NIS 2 and ISO 27001: How to Efficiently Implement Cybersecurity in Your Company Now

NIS 2 is a European directive aimed at strengthening cybersecurity across the EU. It obligates specific companies and entities to implement appropriate technical and organizational measures to protect their IT systems.

The goal: Your company should become more resilient against cyberattacks, detect security incidents faster, and better mitigate damage. In Germany, the Federal Office for Information Security (BSI) is the central authority for implementation and supervision.

Important for you: NIS 2 is not just an issue for classic critical infrastructure (KRITIS) operators (such as electricity or water suppliers). The scope is significantly broader. It affects the upper-mid market, digital services, SaaS providers, the manufacturing sector, and numerous service providers embedded in relevant supply chains.

Whether your company falls directly under NIS 2 depends essentially on two main factors: sector and company size.

1. The Sectors (Is your company included?)

There are a total of 18 regulated sectors. These include, among others:

• Energy, transport, banking, financial market infrastructures, health, drinking water, wastewater
• Digital infrastructure (crucial for cloud providers and data centers!)
• Postal and courier services, waste management, chemicals, food (production and wholesale)
• Manufacturing/production sector (e.g., mechanical engineering, automotive, electrical engineering)
• Digital services (important for providers of online marketplaces, search engines, and social platforms)
• Research institutions (Note: Universities are generally exempt)

2. The Thresholds (Size of the company)

As a rule, you are affected if your sector matches and your company:

• has at least 50 employees OR
• has an annual turnover of over 10 million euros (or a balance sheet total of over 10 million euros).

Special case: Certain providers (e.g., in the areas of DNS services, trust services, or TLD registries) are regulated from the very first employee, regardless of their size.

Many companies only check for direct applicability. This is a fatal mistake. Even if your company is formally too small or does not belong to the regulated sectors, NIS 2 can hit you with full force through your customers.

The law obligates directly affected corporations and large enterprises to secure their entire supply chain. In practice, this means for you as a service provider or SaaS vendor:

• You will receive significantly stricter and more detailed security questionnaires from your customers.
• You must contractually and organizationally prove IT security measures.
• Certificates such as ISO 27001 or proof of a functioning ISMS will become mandatory in tenders and B2B contracts.

In short: If you cannot prove your cybersecurity, you risk being dropped from the supply chain in the worst-case scenario. NIS 2 is therefore not just a compliance issue, but safeguards your market access.

NIS 2 requires affected companies to take "appropriate, proportionate, and effective technical and organizational measures." The law specifies 10 minimum measures that you must implement:

ISO 27001 is the internationally recognized standard for an Information Security Management System (ISMS). An ISMS ensures that you treat IT security not as a one-off project, but as a continuous process (Plan-Do-Check-Act).

If your company is already certified according to ISO 27001, you have a massive head start. According to estimates by ENISA (European Union Agency for Cybersecurity), you already cover approx. 70 to 80% of the NIS 2 requirements with a functioning ISO standard.

ISO 27001 provides you with the perfect structural framework for:

• Systematic risk analyses
• Asset management (inventory of your IT landscape)
• Role definitions and responsibilities
• Documentation logic for authority audits

An ISO 27001 certificate is a strong signal to the market, but it does not exempt you from the specific statutory additional obligations of NIS 2. There are fundamental differences you need to know:

Here are the critical gaps where you must sharpen your focus despite ISO certification:

• The statutory registration obligation: Affected entities must actively register in the BSI portal. Missing the deadline risks immediate fines.
• The ultra-tight reporting obligations: While ISO 27001 only requires you to manage incidents internally, NIS 2 demands compliance with statutory deadlines (24 hours for the initial report to the BSI).
• The obligations of executive management: NIS 2 holds management personally accountable. Executive management must not only approve the measures but actively monitor them and undergo training themselves. Delegating this entirely to the IT department is legally ruled out.
• Liability and sanctions: In case of ISO violations, you lose the certificate in the worst-case scenario. With NIS 2 violations, the company faces fines of up to 10 million euros (or 2% of global turnover) and management faces personal recourse liability with their private assets.

Whether you are starting from scratch or expanding an existing ISO system—this roadmap will help you with pragmatic implementation:

Step 1: Check applicability water-tightly 

Determine your sector affiliation and your key metrics. Are you in a legal gray area or are you indirectly affected as a B2B service provider via the supply chain? Document the result of this assessment carefully.

Step 2: Create a complete asset register 

You can only protect what you know. Systematically record all IT systems, software applications, cloud services, critical datasets, and external service providers.

Step 3: Conduct a risk assessment 

Analyze your assets: What threats exist? What impact would a failure of a specific SaaS tool or cloud hoster have on your core business?

Step 4: Build or expand your ISMS 

Utilize the structure of ISO 27001 to set up security policies and assign responsible persons within the team. A digital compliance platform helps you manage all evidence and deadlines centrally.

Step 5: Implement statutory special processes 

Supplement your system with specific NIS 2 requirements: Set up access to the BSI portal, integrate the 24-hour reporting obligation into your incident response manual, and schedule the mandatory training for your executive management.

Step 6: Continuous effectiveness testing 

Cybersecurity is not a state, but a process. Regularly review your measures (e.g., once a quarter) for their actual functionality and adapt them to new threat landscapes.

• Mistake 1: Shifting the topic entirely to IT. NIS 2 demands holistic governance. Procurement (supplier contracts), HR (employee training), and executive management must sit at the table.
• Mistake 2: Blind activism with isolated tools. Buying a new security tool is useless if the organizational processes, contingency plans, and policies behind it are lacking.
• Mistake 3: Underestimating supply chain inertia. Many attacks occur via seemingly insignificant interfaces to service providers. If you do not audit your suppliers, you leave the back door wide open.

The flood of regulations like GDPR, ISO 27001, and now NIS 2 can quickly feel overwhelming. That is exactly where we come in. heyData is your digital operating system for compliance.

We support you in implementing regulatory requirements efficiently, transparently, and without bureaucratic frustration:

• Smart applicability check & orientation: We clarify together with you which specific obligations apply to you.
• Pragmatic ISMS setup: Through our digital platform, you manage your assets, risks, and security measures centrally.
• ISO 27001 & NIS 2 from a single source: We help you seamlessly extend existing ISO processes to include statutory NIS 2 requirements.
• Efficient vendor management: Use our extensive database of over 6,000 already evaluated software providers and service providers to secure your supply chain in no time.
• Automated training: Sensitize your entire team—including the legally required specialized training for your executive management—directly via our platform.

With heyData, you do not view NIS 2 as an isolated compliance mountain, but integrate it seamlessly into your existing business processes. This is how you turn regulatory pressure into a genuine competitive advantage.

NIS 2 finally elevates cybersecurity to the management level. What used to be a purely technical protective measure in the IT department is today a statutory obligation for corporate leadership.

ISO 27001 provides you with the perfect foundation and structure to fulfill these duties efficiently. Those who specifically supplement specific additional requirements such as reporting obligations and BSI registration now minimize not only liability risks but position themselves as a trustworthy and secure partner in the market.

What is NIS 2 explained simply? 

NIS 2 is an EU-wide statutory directive that obligates companies to massively improve their IT and information security, actively manage risks, and report serious security incidents to state authorities (in Germany, the BSI) lightning-fast.

Is our ISO 27001 certification sufficient for NIS 2? 

No, unfortunately not completely. ISO 27001 covers approx. 70–80% of the technical and organizational measures. However, statutory obligations such as registering with the BSI, the extremely short 24-hour reporting deadlines, and the personal training and liability obligations of management must be implemented additionally.

What happens if my company ignores NIS 2? 

Drastic consequences loom: Official fines in the millions, the loss of major customers because you cannot provide security verification in the supply chain, as well as personal recourse liability of executive management in case of breaches of duty.

Does NIS 2 also affect smaller companies with fewer than 50 employees? 

Directly by law only in rare exceptional cases (e.g., with DNS services). However, indirect impact via the supply chain applies here: If your customers are subject to NIS 2, they will contractually require that you, as a supplier or SaaS service provider, also demonstrate these security standards.

How do I best get started? 

First, perform a clean applicability analysis and subsequently record your critical IT assets. If you want to accelerate the process and document it legally securely, a digital compliance platform like heyData supports you through every single step.