Wondering Where the EU NIS2 Stands?
Currently, there is a 189-page draft bill from the German Federal Ministry of the Interior and Community. In July 2024, it was approved by the Federal Cabinet. This draft must now pass through the Bundestag, where it will be discussed and voted on. Differences in opinion may require a mediation committee. Afterward, the Bundesrat will review and approve the law before the Federal President signs it into effect. The original deadline of October 18, 2024, will no longer be met.
You can read the draft here — but you might want to cancel your meetings for the day. It’s 189 pages packed with legal jargon on cybersecurity — not exactly light reading, and certainly not easy to grasp. The federal government faces a complex decision, and further delays are likely.
If you’re affected by NIS2, you currently have two options:
- Wait until the final law is passed and all details are crystal clear.
- Use this time to begin implementing what you already can.
You might be asking: How am I supposed to implement something if the law hasn’t been passed yet?
If you align the draft requirements with those of ISO/IEC 27001, you’ll see that many NIS2 obligations are already covered by the ISO standard.
The independent platform OpenKritis, which supports operators of critical infrastructure, has created a useful mapping between ISO 27001 and NIS2.
What Is the NIS2 Directive?
The NIS2 Directive is an updated version of the original NIS (Network and Information Systems) Directive. Its goal is to enhance cybersecurity across the EU by introducing stricter requirements for essential service providers and digital service operators. Key focus areas include risk management, incident handling, business continuity, and supplier management.
The Importance of ISO 27001
ISO/IEC 27001 is the internationally recognized standard for Information Security Management Systems (ISMS). It provides a structured approach to managing sensitive company data, ensuring it remains secure. ISO 27001 covers a wide range of security practices, including risk management, incident response, business continuity, and more.
Where ISO 27001 and NIS2 Overlap – 5 Key Areas:
- Risk Management
- ISO 27001: Offers detailed procedures for identifying, assessing, and addressing risks.
- NIS2: Also demands robust risk management — largely covered by ISO 27001.
- Information Security Management System (ISMS)
- ISO 27001: Defines core ISMS requirements.
- NIS2: Requires an ISMS. ISO 27001 sets you up for success.
- Business Continuity Management (BCMS)
- ISO 27001: Includes measures for maintaining operations and disaster recovery.
- NIS2: Calls for similar practices — ISO 27001 provides a strong foundation.
- Supplier and Service Provider Management
- ISO 27001: Includes specific controls for supply chain security.
- NIS2: Requires supplier risk oversight — again, supported by ISO 27001.
- Incident Management
- ISO 27001: Covers detection, reporting, and handling of incidents.
- NIS2: Introduces strict incident reporting obligations, well aligned with ISO 27001.
ISO 27001 Is (Almost) Always a Smart Move
If you already know your organization falls under NIS2 and you don’t yet have an ISO 27001-certified ISMS, now is the time. A certification is often a no-brainer. Whether or not it’s mandatory depends on:
1. Nature and Scope of Your Business
- Are you dealing with sensitive data (e.g. in finance, healthcare, IT)? Then you stand to benefit greatly.
- Are you a critical infrastructure operator or provider? Then a certification is highly recommended.
2. Customer Expectations
- Many clients demand ISO/IEC 27001 certification from their vendors.
- Certification can be a competitive advantage and builds trust.
3. Regulatory Requirements
- In many industries, ISO/IEC 27001 helps meet legal or compliance obligations.
4. Risk Management
- The standard helps organizations identify, assess, and mitigate information security risks — preventing incidents and reducing long-term costs.
5. Internal Culture and Process Maturity
- ISO/IEC 27001 provides a structured framework to foster a strong security culture and continually improve processes.
Our Software Solution GRASP: One Platform for Both ISO 27001 and NIS2
GRASP is designed to help organizations meet ISO 27001 requirements while preparing for NIS2. Key features include:
- Risk Management: Automated tools for risk analysis and evaluation, aligned with both ISO 27001 and NIS2.
- ISMS Implementation: User-friendly modules to build and manage your ISMS.
- Incident Management: Integrated tools for detecting, reporting, and resolving security incidents.
- Vendor Management: Monitor and evaluate supplier compliance with security requirements.
- Training & Awareness: Awareness modules and staff training to keep your team up to date with cybersecurity best practices.
Conclusion: ISO 27001 + GRASP = Ahead of the NIS2 Curve
Implementing ISO 27001 lays the groundwork for NIS2 compliance. And if you use GRASP, you’re not just one step ahead — you’re two.
