NIS2 vs ISO 27001: what to reuse and what is missing

An ISO/IEC 27001 information security management system covers a large part of the work NIS2 requires: risk analysis, policies, access control, incident management, continuity. It is not, however, compliance with Romania’s GEO 155/2024. What is missing are the duties towards DNSC, the role of management, the notification deadlines and assessment against the DNSC Order 1/2026 catalogue.

Key points

ISO 27001 is a voluntary standard with certification; NIS2 is a legal obligation, supervised by DNSC and backed by fines.
The minimum measures in Art. 13 of GEO 155/2024 largely overlap with the areas ISO 27001 covers.
An ISO 27001 certificate does not replace the annual maturity self-assessment on DNSC tools or the NIS audit.
DNSC Order 1/2026 requires a statement of applicability for requirements coming from special or sector rules.
The efficient route is a control-by-control mapping, not a second, parallel documentation set.

What is the real difference between NIS2 and ISO 27001?

ISO 27001 describes how to build and improve an information security management system. The organisation sets its own scope, assesses its risks, selects controls and justifies them in a statement of applicability. Certification is done by a certification body at the organisation’s request.

NIS2, through GEO 155/2024, is law. You do not choose the scope: if you are an essential or important entity, the obligations apply to the whole entity. The control level follows from DNSC’s risk-level methodology, and DNSC Order 1/2026 sets the catalogue: 34 controls at Basic, 133 at Important and 218 at Essential.

Aspect	ISO/IEC 27001	NIS2 (GEO 155/2024 and DNSC Order 1/2026)
Nature	Voluntary standard	Legal obligation
Scope	Chosen by the organisation	The whole in-scope entity
Controls	Selected on risk	National catalogue by assurance level
External assessment	Certification audit	Security audit and DNSC supervision
Reporting	None to an authority	Annual self-assessment to DNSC, incident notification
Management role	Commitment and management review	Approval, oversight, liability, accredited training (Art. 14)
Sanctions	Loss of certificate	Fines up to EUR 10 million or 2% of turnover

What can you reuse from ISO 27001?

Almost everything that belongs to the management system:

Risk assessment and treatment. GEO 155/2024 requires risk analysis policies and procedures and their periodic review (Art. 13(a)).
Asset inventory. DNSC can request the list of relevant assets and identified risks (Art. 11(7)).
Security policies, including cryptography (Art. 13(c)), access control and asset management (Art. 13(f)).
Incident management (Art. 13(g)) as an internal process.
Business continuity, backups and recovery (Art. 13(h)).
Supplier relationships (Art. 13(d)), if the ISO process really covers critical suppliers.
Internal audit and management review as verification and improvement mechanisms.
Evidence. Records kept for certification are largely the same evidence the NIS2 self-assessment needs.

What must be added for NIS2?

NIS2 requirement	Why ISO 27001 does not cover it automatically
Registration notification to DNSC	Legal duty with no equivalent in the standard. DNSC’s first fine (RON 50,000, 29.09.2026) was for missing it
Annual maturity self-assessment signed off by management (Art. 12(4))	Done on DNSC tools, with thresholds of 2.5 / 3 / 3.5
Remediation plan within 30 days, essential entities (Art. 12(5))	Format and deadline set by law
Management approval and liability (Art. 14(1))	ISO asks for involvement, not legal liability for breaches
Accredited management training (Art. 14(2))	The standard does not require accredited courses for management
NIS officer appointed within 30 days, five conditions for essential entities (Art. 14(3)-(4))	A different role from the ISO security manager
Significant incident notification: 24 h, 72 h, one month	Statutory deadlines towards DNSC
Logging and traceability of all activity (Art. 11(4))	May exist, but the legal extent must be checked
Multi-factor authentication where appropriate (Art. 13(j))	A risk-based choice under ISO
Data on digital service providers on DNSC request (Art. 11(9))	The register must be ready in the requested form
Scope: the whole entity	An ISO certificate may cover only part of the organisation

The last row is the one most often missed. An ISO 27001 certificate for “software development, Bucharest office” does not cover the warehouse, the plant or the branch network. NIS2 covers all of them.

What is the statement of applicability in DNSC Order 1/2026?

Art. III of DNSC Order 1/2026 says the risk management measures are supplemented, where relevant, by requirements from special or sector rules that apply to the entity. Requirements implemented this way are recorded in a statement of applicability drawn up by the entity.

For an ISO 27001 organisation the idea is familiar, since the standard has its own statement of applicability. The two are not the same document and do not serve the same purpose, but they can be built on the same base: a matrix in which each control has its source (Order 1/2026, standard, sector rule), status, owner and evidence.

If the entity belongs to a group, Art. III(3) refers to the rules in DNSC Decision 3/2026, explained in NIS2 in groups of companies.

How to map control by control

Start from the applicable catalogue. The control list for your assurance level in DNSC Order 1/2026 is the reference, not the standard’s annex. See CyFun and the 218 controls.
Link each control to existing ISO documents and records. Where the match is full, note the evidence.
Flag partial matches. The usual ones: scope, logging, MFA, suppliers, training.
Add the duties with no equivalent: registration, notification, self-assessment, remediation plan, NIS officer, management training.
Run a trial self-assessment on the DNSC tool before the official one. Thresholds are explained in EVAL_MMS self-assessment.
Merge the calendar: ISO internal audit, management review, NIS2 self-assessment and NIS audit can be scheduled so the evidence serves all of them.

CysNIS provides an interactive correspondence table between DNSC Order 1/2026, NIS2 Article 21, CyFun, NIST CSF 2.0 and ISO/IEC 27001:2022, which shortens the first three steps considerably.

Is ISO 27001 worth it if you must do NIS2 anyway?

It depends on your customers. If you sell abroad or bid in tenders where ISO 27001 certification matters, one management system serving both purposes is the efficient route. If NIS2 is the only driver, the DNSC catalogue comes first and certification can follow later on the same foundation.

Watch for the opposite confusion too: there is no “NIS2 certification” for organisations, as explained in NIS2 certification: what exists and what is sold.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors. Through NIS2 consulting (from EUR 10,000 per project) we map your ISO 27001 system against the applicable DNSC Order 1/2026 controls, identify the gaps and complete the documentation without duplicating it. A NIS2 audit starts at EUR 5,000 per engagement, observing auditor incompatibility rules.

If you need the Art. 14 role, the outsourced NIS2 officer starts at EUR 1,200 per month on a 12-month contract. Prices are final; ProDefence is not VAT-registered.

The ISO 27001 awareness and training control (A.6.3) and the NIS2 training requirement can be covered by the same programme. The courses on CysEdu (in Romanian) and the free interactive games on CysGame (in Romanian) provide ready-made material for it.

Frequently asked questions

If we are ISO 27001 certified, are we NIS2 compliant?

Not automatically. ISO 27001 covers a large share of the measures, but NIS2 adds legal duties with no equivalent: the registration notification, the annual self-assessment on DNSC tools, the remediation plan, management liability and training, the NIS officer and incident notification within 24 hours, 72 hours and one month.

Does DNSC accept an ISO 27001 certificate instead of the NIS audit?

GEO 155/2024 requires a security audit at intervals set by DNSC order, and the annual self-assessment is done on DNSC tools. The ISO certificate is not provided as a substitute, but evidence from the ISO system can be used in both the self-assessment and the audit.

What is the statement of applicability required by DNSC Order 1/2026?

It is the document in which the entity records requirements implemented under special or sector rules that supplement the order’s measures (Art. III). It is not identical to the ISO 27001 statement of applicability, but both can be built on the same control matrix.

What gaps do ISO 27001 certified organisations usually have?

A certification scope narrower than the entity, incomplete logging, MFA not applied everywhere needed, a supplier process applied only on paper, accredited management training, the NIS officer, and a DNSC notification procedure with the statutory deadlines.

How does CyFun relate to ISO 27001?

CyFun, adopted by Romania as the basis of the national control catalogue, draws on international standards including ISO 27001. That is why control-by-control mapping works, but the compliance reference remains DNSC Order 1/2026.

Do we need to rewrite our ISO documentation for NIS2?

No. Existing documentation is extended: add the procedures with no equivalent and widen policies where scope or detail falls short. A parallel set creates inconsistencies and doubles the maintenance effort.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity and NIS2 compliance specialist at ProDefence, whose team includes DNSC-attested NIS auditors.