Since October 2024, NIS2 has been law in Belgium. Many companies now ask the same question: “We already have ISO 27001. Isn’t that enough?” The short answer: it gets you a long way, but not all the way.
In this blog we explain in plain language what both are, how they fit together and what you still need to do.
What is NIS2?
NIS2 is a European law that requires organisations in important sectors to protect themselves better against cyberattacks. Think of energy, transport, healthcare, manufacturing, digital services and many more. In Belgium, the Centre for Cybersecurity Belgium (CCB) checks whether companies follow the rules.
In practice, NIS2 asks three things:
- Manage your cyber risks. Know what could go wrong and take sensible measures, such as backups, access control, staff training and checking your suppliers.
- Report serious incidents quickly. A first warning within 24 hours, more details within 72 hours and a final report within a month.
- Make management responsible. The board must approve the security approach, follow training and can be held personally accountable.
Ignoring it can be costly: fines can reach up to €10 million or 2% of global turnover.
What is ISO 27001?
ISO 27001 is an international standard for organising information security. It does not prescribe specific technology. Instead, it helps you set up a way of working: find out what your risks are, decide which measures you take, check whether they work and keep improving.
An independent auditor checks whether you do this properly. If so, you receive a certificate, which is checked again every year. Unlike NIS2, ISO 27001 is voluntary.
Where they meet
Both start from the same idea: first understand your risks, then take the right measures. Most of what NIS2 asks, such as security policies, backups, access management and handling incidents, is already part of a good ISO 27001 approach.
That is why Belgium officially accepts ISO 27001 as one of the ways to show you comply with NIS2. The other route is CyberFundamentals, a Belgian framework from the CCB. For the most critical organisations (“essential entities”), the deadline for a full ISO 27001 certificate is April 2027.
What ISO 27001 does not cover
Having a certificate does not automatically mean you meet NIS2. Watch out for these gaps:
- Too narrow a scope. Many certificates cover only one site or department. NIS2 looks at your whole organisation and the services you deliver.
- Reporting to the authorities. ISO 27001 asks you to handle incidents, but not to report them. NIS2 does, with tight deadlines. You need a clear process and people who know what to do, also at night or during the weekend.
- The role of management. Under NIS2, directors must be actively involved, follow training and are personally responsible.
- Your suppliers. NIS2 expects you to look more closely at how secure your key suppliers are.
- Registration. You must register with the CCB and be ready for inspections.
Five practical steps
- Check whether NIS2 applies to you and register with the CCB if it does.
- Look at the scope of your certificate. Does it cover all the activities that fall under NIS2?
- Compare what you have with what NIS2 asks. A gap analysis shows quickly where you stand.
- Close the gaps within your existing approach. Add incident reporting, management training and supplier checks to what you already do, and practice an incident at least once.
- Plan your certification in time, so you are ready well before the deadline.
One approach, not two projects
Don’t treat ISO 27001 and NIS2 as two separate projects. Use ISO 27001 as the foundation and add what NIS2 asks on top. That way you work with one set of rules, one risk overview and one improvement plan, and you are ready for both the auditor and the regulator.
Not sure where you stand? Curios helps organisations in Belgium and across Europe with NIS2 gap analyses, ISO 27001 implementation and vCISO support. Get in touch and we will help you find the shortest route.
