A.8.20A.8.21A.8.22A.8.7A.5.7A.7.5A.7.8 | |
| 21(2)(f) | Assess whether your security measures workpolicies and procedures to assess the effectiveness of cybersecurity risk-management measures | Clause 9.1Clause 9.2Clause 9.3Clause 10.1Clause 10.2 | |
| 21(2)(g) | Practise basic cyber hygiene and train everyonebasic cyber hygiene practices and cybersecurity training | Clause 7.3Clause 7.2 | A.6.3 |
| 21(2)(h) | Have a policy on cryptography and encryptionpolicies and procedures regarding the use of cryptography and, where appropriate, encryption | A.8.24 | |
| 21(2)(i) | Manage people security, access control and assetshuman resources security, access control policies and asset management | A.6.2A.5.4A.6.1A.6.5A.6.6A.6.4A.5.15A.5.18A.5.3A.8.3A.8.2A.8.5A.8.18A.5.16A.5.17A.5.12A.5.10A.5.14A.7.14A.8.10A.7.10A.8.7A.5.9A.5.11A.7.1A.7.2A.7.3A.7.4 | |
| 21(2)(j) | Use multi-factor authentication and secured communicationsthe use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate | A.5.17A.8.5 |
The mapping is StandardOS's reading of which records evidence which measure; NIS2 names no standard and grants no presumption of conformity, and the Implementing Regulation's sections below add the detail the Directive leaves open.
Two different instruments, and only one of them is portable
The controls are a Regulation. Implementing Regulation (EU) 2024/2690 applies directly in all 27 member states: the same text, no national version. Everything around them is a Directive. Registration, which authority supervises you, the filing portal and the penalties all come from 27 separate national laws that differ in substance. This page covers the first and deliberately says nothing about the second.
The national laws themselves, as each state communicated them to the Commission, are on their own page: NIS2 transposition by member state.
Recital 3 of the Regulation is explicit about where its requirements come from. They are “based on European and international standards, such as ISO/IEC 27001, ISO/IEC 27002 and ETSI EN 319401”. That is what makes a crosswalk possible rather than approximate.
The Annex, section by section
1. Policy on the security of network and information systems
Art. 21(2)(a) NIS2
Satisfied by
- 1.1Policy on the security of network and information systems Clause 5.1Clause 5.2A.5.1
- 1.2Roles, responsibilities and authorities Clause 5.3A.5.2A.5.3A.5.4
Not covered by ISO 27001: The floors. 1.1.2 has the management bodies review the policy at least annually, and 1.2.3 requires at least one person who reports directly to the management bodies on network and information security. ISO 27001 has top management review at planned intervals and names no such reporting line.
2. Risk management policy
Art. 21(2)(a) NIS2
Satisfied by
- 2.1Risk management framework Clause 6.1.2Clause 6.1.3Clause 8.2Clause 8.3A.5.7
- 2.2Compliance monitoring A.5.36
- 2.3Independent review of information and network security A.5.35
Not covered by ISO 27001: The annual floor. 2.1.4 requires the risk assessment results and the risk treatment plan to be reviewed at planned intervals and at least annually. ISO 27001 sets the intervals and no floor under them.
3. Incident handling
Art. 21(2)(b) NIS2
Satisfied by
- 3.1Incident handling policy A.5.24A.5.5
- 3.2Monitoring and logging A.8.15A.8.16A.8.17
- 3.3Event reporting A.6.8
- 3.4Event assessment and classification A.5.25
- 3.5Incident response A.5.26A.5.5A.5.28
- 3.6Post-incident reviews A.5.27
Not covered by ISO 27001: The statutory clock. ISO 27001 requires an incident process; it does not require a 24-hour early warning, a 72-hour notification, dual filing to a CSIRT and a competent authority, or a significance test. IR Arts. 3–14 make those mechanical and EU-uniform. Art. 3(1)(a) is €500,000 or 5% of turnover, whichever is lower, and none of it falls out of an ISMS by itself. And the logs: 3.2.5 keeps logs and backs them up for a predefined period, protected from unauthorised access or change. A.8.15 asks for logging; it does not require the logs themselves to be backed up for a set period.
4. Business continuity and crisis management
Art. 21(2)(c) NIS2
Satisfied by
5. Supply chain security
Art. 21(2)(d) NIS2
Satisfied by
6. Security in network and information systems acquisition, development and maintenance
Art. 21(2)(e) NIS2
Satisfied by
- 6.1Security in acquisition of ICT services or ICT products A.8.26A.5.21
- 6.2Secure development life cycle A.8.25A.8.26A.8.27A.8.28A.8.29A.8.30A.8.31A.8.33
- 6.3Configuration management A.8.9
- 6.4Change management, repairs and maintenance A.8.32
- 6.5Security testing A.8.29A.8.8
- 6.6Security patch management A.8.8A.8.19A.8.32
- 6.7Network security A.8.20A.8.21
- 6.8Network segmentation A.8.22A.8.31
- 6.9Protection against malicious and unauthorised software A.8.7
- 6.10Vulnerability handling and disclosure A.8.8A.5.7
7. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
Art. 21(2)(f) NIS2
Satisfied by
- 7.1(untitled point: the section's requirement itself) Clause 9.1Clause 9.2Clause 9.3
- 7.2(untitled point: the section's requirement itself) Clause 9.1
- 7.3(untitled point: the section's requirement itself) Clause 10.1Clause 10.2
8. Basic cyber hygiene practices and security training
Art. 21(2)(g) NIS2
Satisfied by
- 8.1Awareness raising and basic cyber hygiene practices Clause 7.3A.6.3
- 8.2Security training Clause 7.2A.6.3
Not covered by ISO 27001: Training the management body. Art. 20(2) NIS2 requires members of the management body themselves to follow training, and Art. 20(1) makes them personally liable for approving and overseeing the measures. ISO 27001 asks for leadership commitment and competence; it does not put the board in the training register or attach liability to the signature.
9. Cryptography
Art. 21(2)(h) NIS2
Satisfied by
10. Human resources security
Art. 21(2)(i) NIS2
Satisfied by
- 10.1Human resources security A.6.2A.5.4A.6.1
- 10.2Verification of background A.6.1
- 10.3Termination or change of employment procedures A.6.5A.6.6
- 10.4Disciplinary process A.6.4
Not covered by ISO 27001: The annual floor. 10.1.3 has the entity review its human resources security, including the resources it commits to it, at planned intervals and at least annually. ISO 27001 sets the intervals and no floor under them.
11. Access control
Art. 21(2)(i, j) NIS2
Satisfied by
- 11.1Access control policy (i)A.5.15
- 11.2Management of access rights (i)A.5.18A.5.3A.8.3
- 11.3Privileged accounts and system administration accounts (i)A.8.2A.8.5
- 11.4Administration systems (i)A.8.18A.8.2
- 11.5Identification (i)A.5.16
- 11.6Authentication (i)A.5.17A.8.5
- 11.7Multi-factor authentication (j)A.5.17A.8.5
Not covered by ISO 27001: Multiple factors. 11.3.2 requires strong identification and authentication such as multi-factor authentication for privileged and system administration accounts, 11.7 requires users to be authenticated by multiple factors or continuous authentication, and 11.6.2(e) terminates inactive sessions after a predefined period. A.8.5 asks for secure authentication and names none of the three.
12. Asset management
Art. 21(2)(i) NIS2
Satisfied by
Where an ISMS stops, in 6 places
Everything else in that Annex falls out of a conforming ISO 27001 management system. These do not, and no amount of ISO conformity produces them:
1. Policy on the security of network and information systems
The floors. 1.1.2 has the management bodies review the policy at least annually, and 1.2.3 requires at least one person who reports directly to the management bodies on network and information security. ISO 27001 has top management review at planned intervals and names no such reporting line.
2. Risk management policy
The annual floor. 2.1.4 requires the risk assessment results and the risk treatment plan to be reviewed at planned intervals and at least annually. ISO 27001 sets the intervals and no floor under them.
3. Incident handling
The statutory clock. ISO 27001 requires an incident process; it does not require a 24-hour early warning, a 72-hour notification, dual filing to a CSIRT and a competent authority, or a significance test. IR Arts. 3–14 make those mechanical and EU-uniform. Art. 3(1)(a) is €500,000 or 5% of turnover, whichever is lower, and none of it falls out of an ISMS by itself. And the logs: 3.2.5 keeps logs and backs them up for a predefined period, protected from unauthorised access or change. A.8.15 asks for logging; it does not require the logs themselves to be backed up for a set period.
8. Basic cyber hygiene practices and security training
Training the management body. Art. 20(2) NIS2 requires members of the management body themselves to follow training, and Art. 20(1) makes them personally liable for approving and overseeing the measures. ISO 27001 asks for leadership commitment and competence; it does not put the board in the training register or attach liability to the signature.
10. Human resources security
The annual floor. 10.1.3 has the entity review its human resources security, including the resources it commits to it, at planned intervals and at least annually. ISO 27001 sets the intervals and no floor under them.
11. Access control
Multiple factors. 11.3.2 requires strong identification and authentication such as multi-factor authentication for privileged and system administration accounts, 11.7 requires users to be authenticated by multiple factors or continuous authentication, and 11.6.2(e) terminates inactive sessions after a predefined period. A.8.5 asks for secure authentication and names none of the three.
What this page is not
It is not a coverage score. A single percentage for how much of NIS2 ISO 27001 covers gets quoted in a lot of places. Every version of it is a structural judgement rather than a measurement, and we are not going to repeat a number we cannot show the working for. ENISA published a machine-readable crosswalk in its Technical Implementation Guidance (v1.0, June 2025); the mapping above is ours, from the two documents, and you should check it against theirs rather than trust either of us.
It is not a NIS2 product. StandardOS does not register you with a national authority, does not file your incident reports, and does not track 27 national transpositions. If you need those, you need something else, and the honest version of our position is that the control set is the part worth building once, because it is the only part that is the same everywhere.
It is not a scope determination. NIS2 binds essential and important entities above the size thresholds in Article 2. Below roughly 50 people and €10m you are very likely outside it entirely, with sector exceptions. That determination is yours to make and record, and we will not make it for you on a marketing page.
The questions people ask
- Is ISO 27001 enough for NIS2?
- For the technical measures, most of the way: the ten measures of Article 21(2) map to 73 Annex A controls and 14 clauses of a conforming ISO/IEC 27001 system, and the Implementing Regulation was written from the same vocabulary. Not all the way: 6 places in the Implementing Regulation ask for records no ISMS produces, and the registration, the management body's approval and training, and the 24-hour and 72-hour incident clocks are duties of the Directive outside the standard.
- NIS2 vs ISO 27001: what is the difference?
- NIS2 is law: a Directive transposed by each member state, with a supervisor, registration, incident reporting clocks and fines, binding on the entity types it lists. ISO/IEC 27001 is a standard a company chooses and a certification body audits. The one reads like the other because the Implementing Regulation borrowed the standard's structure, so the ISMS is the shortest route to the technical half of NIS2, and the Directive's duties are the other half.
- Does NIS2 require ISO 27001 certification?
- No. The Directive names no standard and no member state's transposition makes certification a condition; Article 25 says member states shall encourage the use of European and international standards. A certificate is evidence a supervisor and a customer accept quickly, not a requirement.
- Which ISO 27001 controls cover NIS2 incident handling?
- Article 21(2)(b), incident handling, maps to the Annex A controls on incident management planning, event assessment, response, learning and evidence, with the clauses on operational planning and monitoring; the reporting clocks of Article 23 are the Directive's own and run beside the standard, which is why the incident clock page exists.
Further reading
The ten measures of NIS2 Article 21(2), as a checklist: each point quoted, the Regulation sections behind it, and the ISO 27001 controls that already produce it
Article 21(2) lists ten measures every essential and important entity must take, from risk analysis policies to multi-factor authentication.
NIS2 Article 20 for the board: what the management body must approve, oversee and learn, the twelve places the Implementing Regulation names it, and what liability means
Article 20 of NIS2 makes the management body of an essential or important entity approve the cybersecurity risk-management measures, oversee their implementation, be liable for the entity's infringements of Article 21, and follow training.
NIS2 for a SaaS company: you are a cloud computing service provider, and this is what follows
Recital 33 of the Directive names Software as a Service as a cloud service model, so a SaaS company of medium size or larger is an entity of NIS2 as a cloud computing service provider: important below the medium ceilings, essential above them.
NIS2 for managed service providers and MSSPs: an Annex I entity by definition, and the supplier every customer's due diligence lands on
Article 6(39) makes anyone who installs, manages, operates or maintains ICT for customers, on site or remotely, a managed service provider, and Article 6(40) makes the ones who help with cybersecurity risk management MSSPs.
NIS2 or CRA: which incident clock runs for a software company, and what makes an incident 'significant'
Both laws give you 24 hours, 72 hours and a month, and both start the clock when you 'become aware'.
ISO 27001 vs NIS2: what the certificate covers and what it does not
NIS2 is law and ISO 27001 is a certifiable standard, so they are not alternatives.
NIS2 transposition, state by state: what the Commission's own register shows
Not a law firm's tracker: the national measures the member states have communicated to the Commission as transposing Directive (EU) 2022/2555, read from the Publications Office on 12 September 2026. 25 of the 27 states have communicated at least one, 303 measures in all; Spain and Ireland none; France 15 texts, none of them naming NIS2.
CRA or NIS2: which one applies to a software company, and can it be both?
The Cyber Resilience Act regulates products placed on the market; NIS2 regulates entities that provide services.
Which EU countries name ISO 27001 in public tenders: 1,548 German notices, 829 Polish, and Greece has the highest share
Over 365 days, ISO 27001 appears in 3,415 TED notices.
The overlap is the point
If a customer's questionnaire is really asking whether you manage security the way the Regulation describes, an ISO 27001 ISMS is the answer to eleven of these thirteen sections. StandardOS builds that ISMS: the Statement of Applicability, the risk register and the evidence trail. The export is organised by Annex A reference, which is the same vocabulary the table above uses.
Section titles are quoted from the Annex to Implementing Regulation (EU) 2024/2690 as published on EUR-Lex, read on 10 August 2026. The mapping to ISO/IEC 27001 is our own and is not ENISA's. This is not legal advice, and the Regulation is short enough to read yourself: Implementing Regulation (EU) 2024/2690.