The benchmark for German entities is the current BSIG, generally applicable since 6 December 2025. The ISO edition considered here is ISO/IEC 27001:2022, third edition, with the published amendment Amd 1:2024. This comparison draws on publicly accessible original ISO information and the structure of statutory duties; it is not a complete mapping of individual ISO requirements. ISO: standard overview, ISO: Amd 1:2024, BSIG.
Keep four things separate
The law determines which entity must fulfil which duties. A management system organises the approach to information security. Certification examines conformity with the specified standard within its defined scope. A technical measure protects a particular function or addresses a particular risk. None of these levels can be fully replaced by another.
ISO/IEC 27001 describes requirements for an information security management system, or ISMS. An organisation can use such a system without holding a certificate itself. Certificates are issued by external certification bodies, not by ISO itself. Accreditation of a certification body and an organisation’s certificate are also different things. ISO: ISO/IEC 27001, ISO: Certification.
On narrow screens, scroll the table sideways.
| Question | NIS2 / German BSIG | ISO 27001 / certification |
|---|---|---|
| Why does it apply? | Statutory scope, in particular section 28 and Annexes 1–2; not merely the sector name. | A decision to adopt the standard; additional obligations may arise from a contract or a specific rule. |
| What needs protection? | The systems, components and processes relevant to the services in scope; the statutory scope cannot simply be chosen to match the certificate. | The management system within its defined scope. Compare that scope specifically with the services covered by the law. |
| What must happen during incidents? | Statutory reporting of significant incidents under section 32, where applicable, with deadlines and a competent reporting office. | An existing incident process can help; the certificate does not prove that statutory notifications are submitted on time. |
| What must management do? | Implementation and oversight under section 38(1), and regular training for management itself under subsection (3). | Existing management processes can support decisions; the statutory duties of governing bodies remain separate. |
| Does the entity have to register? | Under section 33 if the conditions are met; additional information under section 34 for certain entity types. | A certification audit does not replace registration with an authority. |
| What consequences may follow? | Supervision and fines depending on the specific offence; liability under the applicable rules where relevant. | Identified nonconformities and consequences in the certification process are not official decisions under the BSIG. |
| What evidence is sufficient? | Evidence must match the duty actually applicable and the procedure; there is no general waiver through certification. | The certificate, its scope and underlying evidence can provide information, but no blanket legal approval. |
Legal bases: Sections 28, 30, 32, 33, 34, 38 BSIG. The BSI’s current explanation likewise rejects automatic NIS2 fulfilment solely through ISO 27001 certification. BSI: NIS2 in the context of ISO 27001.
A certificate whose scope is too narrow
A synthetic example: an undertaking operates a certified ISMS for its central administration. A newly acquired production company, its operational networks and outsourced maintenance access are not yet included. Even a valid certificate for the administration then does not establish whether the production services relevant to NIS2 are adequately protected.
Even within a suitable scope, subsequent changes matter: new suppliers, different business processes, changed access and identified deficiencies. Check the current circumstances and underlying evidence, not just the logo and expiry date on the certificate.
Ten statutory questions for your existing ISMS
Section 30(2) BSIG lists ten areas of measures. Their basic structure corresponds to Article 21(2)(a)–(j) of the Directive, but the wording is not identical throughout. The German provision governs the German duty, supplemented by more detailed requirements that take precedence. For example, point (g) of the Directive names cyber hygiene and training, whereas point 7 BSIG refers to basic training and awareness raising. Under point 8, the BSIG specifies policies and processes for cryptographic methods. Section 30 BSIG, Article 21 NIS2.
The following table is a working matrix for your gap assessment, not a claimed one-to-one mapping to ISO clauses or a certificate of fulfilment.
On narrow screens, scroll the table sideways.
| Section 30(2), second sentence | Question for the existing system | Meaningful additional evidence |
|---|---|---|
| Point 1 – risk analysis and security policies | Do the assessment and measures cover all dependencies relevant to the services within statutory scope? | Current risk analysis with decisions, measures and responsible people. |
| Point 2 – incident handling | Do detection, escalation, containment and notification to authorities work together? | A tested procedure covering the time of awareness, access to reporting channels and deputies. |
| Point 3 – operations and crisis management | Can critical services be recovered within the required limits? | A recovery test with measured results and resolved discrepancies. |
| Point 4 – supply chain | Are direct suppliers and their risks relevant to the service taken into account? | Supplier assessment, agreed requirements and verified implementation. |
| Point 5 – acquisition, development and maintenance | Are vulnerabilities and changes handled according to risk? | A specific chain of action from the finding to a verified fix. |
| Point 6 – assessment of effectiveness | Do the checks actually test the intended effect? | Suitable test methods, results and follow-up of deficiencies. |
| Point 7 – training and awareness | Does the content reach the relevant roles, and are reporting routes understood? | Training content, attendance and evaluated exercises; management competence considered separately. |
| Point 8 – cryptography | Are selection, key management and operation appropriate to protection needs? | A cryptographic policy with traceable implementation and renewal. |
| Point 9 – personnel, access and ICT management | Do actual permissions and inventories match responsibilities and needs? | Verified onboarding, role change and departure cases, and a maintained inventory. |
| Point 10 – authentication and communication | Are the required sign-in and communication paths, including emergencies, effectively protected? | Verified sign-in paths, exceptions and working crisis communication. |
For each row, record: evidenced, partly evidenced or open. Partial evidence should identify what it does not cover. For example, “TLS configuration checked” is narrower than “cryptography fully implemented”.
For certain digital services and trust services, Implementing Regulation (EU) 2024/2690 takes precedence under section 30(3). Its Annex contains further technical and methodological requirements. A general ISO comparison must not skip this specific level. Conversely, the Annex does not automatically apply in full to every entity in other sectors. Implementing Regulation, Articles 1–2 and Annex.
What to assess alongside your existing system
1. Document the reasoning on statutory scope and exceptions
Establish the legal entity, actual services, size calculation including relationships between undertakings, and relevant special rules. A certificate does not automatically make an entity outside scope subject to NIS2. Lack of a certificate does not automatically put an entity within scope in breach of the law. The NIS2 checklist explains classification.
2. Complete registration and keep information up to date
Section 33(1) generally requires registration no later than three months after first entering scope or entering scope again. Section 34 also applies to certain digital providers; critical installations require additional information and consideration of section 66. An auditor’s list is not an official register. Sections 33, 34, 66 BSIG.
3. Test readiness to fulfil statutory reporting duties
An internal incident ticket is insufficient if the statutory notification to the competent body is missing. Check the start of deadlines, significance criteria, recipients, access, deputies and follow-up notifications. The German 24-hour and 72-hour periods generally both run from awareness of the significant incident. Trust services have additional, separate eIDAS notifications within 24 hours. Do not wait for the regular audit or management meeting. NIS2 incident reporting.
4. Involve management in practice
Management reports and decisions must support implementation and oversight under section 38(1). Management’s own regular training under subsection (3) is not fulfilled merely by training employees or appointing an ISMS manager. Management responsibility.
5. Match evidence procedures and technical findings to their purpose
Section 30(1) requires documentation. Section 39 contains special evidence duties for operators of critical installations; official evidence requirements and inspection measures under sections 61 and 62 have their own conditions. This does not establish a general annual ISO certification audit for all NIS2 entities. Conversely, later dates for certain official orders to provide evidence do not defer security measures that already apply. Sections 39, 61, 62 BSIG.
An external check adds individual observations about publicly reachable systems. It assesses neither the entire ISMS nor training, internal access, recovery or all suppliers. No header, DNS record or scanner score proves NIS2, GDPR or ISO compliance. Evidence becomes meaningful through the target, scope, time, method and handling of the result.
Frequently asked questions
Does NIS2 always require an ISO 27001 certificate?
No such duty follows from the general provision in section 30 BSIG. It requires appropriate and effective measures and documentation of them. Special statutory, sectoral or contractual evidence requirements must be assessed separately. ISO 27001 may provide a suitable organisational foundation, but it does not replace that assessment.
What percentage of NIS2 does ISO 27001 cover?
There is no generally reliable percentage for your specific fulfilment of duties. That would first require establishing legal scope, the measures actually implemented, the scope of the certificate and all additional duties. Counting similarly named topics does not measure complete implementation.
Is ISO 27001 based on IT-Grundschutz the same procedure?
The BSI operates a separate certification scheme for this, with defined audit bases. The audit bases read for this article, version 4.8 of 1 February 2026, include ISO 27001:2022 and the IT-Grundschutz Compendium, edition 2023; the audit start date is decisive. This specific procedure must neither be equated with every ISO certification nor presented as universal approval under the BSIG. BSI audit bases.
Start with a specific gap
Compare the services within statutory scope with the scope of your existing ISMS. Then examine a complete process, such as an outage of an important service: risk decision, protective measures, detection, reporting, recovery and management oversight. This reveals what the existing system already supports and what needs to be added.
The NIS2 checklist provides the structure of measures. For individual technical contributions, see the overviews of Web Security and compliance and Email Security and compliance.