NIS2 and ISO 27001: what do you need to know?

Europe takes cybersecurity seriously. The NIS2 Directive  requires thousands of organisations to get their information security in order. The NCSC  (Netherlands National Cyber Security Centre) provides current information on the Dutch implementation. ISO 27001  helps you meet the requirements.

What is NIS2?

NIS2 stands for Network and Information Security Directive 2. It succeeds the original NIS Directive from 2016 and sets stricter cybersecurity requirements for “essential” and “important” entities in the EU.

The European Union adopted the directive. In the Netherlands it is implemented in the Cyberbeveiligingswet (Cbw, Dutch Cybersecurity Act). Sector regulators and the NCSC  enforce the Act.

The Cyberbeveiligingswet (Cbw)

The Cyberbeveiligingswet is the Dutch version of NIS2. The House of Representatives adopted the bill on 15 April 2026. The Senate approved it on 7 July 2026, and the Act has applied since 15 August 2026. That means the duty of care (zorgplicht), the notification duty (meldplicht) and the registration duty (registratieplicht) apply now. If you have not started yet, begin by asking whether the Act applies to you. Follow the current status via the NCSC  and the Dutch government .

Why NIS2?

The digital threat is growing. Ransomware shuts down hospitals, and supply chain attacks hit thousands of companies at once. The old NIS Directive was too limited. NIS2 greatly expands the scope: more sectors, more organisations, stricter requirements and higher fines.

Does NIS2 apply to you?

NIS2 distinguishes two categories: essential entities and important entities. The requirements are largely the same, but the supervision differs.

Essential entities

These are organisations in critical sectors that meet certain size criteria:

Sectors:

• Energy (electricity, gas, oil, hydrogen)
• Transport (air, rail, water, road)
• Banking
• Financial market infrastructure
• Healthcare
• Drinking water
• Waste water
• Digital infrastructure (DNS, data centres, cloud providers)
• ICT service providers (MSPs, MSSPs)
• Government
• Space

Size:

• Large enterprises (250+ employees or more than €50M turnover and more than €43M balance sheet total)
• Or designated by the government because of a critical role

Important entities

These are organisations in additional sectors, or smaller organisations in essential sectors:

Additional sectors:

• Postal and courier services
• Waste management
• Chemicals
• Food
• Manufacturing (medical devices, electronics, machinery, vehicles)
• Digital providers (online marketplaces, search engines, social networks)
• Research

Size:

• Medium-sized enterprises (50 to 250 employees or €10 to €50M turnover)
• Large enterprises in the additional sectors

What does NIS2 require?

The directive sets requirements in three areas: risk management, incident reporting and governance.

1. Risk management measures

Organisations must take “appropriate and proportionate technical, operational and organisational measures”. The directive specifically mentions:

• Policy for risk analysis and information security
• Incident handling: detection, response and recovery
• Business continuity: backups, disaster recovery and crisis management
• Supply chain security: security of suppliers and service providers
• Security in procurement: security in acquiring and developing systems
• Effectiveness assessment: measuring whether measures work
• Cyber hygiene and training: basic practices and awareness
• Cryptography: policy for encryption
• Access control: HR security and identity management
• Multi-factor authentication: strong authentication where appropriate

2. Incident reporting

Significant incidents must be reported to the supervisory authority:

An incident is “significant” if it:

• Causes serious operational disruption or financial loss
• Can cause considerable damage to other people or organisations

3. Governance and accountability

The board of directors is responsible for cybersecurity. NIS2 states this explicitly:

• The board must approve cybersecurity measures
• The board must oversee implementation
• The board is liable if the rules are not met
• Board members must complete cybersecurity training

How does ISO 27001 help?

ISO 27001 is not mandatory under NIS2, but it is an excellent way to meet the requirements. What NIS2 asks for and what ISO 27001 offers overlap considerably.

NIS2 duty of care linked to ISO 27001

The table links each duty of care in NIS2 to the matching clause or Annex A control in ISO 27001. This shows at a glance how far the standard takes you.

What ISO 27001 adds

ISO 27001 goes further than the minimum NIS2 requirements:

• A systematic approach through the ISMS
• Continual improvement built into the system
• External validation by an accredited auditor
• International recognition that has value beyond the NIS2 context

What ISO 27001 does not cover

There are aspects of NIS2 that ISO 27001 does not address explicitly:

• Reporting incidents to the supervisory authority: ISO 27001 requires incident logging, but not notification to external parties
• Specific reporting deadlines: the 24/72-hour deadlines are specific to NIS2
• Sector-specific requirements: some sectors have additional requirements

So you need ISO 27001 plus additional processes for full NIS2 compliance. How to build the reporting deadlines into your incident procedure is covered on a separate page. Government organisations fill in the duty of care with the BIO2; see BIO2 and ISO 27001.

Practical approach: NIS2 and ISO 27001

If you have nothing in place yet

1. Check whether you fall under NIS2 using the NCSC tool 
2. Start with a baseline measurement and gap analysis: where do you stand now?
3. Implement ISO 27001: this gives you the foundation
4. Add NIS2-specific processes: especially incident reporting
5. Train your board: they are responsible

If you already have ISO 27001

You have a head start. Focus on:

1. Incident reporting process: can you report within 24 hours?
2. Supply chain review: do you have visibility of your suppliers?
3. Board involvement: is the board demonstrably involved?
4. Documentation: can you show that you comply?

Timeline

NIS2 fines and enforcement

NIS2 introduces substantial fines:

In addition, supervisory authorities can:

• Issue warnings and orders
• Impose binding instructions
• Temporarily suspend board members
• Halt activities

Enforcement lies with the sector regulators: DNB (De Nederlandsche Bank, the Dutch central bank) for financial institutions, Agentschap Telecom (Telecom Agency) for telecom, NVWA (Nederlandse Voedsel- en Warenautoriteit, the Netherlands Food and Consumer Product Safety Authority) for food, and so on.

Frequently asked questions about NIS2 and ISO 27001

Is ISO 27001 enough for NIS2?

Largely, but not completely. You need additional processes for incident reporting and possibly sector-specific requirements.

Do I need to be certified?

NIS2 does not require certification. But an ISO 27001 certificate is the strongest proof that your information security is in order. In an audit by the supervisory authority, it is a major advantage.

Does NIS2 also apply to SMEs?

Yes, if you work in one of the sectors and meet the size criteria (50 or more employees, or more than €10 million turnover). Small companies (fewer than 50 employees) usually do not fall under it, unless they play a critical role.

What if I am a supplier to a NIS2 organisation?

NIS2 requires organisations to secure their supply chain. Your clients will set requirements for you. NIS2-covered organisations increasingly ask their suppliers for ISO 27001 certification.

How does NIS2 relate to the GDPR (AVG in Dutch)?

Both are EU legislation, but with different focuses. The AVG protects personal data; NIS2 protects network and information systems. The two overlap on data breaches: a cyber incident involving personal data must be reported under both the AVG and NIS2.

More information

• What is ISO 27001?: introduction to the standard
• The ISMS: the management system explained
• Annex A controls: the 93 controls
• GDPR and ISO 27001: how ISO 27001 supports GDPR accountability
• ISO 42001: the standard for AI management systems, relevant if your organisation uses AI
• NCSC NIS2 information : official government information
• European NIS2 text : the full directive
• Digital Trust Center : help for SMEs