NIS2 Control Mapping: Reuse ISO 27001 and CIS Work

NIS2 came into force in January 2023, with Member States required to transpose it into national law by 17 October 2024. It applies to medium and large organisations operating in 18 critical sectors, including energy, transport, financial services, healthcare, and manufacturing.

The compliance obligation lives in Article 21 of the directive. It requires in-scope organisations to implement appropriate and proportionate cybersecurity risk management measures, and to demonstrate those measures are operating in practice. Regulators judge programmes on the evidence that required measures are running today.

The 10 Mandatory Measure Areas Under Article 21(2)

Article 21 is deliberately outcome-driven. It sets ten minimum areas every in-scope entity must address, without naming a specific technology or framework to get there.

The October 2024 Implementing Regulation (EU) 2024/2690 added technical and methodological detail on top of these ten areas, targeted at cloud, managed service, and digital infrastructure providers specifically. Organisations in scope for that regulation need to map one level deeper than the ten areas alone. ENISA, the EU Agency for Cybersecurity, published Technical Implementation Guidance for the regulation in June 2025, correlating its requirements directly with ISO 27001, NIST CSF, and other frameworks, with the explicit aim of cutting duplicate audit work across overlapping regimes.

Article 20 adds a governance layer on top of Article 21: management bodies must approve cybersecurity measures, oversee their implementation, and complete security training themselves. Directors can be held personally liable for non-compliance, a real shift from the original NIS Directive.

Treating NIS2 as a new compliance programme feels like the safe choice. New directive, new acronym, new deadline. But it's the more expensive path, and it costs teams months of duplicated work.

NIS2 is outcome-based: it sets the bar as evidence that cybersecurity risk is managed as a repeatable, documented process, without mandating a specific framework to get there. That's exactly what ISO 27001 and CIS Controls already produce.

If your organisation already holds ISO 27001 certification, or has implemented CIS Controls v8.1 at Implementation Group 2 or above, you've covered most of Article 21's ten measure areas already. The mapping leaves genuine gaps, particularly around supply chain security depth and incident reporting timelines, but the foundation is already in place.

Duplication carries a real cost. Teams that treat NIS2 as a standalone programme end up maintaining two separate control sets, two evidence repositories, and two audit cycles for controls that are substantively identical. That pattern builds compliance debt with every audit cycle.

The smarter approach is a crosswalk: map each NIS2 Article 21 requirement to the controls you already own, rate what's covered, what's partially covered, and where genuine gaps remain, then close only those gaps.

This is what ENISA itself recommends. Its Technical Implementation Guidance, published in June 2025, maps Implementing Regulation 2024/2690 requirements directly onto ISO 27001, NIST CSF, and other frameworks, precisely so organisations can avoid running duplicate audits across overlapping regimes.

The mapping exercise runs in three steps: establish your coverage baseline, identify gaps, and prioritise remediation. Here's how each Article 21(2) area maps to ISO 27001:2022 Annex A controls and CIS Controls v8.1.

The NIS2 to ISO 27001 and CIS Controls crosswalk

This crosswalk is illustrative, built from each framework's published control structure rather than reproduced from a single official source. CIS Controls v8.1 has no dedicated Safeguard for governance-level risk policy, which is a structural gap in CIS itself rather than an oversight in the mapping. For certification or audit-grade work, cross-check against CIS's own NIS2 mapping and your ISO 27001 Statement of Applicability directly.

Where ISO 27001 Leaves Genuine NIS2 Gaps

Three areas consistently surface as real NIS2 gaps for ISO 27001-certified organisations.

1. Supply chain security (Article 21(2)(d)): ISO 27001 Annex A covers supplier relationships in A.5.19 through A.5.23, but NIS2 goes further. It requires organisations to assess the security practices of direct suppliers and to take into account the results of coordinated supply chain risk assessments carried out under Article 22. A supplier programme built around questionnaires and contractual clauses alone will need strengthening to meet that bar.
2. Incident reporting timelines (Article 23): ISO 27001 sets no fixed notification clock. NIS2 does: a 24-hour early warning, a 72-hour incident notification, and a final report within one month for significant incidents. Map explicit NIS2 triggers into your incident response plan, tied to the relevant CSIRT (Computer Security Incident Response Team) or competent authority.
3. Board-level governance (Article 20): Directors carry personal accountability for cybersecurity measures under Article 20, and must complete security training themselves. ISO 27001 requires management commitment, but stops short of personal liability or mandatory board-level training. This gap needs a dedicated governance artefact, tracked and evidenced on its own terms.

CIS Controls v8.1 confirms a similar picture. CIS published a formal mapping between CIS Controls v8.1 and Directive (EU) 2022/2555 in April 2025, correlating each Article 21 area with specific CIS Safeguards. The underlying point holds regardless of which framework you run: NIS2 adds regulatory weight and reporting obligations to security practices CIS and ISO already recommend on technical grounds. You’re formalising and evidencing controls you should already have.

Turning the mapping above into a working exercise takes four steps.

Step 1: Populate your existing control inventory

Start with what you already have: for each of the ten Article 21 areas, list the controls you currently operate against that domain. If you're ISO 27001 certified, your Statement of Applicability is the natural starting point. If you're CIS-aligned, your Implementation Group 2 records serve the same purpose. The goal at this stage is an honest picture of current coverage you can build on.

Step 2: Apply the coverage rating

Rate each NIS2 requirement as covered, partial, or a gap. Covered means an existing control directly satisfies the requirement and you hold evidence it's operating. Partial means you have a control, but the evidence is missing, or the control addresses a narrower obligation than NIS2 specifies, a supplier questionnaire without contractual security clauses, for example. Gap means no existing control addresses the requirement, and new work is required.

Step 3: Prioritise the gaps

Not every gap carries equal risk. Weigh each one against two factors: regulatory exposure if the area fails, and operational impact if an incident hits that domain. Supply chain security, incident reporting timelines, and board governance are consistently the highest-priority gaps for ISO 27001-certified organisations. Start there.

Step 4: Document the mapping

The crosswalk becomes a compliance artefact in its own right. When a regulator or auditor asks how your cybersecurity programme maps to NIS2, you hand them the crosswalk. It shows which controls satisfy which requirements, what the evidence is, and what remediation is already under way for any gaps.

This turns “we're working on NIS2” into “here's our NIS2 control coverage, evidenced,” and regulators respond very differently to those two answers.

A crosswalk built once has a shelf life. A control rated 'covered' in January can drift to 'partial' by June if the evidence hasn't been refreshed, a supplier list has changed, or a framework has released a new version. Keeping that picture current by hand across ISO 27001, CIS Controls, NIS2, and any other framework your organisation answers to is a genuine ongoing burden.

SureCloud's Compliance Management platform is built for governance, risk, and compliance (GRC) teams juggling more than one framework, with a named Persona doing the mapping work instead of a person maintaining it by hand. A Compliance Persona inside Gracie AI Agents with Personas and Skills holds the ISO 27001, CIS Controls, and NIS2 mappings as live data: when evidence is collected against one control, every framework that references it sees the update, and a flagged gap creates a remediation task, owned and tracked automatically.

This matters in practice: teams running NIS2 alongside DORA, ISO 27001, and other frameworks share evidence across all three instead of collecting it three separate times, and evidence retrieval for a regulator's request happens in minutes rather than days. Control coverage stays visible in real time.

The 10-in-1 SureCloud Controls Framework is the operational version of the crosswalk in this guide: one control, tested once, satisfies multiple standards. Teams managing NIS2 alongside an existing ISO 27001 or CIS programme see a 50-65% reduction in manual evidence collection as a direct result.

Most of that operational detail, connecting evidence sources, running incident workflows, and generating board packs, is what separates a spreadsheet crosswalk from a NIS2 compliance software platform built to operate day to day.

The NIS2 deadline has passed, and enforcement is active. The path to compliance for most organisations is a structured gap analysis against controls already in place.

Run the crosswalk. Rate coverage honestly. Close the three gaps that matter most: supply chain security, incident reporting timelines, and board-level governance accountability. Then build the evidence trail that shows regulators the programme is live and operating.