NIS2 · Directive (EU) 2022/2555
NIS2 compliance on your ISO 27001 base.
NIS2 requires essential and important entities in the EU to manage cybersecurity risks, report significant incidents and hold management accountable. With Basenorm you build those measures on your ISO 27001 ISMS, in one EU-native platform.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Type
- EU directiveIn force in the Netherlands since 15 August 2026 as the Cyberbeveiligingswet
- Applies to
- Essential and important entitiesIn the sectors listed in Annex I and II
- Reporting
- 24 hours, 72 hours, one monthEarly warning, notification and final report
- Accountability
- Management bodyApproves and oversees the measures
01 / What NIS2 asks
What NIS2
asks of you.
NIS2 sets a baseline of risk management measures, incident reporting and governance. The details depend on your sector, your size and the national law that applies to you.
- 1Risk management measures
Article 21: policies for risk analysis and information system security, based on an all-hazards approach.
- 2Incident handling
Detect, handle and recover from incidents.
- 3Business continuity
Backup management, disaster recovery and crisis management.
- 4Supply chain security
Security in your relationships with suppliers and service providers.
- 5Incident reporting
Article 23: for significant incidents an early warning within 24 hours, a notification within 72 hours and a final report within one month.
- 6Management accountability
Article 20: the management body approves and oversees the measures and follows training.
Check the national implementing law for your sector and country.
02 / With your ISMS
NIS2 on what you already have.
| Topic | Your ISO 27001 ISMS | What NIS2 adds |
|---|---|---|
| Risk management | Risk assessment and treatment, Annex A controls | The all-hazards approach and the measures listed in Article 21 |
| Incidents | Incident management controls | Reporting deadlines of 24 hours, 72 hours and one month |
| Suppliers | Supplier relationship controls | Attention to supply chain security and supplier vulnerabilities |
| Governance | Leadership and management review | Accountability and training of the management body |
| Continuity | ICT readiness for business continuity | Backup management, disaster recovery and crisis management |
ISO 27001 and NIS2 share 70 to 80% of their controls according to Basenorm’s published mapping. A certificate alone does not prove NIS2 compliance.
03 / In practice
DIRECTIVE (EU) 2022/2555NIS2 in
practice.
NIS2 is a directive: each member state transposes it into national law. Registration, supervision and fines follow that national law.
Read about ISO 27001In force. The directive entered into force at EU level.
Transposition deadline. Member states had to adopt their national law by this date.
Cyberbeveiligingswet. The Dutch implementation of NIS2 is in force. According to the NCSC it covers more than 8,000 organisations, which must register and report significant incidents within 24 hours.
Source: Directive (EU) 2022/2555. National implementation and dates differ per member state.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also count for NIS2, and what is still missing.
02Governance Graph
Connect risks, suppliers, controls and owners, up to the management body.
03AskNorman
Ask what is still open for NIS2, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
NIS2.
Does NIS2 apply to us?
That depends on your sector, size and role, as set out in Annex I and II of the directive and in national law. Medium-sized and large entities in those sectors are generally in scope, and some entities are in scope regardless of size.
Is ISO 27001 enough for NIS2?
Not on its own. ISO 27001 covers a large part of the measures, but NIS2 adds requirements such as reporting deadlines and management accountability. A certificate is not proof of NIS2 compliance.
What are the reporting deadlines?
For significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
What are the maximum fines?
Up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher.
Does Basenorm report incidents for us?
No. Basenorm helps you record incidents and organise your measures and evidence. Reporting to the authority remains your responsibility.
Book a demo
Build NIS2 on your ISO 27001.
In a demo we look at your scope, your current ISMS and what NIS2 adds.
- Whether and how NIS2 applies to you.
- Which ISO 27001 controls you can reuse.
- How you organise incidents, suppliers and governance.
Hosted in the Netherlands. Your data stays in the EU.