Two Projects, One Problem
Have you received a NIS2 compliance notice while already running an ISO 27001 project? Or the other way around?
In either case, there's a good chance your teams — or your consultants — are handling these two topics in separate meetings, with separate budgets, and deliverables that never talk to each other.
That's understandable: NIS2 comes from the regulator, ISO 27001 comes from the certification body, and the two appear to follow entirely different logics.
But this siloed approach is costing you time, money, and peace of mind. It doesn't have to be this way.
What NIS2 Actually Requires
The NIS2 Directive, transposed into Belgian, Luxembourg, and French legislation since late 2024, imposes concrete obligations on essential and important entities across strategic sectors: energy, healthcare, finance, digital infrastructure, transport, and many others.
In operational terms, this translates into five major areas:
- a formalised cyber risk management process,
- incident reporting within strict deadlines (initial notification within 24 hours, full report within 72 hours),
- active security of the supply chain,
- explicit board-level accountability for measures taken,
- and a baseline of minimum technical controls (multi-factor authentication, encryption, continuity testing).
What sets NIS2 apart from a voluntary certification: it is a legal obligation, backed by sanctions that can reach €10 million or 2% of global turnover for essential entities. Senior executives can be held personally liable in cases of serious non-compliance. Ignoring NIS2 is simply not an option.
Learn more about senior executives' responsibility in our last article.
What ISO 27001 Already Delivers
ISO 27001 is the international reference standard for information security management.
It requires organisations to build an Information Security Management System (ISMS):
- a formalised risk assessment,
- a documented risk treatment process,
- and a set of controls drawn from Annex A — over 90 measures covering physical security, access management, cryptography, incident response, and business continuity. Regular management reviews close the loop.
For an organisation that is ISO 27001 certified, or actively pursuing certification, the reality is this: it has already built between 60 and 70% of what NIS2 requires.
The problem? It hasn't always framed this under the NIS2 lens, and doesn't systematically know where to point when supervisory authorities come knocking.
The Overlap Map
The two frameworks overlap substantially across seven key domains:
- Risk management: ISO 27001 clause 6.1, which mandates risk assessment and treatment, directly addresses the requirements of NIS2 Article 21 on cyber risk management.
- Incident management: Controls A.5.24 to A.5.26 (detection, response, lessons learned) form the operational backbone of the NIS2 24h/72h notification obligation.
- Business continuity: Controls A.5.29 and A.5.30 cover the operational resilience that NIS2 makes mandatory for critical entities.
- Supplier security: Controls A.5.19 to A.5.22 on supplier relationships directly address NIS2's supply chain security requirements.
- Access control: Controls A.5.15 to A.5.18 lay the groundwork for the enhanced authentication and privilege management required by NIS2.
- Awareness and training: Control A.6.3 and NIS2 Article 20 share the same logic: training staff and leadership on cybersecurity is a requirement, not an option.
- Documentation and traceability: ISO 27001 clause 7.5 mandates control of documented information — these are precisely the audit trails that NIS2 supervisory authorities will request during an inspection.
The conclusion is straightforward: running both frameworks in parallel without capitalising on these overlaps means literally paying twice for the same work.
The 3 Real Points of Divergence
To be fair: NIS2 is not simply a regulatory repackaging of ISO 27001.
Three genuine divergences deserve specific attention.
First, personal liability of executives:
NIS2 is explicitly stricter than ISO 27001 on this point. Members of senior management can be sanctioned individually if they have not actively supervised the implementation of required measures.
Second, scope of application:
ISO 27001 is a voluntary framework, with a scope chosen by the organisation itself. NIS2 applies to any entity meeting the sector and size criteria, regardless of its willingness to participate.
Third, mandatory reporting to national authorities :
ANSSI in France, the CCN in Luxembourg, the CCB in Belgium, with constrained deadlines and specific formats. This is an operational obligation with no direct equivalent in ISO 27001.
These divergences are real. But they represent 30 to 40% of the journey not 100%. Treating both frameworks as entirely separate projects means misunderstanding where the real value of your investment lies.
The Unified GRC Approach: One Foundation, Two Frameworks
The logical response to this reality is a centralised GRC (Governance, Risk, Compliance) approach:
- a single control library,
- mapped simultaneously against ISO 27001 and NIS2,
- with shared workflows for risk management,
- incident handling,
- and audit preparation.
This is precisely the philosophy behind Prism Technology's GRC solution: built natively on Odoo, it integrates directly into your information system without additional middleware.
Risk treatment plans, incident registers, security policies, and audit evidence are all managed within a single environment. One internal audit covers both frameworks.
The estimated reduction in compliance workload sits between 40 and 60% compared to a siloed approach... measured in staff time, external consulting fees, and operational friction.
The Right Question to Ask
The question is no longer "ISO 27001 or NIS2?" but "how do we manage them together, sustainably?" Organisations that answer this question today will be the ones that turn compliance into a competitive advantage : a demonstrable ability to reassure clients, partners, and regulators with the same evidence, produced once.
Prism Technology helps you map your gaps, identify what you already have in place, and build a unified compliance programme tailored to your sector and size.