Acuna GRC core
ComplyFrameworks, scopes and cross-mapping.ImplementRequirements, measures and controls.OperateRisks, tasks, annual plan, documents.AssureKPIs, audits and corrective actions.
Platform overview
Add-on modules
TPRM (Supplier Shield)Supplier assessments and a daily grade.Data PrivacyProcessing activities, DPIAs and requests.Cookie ManagerCookie banner and consent records.Trust CenterAnswer questionnaires, share a trust page.AI GovernanceRegister and assess your AI systems.EvaluationsSpot checks and gap assessments.Group managementSubsidiaries in one Group Compliance view.Staff PortalPolicies staff read and acknowledge.Vulnerability managementScanner results turned into issues.
All modules
Across the platform
AikoThe AI assistant, at your pace.Integrations and APIConnectors, task sync, webhooks, API.Administration and securityUsers, access profiles, audit log.100+ connectors
By size
StartupGet ready for your first audit.Mid-marketKeep the library clean as you grow.EnterpriseControl at scale.Consultants and MSSPsAll your clients in one view.
By framework
ISO 27001ISO 42001NIS2EU AI ActDORASOC 2GDPRNIST CSFSwiss FADPFINMA
See all frameworks
By need
Prepare for a certification auditAnswer a client questionnaireRun compliance across a groupAssess your suppliersGovern your AI systems
All solutions
Acuna GRC Services
Do it yourselfYou run the program in Acuna GRC, with Aiko.Done with you (Co-managed)Guidance, reviews and audit preparation with your team.Done for you (Fully managed)Our experts run it. You review.
What we take on
CISO as a serviceDPO as a serviceAudit preparationGap assessmentsProgram setup in Acuna GRC
Meet the experts
Alexis HirschhornCertified Lead AuditorLaura MenetreyLegal and privacy expertBénédicte SévinISO 27001 Lead Implementer
Meet the full team
MSSPs and consultants
Acuna GRC for MSSPsWhite label and tenant managementBecome a partner expert
Learn
BlogWebinarsAnswersGlossary
See all resources
Framework guides
ISO 27001NIS2DORAEU AI ActCyber Resilience Act
All frameworks
Featured
WebinarFrom AI hype to AI reality: governing the AI your company already usesView the webinarGuideHigh-risk AI systems: how the EU AI Act classifies yoursRead the guide
Company
About AcunaTeamPricingOur Trust CenterContact us
Legal
PrivacyTermsData Processing AgreementAcuna GRC AI information
Our own standard
ISO/IEC 27001:2022 certifiedThe standard you ask of your own suppliers.Built and run from SwitzerlandHosted in Switzerland, the EU or the US.
Frameworks

Does ISO 27001 cover NIS2?

By the Acuna GRC teamLast updated 19 October 20262 min read

Direct answer

Partly. An ISO 27001 information security management system covers much of the risk-management substance of NIS2 Article 21, such as risk analysis, incident handling, business continuity, access control and cryptography. It does not cover the legal duties around it: registration with your authority, the 24-hour, 72-hour and one-month incident reports, management-body approval and training, and national rules.

A certificate is not proof of NIS2 compliance.

What ISO 27001 already gives you

Article 21(2) of NIS2 lists ten groups of measures. Most have a match in ISO/IEC 27001:2022 and its Annex A controls:

  • Risk analysis and security policies: clauses 5.2 and 6.1.
  • Incident handling: Annex A 5.24 to 5.28.
  • Business continuity and backups: Annex A 5.29, 5.30 and 8.13.
  • Supply chain security: Annex A 5.19 to 5.22.
  • Secure acquisition, development and maintenance: Annex A 8.25 to 8.29 and 8.8.
  • Assessing effectiveness: clauses 9.1 to 9.3.
  • Cyber hygiene and training: Annex A 6.3.
  • Cryptography: Annex A 8.24.
  • Human resources security and access control: Annex A 6.1 to 6.6 and 5.15 to 5.18.
  • Multi-factor authentication: Annex A 8.5.

NIS2 itself says entities should take account of European and international standards (Article 21(1) and Article 25).

What ISO 27001 does not cover

  • Incident reporting to the authority. Article 23 sets an early warning within 24 hours, a notification within 72 hours and a final report within one month. ISO 27001 asks you to manage incidents, not to report them on those clocks.
  • Management-body duties. Article 20 makes the management body approve the measures, oversee them and follow training, and it can be held liable.
  • Registration. Entities register with their national authority under the national law.
  • Scope. NIS2 applies to the whole entity, while an ISO 27001 scope can be narrower.
  • Stricter detail for some sectors. Implementing Regulation (EU) 2024/2690 sets detailed technical requirements for cloud, data centre, managed service and other digital providers.
  • National law. Each member state adds its own specifics.

Closing the gaps in Acuna GRC

In Acuna GRC you adopt NIS2 next to ISO 27001 in Comply. Common Measures are mapped across both, so an ISO 27001 measure counts for the NIS2 requirements it meets, and Mapping lists the NIS2 requirements with no measure linked: usually reporting, registration and management-body duties. Incidents are logged as issues with a timeline of dated steps. See cross-framework control mapping.

How Acuna GRC handles it

In Acuna GRC, NIS2 sits next to ISO 27001 and Mapping shows what is still uncovered.

Sources

  1. Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23 and 25
  2. Commission Implementing Regulation (EU) 2024/2690
  3. ISO/IEC 27001:2022

This page explains the rules in general terms and is not legal advice.

Frequently asked

Does an ISO 27001 certificate prove NIS2 compliance?

No. Authorities can accept it as evidence for some measures, but NIS2 has no presumption of conformity for ISO 27001, and the reporting and governance duties sit outside it.

Should we certify to ISO 27001 for NIS2?

It is not required, but an ISMS gives you the structure NIS2 expects and evidence that customers recognise. Start from your NIS2 scope, which may be wider than your current ISO 27001 scope.

For: Security Leader (CISO)

See how Acuna GRC runs this.

Tell us your frameworks and your team. We show you how Acuna GRC runs the program.

Hosted in Switzerland, the EU or the US