This is one of the most common questions we hear from companies that already hold an ISO 27001 certificate: “If we are certified, are we automatically NIS2 compliant?”
Short answer: not automatically, but you are well ahead of the rest. ISO 27001 covers much of what the NIS2 Directive and the new Law on Information Security (Official Gazette of RS, No. 91/2025) require, but there are specific obligations the standard does not prescribe. Below we explain what you already have and what you need to add.
Note: if you want to know whether ISO 27001 is mandatory, we covered that in Is ISO 27001 mandatory for NIS2 compliance? Here we address a different question: if you already have it, is it sufficient?
What ISO 27001 Already Covers
NIS2 (Article 21) and the new law are built on the same principle as ISO 27001: risk management. If you have a working information security management system (ISMS), you already have:
- a risk assessment and treatment methodology,
- information security policies,
- incident management,
- access control and account management,
- supplier security,
- business continuity and backups,
- employee training and awareness,
- internal audits and management review.
Many of the measures in Article 21 of NIS2 have a counterpart in the Annex A controls of ISO 27001:2022. That makes ISO 27001 the best possible starting point.
Where ISO 27001 Falls Short
1. Scope of the Certificate
An ISO 27001 certificate applies only to the scope you have defined yourself, for example one data centre or one process. NIS2 and the law apply to the organisation as a whole, that is, to all ICT systems supporting the service that brings you under the law. If your ISMS is narrow, obligations outside it remain uncovered.
2. Incident Reporting Deadlines
ISO 27001 requires you to manage incidents, but does not prescribe to whom or by when you must report them. NIS2 introduces strict deadlines: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month. The new Serbian law also provides for a 24-hour deadline for notifying the competent authorities. Your incident procedure must include these deadlines, contacts and criteria for assessing whether an incident is significant.
3. Personal Liability of Management
ISO 27001 asks for “leadership commitment”, but NIS2 goes further: management bodies must approve risk management measures, oversee their implementation and undergo cybersecurity training, and they can also be held personally liable for failures. This is an obligation that a certificate does not prove on its own.
4. Measures That Are Not Optional
In ISO 27001 you select controls based on a risk assessment, and you can exclude some through the Statement of Applicability (SoA). NIS2 explicitly names certain measures, such as multi-factor authentication, cryptography, supply chain security and vulnerability management. If you have excluded any of these, you must reinstate it.
5. National Documentation and Categorisation
The new law divides operators into priority and important operators and prescribes its own mandatory documents, above all the ICT system security document and the risk assessment document. ISO documentation can be used as a basis, but it must be aligned with the form and content required by the law and implementing regulations.
6. Oversight
ISO 27001 is audited by a certification body of your own choosing. Compliance with the law is overseen by the state, which has the power to impose measures and penalties. A certificate is good evidence of good practice, but it is no substitute for legal compliance.
Comparison at a Glance
| Area | ISO 27001 | NIS2 / Law |
|---|---|---|
| Risk management | Yes | Yes |
| Scope | You define it | Entire organisation / service |
| Incident reporting | Internal process | Statutory deadlines (first notification within 24h) |
| Management responsibility | Leadership commitment | Approval of measures, oversight, training, personal liability |
| Mandatory measures (MFA, supply chain) | Based on risk assessment | Prescribed |
| Oversight | Certification body | State |
What to Do If You Already Have ISO 27001
- Check whether the law applies to you and which category you fall into. See our guide Who is covered by the NIS2 Directive?
- Carry out a gap analysis: compare your existing ISMS with the requirements of the law and NIS2.
- Extend the scope of your ISMS if it does not cover all relevant systems.
- Add deadlines, contacts and significance criteria to your incident procedure.
- Organise training for management and document that management has approved the measures.
- Prepare the documents required by national law, using your existing ISO documentation as a basis.
Companies with ISO 27001 usually reach compliance much faster and at lower cost than those starting from scratch, because most of the work has already been done.
Frequently Asked Questions
Does an ISO 27001 certificate make us automatically NIS2 compliant?
No. The certificate shows you have a good information security management system, but the law has additional obligations the standard does not cover: incident reporting deadlines, management responsibility and national documentation.
Do we have to be ISO 27001 certified to comply with the law?
No. The law does not require a certificate, but rather the implementation of the prescribed measures. Even so, ISO 27001 is the most practical way to organise and demonstrate those measures. Read more in Is ISO 27001 mandatory for NIS2 compliance?
How long does compliance take if we already have ISO 27001?
It depends on the scope and size of the organisation, but it usually takes weeks or a few months rather than being a multi-year project.
Do you have ISO 27001 and are unsure how far you are from compliance? Contact us for a gap analysis and we will tell you exactly what needs to be added.