Guide
NIS2 and ISO 27001: reuse existing measures with confidence
NIS2–ISO 27001 mapping: compare scope, measures and evidence. Reuse existing ISMS work and identify additional obligations in Germany and Austria.
An existing ISO 27001 ISMS can prevent considerable duplication when implementing NIS2. The certificate alone is not decisive: do your measures cover the regulated entity, are they actually implemented and does your evidence substantiate the specific requirement?
This guide explains how to document the assessment and incorporate remaining gaps into your existing action plan. Reviewed on 29 October 2026. Additional statutory obligations are addressed separately for Germany and Austria.
The NIS2 Directive and its requirements provide the starting point; this guide focuses on reusing existing ISMS work.
What mapping establishes and what remains open
Mapping connects related requirements. It does not automatically prove fulfilment. ENISA also explains in its technical implementation guidance that its mappings do not establish equivalence or full coverage. The guidance concerns Implementing Regulation (EU) 2024/2690 for certain digital entities; it is not a universal assessment procedure for every sector.
A statement such as “ISO 27001 covers 70 percent of NIS2” does not establish the position of your organisation. You need the appropriate scope, verified measures and additional statutory processes.
For the underlying distinction, see the ISO 27001 and NIS2 comparison. This guide focuses on reusing work already performed.
Compare scope first
Establish which entity, services, locations and systems fall within the statutory obligation. Compare this with your ISMS scope. A certificate covering headquarters does not automatically demonstrate equivalent protection for another entity or an excluded service.
Then assess the Statement of Applicability, or SoA, risk treatment and actual implementation. A control reference alone says nothing about evidence quality.
Ten areas to assess for reuse
The following table is our practical assessment aid for the topics in section 30(2) BSIG. It does not replace assessment of all applicable obligations and deliberately assigns no generic coverage score.
| NIS2 assessment area | Existing ISMS work to reuse | Additional question |
|---|---|---|
| Risk analysis and security policies | Risk assessment, treatment plan and policies | Are affected services, dependencies and current risks within scope? |
| Incident handling | Detection, assessment, response and lessons learned | Have statutory criteria, deadlines, recipients and deputies been added? |
| Business continuity | Business impact analysis, backup and recovery planning | Has recovery been tested and have deviations been addressed? |
| Supply chain | Supplier assessments and security agreements | Are relevant providers and impacts on your services included? |
| Acquisition, development and maintenance | Security requirements, changes and vulnerability handling | Are actual systems and development processes covered? |
| Effectiveness | Tests, internal audits and management reviews | Are results assessed and follow-up actions tracked? |
| Training and awareness | Audience-specific training programmes | Have management and relevant employees been reached? |
| Cryptography | Rules and technical implementation | Have protection needs, key management and use been assessed? |
| People, access and assets | Roles, access reviews and inventory | Are ownership, lifecycle and privileged access addressed? |
| Authentication and communication | Secure sign-in and communication channels | Are suitable mechanisms and emergency communications assessed? |
For exact control references, use a source matching your edition of the standard. Do not mix control numbers and names from the 2013 and 2022 editions. Management-system requirements also belong in the assessment; Annex A alone does not represent the complete ISMS.
Document a defensible mapping
Record six items for each statutory requirement:
- Legal basis and version: Which specific requirement applies to the entity?
- Scope: Which services, information and systems are affected?
- Existing measure: Which implemented work addresses it?
- Evidence: Which result substantiates implementation, for what period and scope?
- Assessment: Does the evidence meet the assessment need fully, partly or not at all?
- Remaining work: Who must decide or improve what, and by when?
“Partly” is not a percentage. Describe the missing element: for example, an excluded location, a missing deputy or an untested recovery procedure.
Example: one recovery test supporting multiple requirements
Fictional case: An IT provider has documented a recovery test for its customer platform. The test covers the data set, technical restoration, application checks and deviations.
For ISO 27001, the test can support the relevant backup and continuity measures. For NIS2, assess additionally whether the legally relevant service is within the test scope and whether the result matches its risks. The record is not rewritten for every framework. Its suitability is justified in each context.
If a dependent application was omitted, a gap remains even when the record is well organised and mapped to several controls. Mapping exposes the outstanding work; it does not resolve it.
What needs separate treatment in Germany
Registration: Assess applicable registration requirements and maintain the information. BSI registration is a separate administrative procedure.
Notifications: An internal incident process must incorporate statutory assessment criteria and reporting routes. Section 32 BSIG requires staged reporting for significant incidents. The final notification is generally due one month after the second notification, not a blanket 30 days after the incident. Details and exceptions are explained in the notification guide.
Management: Section 38 BSIG addresses implementation, oversight and regular training. General management approval of an ISMS does not replace these ongoing responsibilities.
Sector and supervision: Assess additional rules for your entity category. A general table must not obscure sector-specific provisions or authority requirements.
What to check separately in Austria
An existing ISO 27001 ISMS also gives Austrian organisations a starting point: risk assessments, security measures and evidence can support an assessment against NISG 2026. First check whether the ISMS scope covers the affected entity and its services.
The statutory requirements remain distinct. Section 31 NISG 2026 addresses management obligations and training; section 32 addresses risk-management measures. Assess your existing measures against these requirements and address gaps in ownership, implementation and evidence.
For your action plan: Record the Austrian legal basis and check registration, incident reporting and the competent authority separately. Do not copy the German BSI procedures. This lets you reuse existing ISMS work without overlooking country-specific obligations.
Keep the SoA traceable
The SoA documents controls required for your ISMS and their justification. Additional statutory requirements should be connected to relevant controls and measures through a traceable requirements register. Simply renaming statutory obligations as “ISO controls” obscures their origin.
Where the assessment requires new or changed controls, evaluate the implications for risk treatment and the SoA. Document the change, its version, owner and rationale. This preserves the reason for a measure and the requirements for which you use it.
Maintain one measure across multiple requirements
With Kopexa’s ISMS software, you do not need a separate NIS2 measures list alongside your ISO 27001 ISMS. Evidence belongs to measures, which you map to the relevant controls in both frameworks. Reuse existing work instead of assembling measures and evidence again for every requirement.
In day-to-day work, a changed measure is maintained in one place. During assessment, review the linked evidence and focus on the remaining tasks. Whether a requirement is met still needs professional assessment.
Start with a specific measure such as a recovery test. Review its mappings, evidence and outstanding issues. Then apply the approach to other measures. For the broader programme, see the NIS2 roadmap and checklist.