Published: 6 August 2026.
Many people search for “NIS2 standard” — but that is a common misunderstanding. Short answer: NIS2 is not a standard but a European directive and, in Serbia, a law. It does not prescribe mandatory application of, or certification against, ISO 27001 or any other standard. Here is what the law actually requires, and why ISO 27001 is nevertheless most often used in practice as a practical route to compliance.
What NIS2 Prescribes
NIS2 prescribes security objectives that an organisation must meet, for example:
- Risk management
- Incident management
- Business continuity
- Supply chain security
- Access control
- Asset management
- Cryptography
- Employee training
Why ISO 27001 Is Nevertheless Most Often Used
In practice, most organisations use ISO/IEC 27001 as the basis for compliance, because the standard covers much of what NIS2 requires. Rather than the organisation having to work out for itself how to meet the legal objectives, ISO 27001 provides a ready-made, tested framework that already does so.
NIS2 is also most often linked to ISO/IEC 27002, the NIST Cybersecurity Framework and IEC 62443, but none of them is legally prescribed as mandatory.
The Simplest Explanation
NIS2 is not a standard but a law. ISO 27001 is not a law but a standard that helps meet the requirements of that law.
If you are considering ISO 27001 implementation as a route to NIS2 compliance, see our Services page or request a free consultation.