ISO 22301 and NIS2
The NIS2 Directive requires organisations in critical sectors to demonstrate risk management, including business continuity. ISO 22301 provides an international standard for business continuity management (BCMS) for this purpose. In the Netherlands, NIS2 is implemented through the Cyberbeveiligingswet (Dutch Cybersecurity Act), which has been in force since 15 August 2026 (Rijksoverheid ). More about the Dutch implementation is on Digitale Overheid (the Dutch government’s digital government portal).
For IT companies and SaaS providers, the overlap with ISO 22301 for IT companies is directly relevant: organisations in the technology sector that fall under NIS2 must show that they keep functioning during serious disruptions.
NIS2 does not require an ISO 22301 certificate. But the standard offers a proven structure for meeting the NIS2 duty of care for business continuity. Certification makes it easier to demonstrate compliance.
Which organisations fall under NIS2?
NIS2 applies to organisations that provide essential or important services. The directive distinguishes two categories:
| Category | Description | Examples |
|---|---|---|
| Essential entities | Large organisations in critical sectors | Energy companies, banks, hospitals, telecoms, water |
| Important entities | Medium-sized organisations in critical sectors | IT service providers, digital infrastructure, government suppliers |
The thresholds are indicative: organisations with more than 50 employees or an annual turnover above €10 million may fall under NIS2 if they are active in one of the designated sectors. Check on NCSC.nl (the Dutch National Cyber Security Centre) whether your organisation is in scope.
The NIS2 duty of care: ten measures
Article 21 of the NIS2 Directive describes ten mandatory measures. Below you can see which of them relate directly to business continuity and how ISO 22301 connects to them.
| NIS2 measure (art. 21) | Relevance for BCM | ISO 22301 link |
|---|---|---|
| Risk analysis and ICT security policy | Determines scope and threats | Context and risk analysis (ch. 6) |
| Business continuity, backup management and crisis management | Direct BCM requirement | Core of ISO 22301 |
| Security of the supply chain | Supplier continuity | Continuity strategy (ch. 8) |
| Incident handling | Crisis response and escalation | Crisis organisation, plans (ch. 8) |
| Performance measurement and supervision | Demonstrable operation | Performance evaluation (ch. 9) |
The measure “business continuity, backup management and crisis management” appears word for word in the directive. The NCSC describes the concrete requirements as:
- a backup strategy with a described frequency, storage location and test status;
- documented RTO and RPO for each critical process;
- a recovery plan that also works if systems or locations are lost;
- a crisis organisation that functions outside exercise rounds;
- regular tests of plans (the test counts, not the existence of the plan).
These are exactly the elements that ISO 22301 structures and that an auditor checks.
How ISO 22301 helps with NIS2 compliance
ISO 22301 is not a requirement for NIS2 compliance, but it offers three concrete benefits:
Demonstrability
Demonstrability to supervisory authorities
NIS2 requires organisations to prove that their measures work. An ISO 22301 certificate gives supervisory authorities recognisable, independent evidence. You need to justify less yourself: the accreditation speaks for itself.
NIS2 and the relationship with ISO 27001
Many NIS2-regulated organisations already have ISO 27001 or are working towards that certificate. ISO 27001 covers information security, but does not fully cover the broader BCM requirement of NIS2.
| Aspect | ISO 27001 | ISO 22301 | NIS2 requirement covered? |
|---|---|---|---|
| Information security risks | Yes (fully) | Partly | With 27001: yes |
| Backup management and recovery | Partly (Annex A) | Fully | With both: yes |
| Crisis management and crisis organisation | Limited | Fully | With 22301: yes |
| Exercises and testing | Limited | Required and detailed | With 22301: yes |
| Supplier continuity | Partly | Fully | With both: yes |
If you already have ISO 27001, ISO 22301 builds further on that foundation. The combination provides the most complete coverage of the NIS2 duty of care. You can read more about this combination on ISO 22301 vs. ISO 27001.
Practical: NIS2 and BCM step by step
Organisations that are now starting NIS2 preparation and BCM can combine the two projects:
- Scope: determine which services fall under NIS2 and which processes are critical.
- BIA: carry out a business impact analysis for each critical process.
- Backup strategy: document frequency, storage location and test status per system.
- Crisis organisation: assign roles, substitutes and an escalation path.
- Recovery plan: write a business continuity plan that also works when a location or system is lost.
- Exercising: plan at least one tabletop exercise and one technical test per year.
- Certification (optional): if supervisors or customers ask for external verification, consider ISO 22301 certification.
The Cyberbeveiligingswet also introduces a duty to report significant incidents to supervisory authorities. Make sure your crisis plans include a reporting procedure.