NIS2by country

Does an ISO 27001 certificate count for NIS2?

It depends on the country. Belgium, Estonia and Portugal give a presumption of conformity. Austria accepts valid certificates as proof. In 8 more countries a certificate is useful evidence, not proof. 12 laws do not name it.

3 BE EE PT Presumptionof conformity 1 AT Acceptedas proof 11 CZ DK FR DE HU IE IT LT NL SI ES Helps, notenough alone 12 BG HR CY FI GR LV LU MT PL RO SK SE Not namedin the law

Presumption of conformity

3 countries

  • Belgium

    An ISO 27001 certificate from a CCB-authorised body gives a presumption of conformity.

    • The certification body must be accredited by an EA or IAF MLA signatory and authorised by the CCB.
    • The certificate scope must cover the whole organisation, unless IT/OT environments are separated.
    • Essential entities on the ISO route must hold the certificate by 2027-04-18.

  • Estonia

    A valid ISO 27001 certificate exempts you from the Estonian standard, if its scope covers the NIS systems.

    • The Act asks for measures under the Estonian information security standard (E-ITS). The Government regulation says this standard does not apply to a certified entity.
    • You need an ISO/IEC 27001 or EVS-EN ISO/IEC 27001 certificate. The scope must cover the systems of your NIS activities. You send the certificate to RIA.
    • A certified entity also skips the E-ITS audit every 3 years. Entities under 50 staff and EUR 10 million turnover are outside E-ITS.

  • Portugal

    A valid ISO 27001 certificate gives a presumption that you meet the security measures.

    • An accredited-body ISO/IEC 27001 certificate lets you claim a presumption of compliance with the measures in arts. 26-28 of the regime. The certificate scope must cover all the information systems and networks tied to your services.
    • The certificate must include the statement of applicability. Report a revocation to the CNCS within 72 hours. Report a suspension, renewal or scope change within 10 working days.
    • The CNCS may also require certification under art. 34.

Accepted as proof

1 country

  • Austria

    The law accepts valid, relevant certificates as proof of how you implemented the measures.

    • § 33 names relevant valid certificates as a way to prove operational and organisational implementation.
    • The proof is due on request. The first request can come from 2028-10-01.

Helps, not enough alone

11 countries

  • Czechia

    ISO 27001 is not required. NÚKIB says a certificate puts you on the way but cannot be the only evidence.

    • NÚKIB says a certified ISMS means a provider is on the way to meet the higher-regime decree. The decree builds on the ISO 27000 series.
    • The law does not require an ISO 27001 certificate. NÚKIB can inspect the measures whatever certificates the provider holds.

  • Denmark

    The Act does not name ISO 27001. The ministry says the ISO/IEC 27000 series can serve as a framework.

    • The Act requires appropriate and proportionate measures. It names no standard.
    • The explanatory notes say standards such as the ISO/IEC 27000 series can serve as a framework for the measures.
    • The Act lets a minister require European certified ICT products. That rule covers ICT products and services, not management systems.

  • France Bill, not law yet

    The bill names no ISO standard. A framework or standard ANSSI recognises as equivalent can show compliance.

    • The bill makes ANSSI's reference framework the base. Entities can also use another framework that ANSSI recognises as equivalent. A decree sets how European and international standards are recognised.
    • A trust label approved by ANSSI gives a presumption of compliance. The bill does not name ISO 27001 or any certificate as proof.
    • ANSSI publishes ReCyF and a tool that compares it with other frameworks and standards. The ReCyF framework is non-binding by default.

  • Germany

    ISO 27001 helps as evidence. It does not prove BSIG compliance on its own.

    • The BSI states that a certificate does not automatically meet all BSIG duties.
    • Your ISMS scope can be narrow. The BSIG covers the whole entity.
    • Registration, incident reporting and the management duties sit outside ISO 27001. Check them separately.

  • Hungary

    The Act does not name ISO 27001. A certificate feeds the mandatory audit.

    • The Act requires a 2-yearly audit by a registered auditor. A certificate does not replace it.
    • The audit rules say the entity gives the auditor its past audit results and certificates issued under international standards.
    • The text does not name ISO 27001. No rule says that a certificate lowers the audit scope.

  • Ireland Bill, not law yet

    The NCSC will keep recognising ISO 27001. No law gives a presumption of compliance.

    • The NCSC says it will continue to recognise standards such as ISO 27001. This is a policy statement, not a rule in the General Scheme.
    • The NCSC recommends the CyberFundamentals framework as a voluntary route. It is not a statutory presumption of compliance.
    • The NCSC plans a voluntary national certification scheme that the Irish National Accreditation Board (INAB) would accredit. The General Scheme does not mandate certification.

  • Italy

    ISO 27001 helps. UNI/PdR 174:2025 maps it to the ACN baseline measures.

    • ACN supported a reference practice for companies already certified to ISO 27001.
    • It extends the ISMS to the controls of the NIST Cybersecurity Framework that the ACN measures use.

  • Lithuania

    The law does not name ISO 27001. The NKSC says the audit can run within the ISO 27001 scope.

    • The law asks entities to follow national, EU and international standards. It does not set a standard or a certificate as proof.
    • The NKSC answered the question if an ISO 27001:2022 assessment equals the cybersecurity audit. It said the assessment can run within the ISO 27001 scope. It must check the requirements of the national rules (KSRA), the law and the internal policies.
    • The audit must be done by an independent auditor who holds a recognised certificate and meets the NKSC rules.

  • Netherlands

    ISO 27001 is not required for companies. A certificate alone does not prove your level is enough.

    • Only essential entities in the government sector must apply ISO 27001:2023.
    • The explanatory note says a certificate does not by itself show that the security level is sufficient.
    • It also says customers have no de facto duty to ask suppliers for a certificate.

  • Slovenia

    The law requires a documented ISMS, not an ISO 27001 certificate. It names no certificate as proof.

    • Article 21 requires a documented information security management system and a business continuity management system. An ISMS built on ISO 27001 supports this.
    • Articles 22 and 28 tell entities to use European and international standards. They name no standard.
    • The proof is the compliance assessment under Article 25, not a certificate. URSIV mentions ISO/IEC 27001 only as a check on suppliers' products.

  • Spain Bill, not law yet

    The draft names no ISO standard. It asks for a certificate based on the national scheme (ENS) and equivalent standards.

    • The draft bases security measures on the National Security Scheme (ENS) and on equivalent European and international standards. It does not name ISO 27001.
    • Essential entities must hold a certificate of conformity. The National Cybersecurity Centre will set the certification procedure.
    • The Centre aims for one certificate that proves both the ENS and the international standards at matching levels. An ISMS built on ISO 27001 supports this.

Not named in the law

12 countries

  • Bulgaria

    The Act names no ISO standard. It points to European and international standards in general.

    • The Act says measures take into account relevant European and international standards.
    • The Cybersecurity Council promotes the use of such standards. No list of standards exists in the Act.
    • The Act lets the Council of Ministers require EU-certified ICT products. This covers the EU schemes under the Cybersecurity Act, not ISO 27001.

  • Croatia

    The Act and the Regulation do not name ISO 27001. Audits need a certified cybersecurity auditor.

    • The Act says measures take into account European and international standards. It names no standard.
    • The central body must publish a map of the required measures to the main European and international standards.
    • An ISO 27001 audit does not replace the audit by a certified cybersecurity auditor.

  • Cyprus

    The Law names no ISO standard. It points to European and international standards in general.

    • The Law says measures take into account relevant European and international standards.
    • The Authority may set the measures by a Decision. No Decision names ISO 27001.
    • The Authority can require products certified under EU cybersecurity schemes. These are not ISO schemes.

  • Finland

    The Act does not name ISO 27001. It lists no certificate as proof of the duties.

    • The Act sets duties for a risk management policy and 12 minimum measures. It names no standard.
    • The audit power applies only after a serious incident or breach. No routine audit cycle exists.
    • Approved certification mechanisms count as 1 factor when the fine amount is set.

  • Greece

    The Law does not name ISO 27001. It does not accept a certificate as proof.

    • Article 15 asks for measures that take account of national, European and international standards. It names no standard.
    • The Authority may require ICT products certified under EU cybersecurity schemes. This does not cover management system certificates.
    • The Authority audits essential entities and reviews their unified policy each year.

  • Latvia

    The law does not accept ISO 27001 as proof. It appears only as an example auditor certificate.

    • The regulation lists ISO/IEC 27001 Lead Auditor as one example of an auditor qualification. It does not treat an ISO 27001 certificate of the entity as proof of compliance.
    • The NKDC checks compliance through the self-assessment report and, on suspicion, an audit.

  • Luxembourg

    The law does not name ISO 27001. Approved certification schemes count in enforcement.

    • The law and the ILR pages do not mention ISO/IEC 27001. The ILR may require products certified under EU schemes.
    • An approved certification mechanism is one factor when the authority sets an enforcement measure.

  • Malta

    The order does not name ISO 27001. The CIP Department encourages European and international standards.

    • The order names no certificate as proof of compliance. The CIP Department promotes European and international standards for network and information security.
    • A qualified auditor must hold a valid cybersecurity certification or standard that the CIP Department decides.

  • Poland

    The law does not name ISO 27001. It counts as evidence for your measures, not as proof.

    • The audit is a legal audit of the KSC duties. An ISO 27001 audit does not replace it.
    • An ISMS built on ISO 27001 covers much of the required risk management.

  • Romania

    The ordinance does not name ISO 27001. The audit and self-assessment follow DNSC rules.

    • Audits use DNSC-certified auditors and DNSC criteria. An ISO 27001 certificate does not replace them.
    • An ISMS built on ISO 27001 gives you much of the evidence the self-assessment asks for.

  • Slovakia

    The act does not name ISO 27001. It requires audits by an auditor certified under NBU rules.

    • The act says security measures take account of international standards. It names no standard.
    • An ISO 27001 certificate does not replace the audit by a certified cybersecurity auditor.
    • An ISMS built on ISO 27001 supports the risk analysis and the security documentation that the act requires.

  • Sweden

    The act and its rules name no standard and no certificate. Measures must fit the risk.

    • The act lists the minimum areas for security measures. It names no standard, including ISO 27001.
    • An ISO 27001 certificate does not prove compliance by itself.
    • An ISMS built on ISO 27001 covers areas the act lists, such as risk analysis, incident handling and supplier security.

What a certificate does not cover

NIS2 adds 5 things a certificate does not give you.

  1. Whole-entity scope. You choose your ISMS scope. NIS2 covers the whole entity.
  2. Registration with the national authority.
  3. Incident clocks: early warning in 24 hours, notification in 72 hours, final report in 1 month.
  4. Management duties: approve the measures, oversee them, take training. Some countries make managers liable.
  5. National measure lists: § 30 BSIG in Germany, the ACN baseline in Italy, CyberFundamentals in Belgium.

In Belgium, important entities have no formalities. They can join the conformity assessment regime voluntarily.