NIS2 + ISO 27001 Certification: 12-Month Path

Main article: Building an ISMS — building an ISMS under NIS2 and ISO 27001 step by step.

What an ISO 27001 certification delivers for NIS2 — and what it does not

It is a means of evidence, not an obligation. In Germany, § 30(1) BSIG requires particularly important entities and important entities to take appropriate, proportionate and effective technical and organisational measures — and to document compliance with them. A certificate is not prescribed for this. The link to the standard is set out in § 30(2) sentence 1 BSIG: the measures "shall reflect the state of the art, take into account the relevant European and international standards, and must be based on an all-hazards approach". This is precisely the role played by ISO/IEC 27001:2022 — as a relevant international standard against which an ISMS can be aligned.

In practice, the certificate delivers two things: the underlying standard addresses the requirements of Section 30 BSIG structurally in all ten areas, but is congruent with them in none (mapping and gaps below); and the documents produced in the certification process can support the documentation under § 30(1) BSIG (months 9-10). Towards customers and business partners, the certificate can also serve as external evidence of the ISMS — a practitioner assessment, not a legal consequence. It carries statutory weight in one place: operators of critical installations must demonstrate the implementation of the measures under § 30(1) in conjunction with § 31 BSIG by means of security audits, examinations or certifications — at a point in time set by the BSI, at the earliest three years after first qualifying as an operator and every three years thereafter; the results, including any security deficiencies identified, must be transmitted (§ 39(1) BSIG). For all other particularly important entities and important entities, certification is a business decision.

§ 30(2) BSIG mapped onto ISMS building blocks

Each of the ten areas of measures under § 30(2) BSIG has a counterpart in the Annex A controls of ISO 27001. This mapping belongs in the Statement of Applicability (SoA), which records which controls are applicable. The column "gap likelihood" shows where experience indicates that remediation is needed even with a certified ISMS. The Austrian counterpart is set out in § 32(4) NISG 2026: likewise ten areas in the same order, designated (a) to (j).

The depth of implementation scales with risk: Section 30 BSIG requires appropriate and proportionate measures, not the same level of maturity in all ten areas. Where the focus lies follows from the risk analysis — and the SoA records which controls are applicable and why.

The gaps the certificate does not close

Three sets of obligations regularly remain open even with a valid certificate — they are independent statutory obligations that a passed ISMS audit does not discharge. First, the reporting chain for significant security incidents — in Germany with three deadline-bound stages (24 hours, 72 hours, one month) and an event-driven intermediate report at the request of the BSI:

In Austria the same deadline-bound stages with the same deadlines apply; there the addressee is the competent sector-specific CSIRT or, in the absence of one, the national CSIRT (§ 34(1) and (2) nos. 1 to 5 NISG 2026).

Second, supply-chain due diligence under § 30(2) no. 4 BSIG — frequently objected to in audit practice, based on experience (practice assessment). In practice, its content comprises: supplier assessment with risk classification, cybersecurity clauses in the standard contracts, a right to audit for critical suppliers, and incident notification by suppliers within a maximum of 24 hours. Third, the obligations of the management body under Section 38 BSIG: implementation and monitoring of the measures (subsection 1 — this responsibility cannot be delegated), personal internal liability for damage caused culpably under the company law applicable to the legal form (subsection 2), and regular attendance at training (subsection 3). In addition, there is the registration under § 33(1) BSIG, at the latest three months after an entity first qualifies as a particularly important entity or an important entity; the BSI points out that the statutory registration deadline has already expired, and that a missing registration can be made good.

Months 1-2: scope + preparation

In the first two months, an ISMS officer is appointed, the scope is defined, the gap analysis is carried out and the roadmap is set.

On the roadmap: the monthly figures are a practitioner recommendation for the route to certification, not a statutory schedule. The obligations under Section 30 BSIG have applied in Germany since 6 December 2025 without a transition period — the certification path does not extend them.

The scope determines which processes (all, only critical ones, or specific ones), which sites, which IT systems and which subsidiaries fall within the ISMS. For SMEs subject to NIS2, the practitioner recommendation is to bring the entire company into scope — otherwise a certified area sits alongside a remainder for which the obligations of Section 30 BSIG apply unchanged. The ISMS is led by the ISMS officer (Information Security Officer, CISO), who has authority to issue instructions; responsibility under § 38(1) BSIG remains with the management body and cannot be delegated. In group structures the rule is: if each subsidiary is affected in its own right, it needs its own measures — the parent company can prescribe a central ISMS policy and central measures, and the subsidiary implements them operationally; contracts and delegation chains should be documented. German and Austrian companies register separately in both countries.

The gap analysis uses the mapping table as a grid: for each of the ten areas of measures under § 30(2) BSIG, the current state is recorded and compared with the assigned Annex A controls. As a practitioner recommendation, every gap becomes a roadmap entry with an owner and a target date; the column "gap likelihood" shows where to look first based on experience.

Two obligations that the later certificate does not cover also belong in this phase: the registration under § 33(1) BSIG (Austria: § 29(2) and (3) NISG 2026) and the management body's first attendance at training under § 38(3) BSIG (Austria: the training obligation for management bodies under § 31 NISG 2026). Both belong in the roadmap with their own dates, not in the certification cycle.

Months 3-6: build-up

In months 3 to 6, the policy set, the risk assessment, the SoA, the asset inventory and the training are produced.

The risk work runs in six steps: asset inventory (all IT assets, data classes, business processes), threat analysis per asset (for example ransomware, data breach, outage), vulnerability assessment of the current level of protection, a risk score from likelihood of occurrence × extent of damage, a treatment decision (reduce, accept, transfer, avoid) and finally the Statement of Applicability determining which controls are applicable. For the threat analysis, the benchmark is the all-hazards approach of § 30(2) sentence 1 BSIG; the three scenarios named are typical examples, not an exhaustive list.

In practice, a policy set has become established as the document set, typically comprising: information security policy (top level), acceptable use, access control, cryptographic controls, backup and recovery, patch management, incident management, supplier management, mobile device and BYOD, clear desk and clear screen, password policy, physical security. Two of them carry obligations that the certificate does not cover: the incident management policy must reflect the reporting chain tabulated above, including deadlines and addressee, and must ensure the availability that an early warning within 24 hours of becoming aware presupposes. The supplier management policy takes up the four elements of supply-chain due diligence under § 30(2) no. 4 BSIG named above; the maximum of 24 hours mentioned there is a contractual and practitioner figure, not the statutory reporting deadline of § 32(1) no. 1 BSIG.

For the training under § 30(2) no. 7 BSIG (basic training and awareness-raising measures), the following have proven effective in practice: onboarding training within the first four weeks, annual training for all employees with a quiz, quarterly phishing simulations with click-rate monitoring, and sector-specific in-depth training, for example SCADA training in industry. These rhythms are practitioner recommendations, not statutory deadlines.

Months 7-8: trial operation

In months 7 and 8, the internal audit, the gap remediation, the CAPA process and the management review take place.

The internal audit covers the complete ISMS scope and is carried out by an independent internal auditor or an external auditor. ISO/IEC 27001:2022 requires internal audits "at planned intervals" — annually is the usual practice, not the wording of the standard, and certainly not a NIS2 obligation: Section 30 BSIG does not prescribe an audit frequency.

In the management review, the management examines the audit report, incidents and changes in risk; deviations enter the CAPA process (corrective and preventive actions); as a practitioner recommendation, every deviation is documented with a root-cause analysis, a corrective action, an owner, a target date and a subsequent effectiveness check — the same system later carries the deviations from the stage 2 audit. Practitioner recommendation: the reporting chain belongs within the scope of the internal audit — otherwise, whether an early warning actually goes out within 24 hours of becoming aware only becomes apparent in a real emergency.

What the law requires at this point is more narrowly worded and at the same time permanent: § 30(2) no. 6 BSIG requires policies and procedures to assess the effectiveness of the risk-management measures — without prescribing a frequency. In practice this is handled through KPIs per area (for example patch compliance rate, phishing click rate, recovery time), quarterly reporting to the management body, an annual penetration test and an external audit every two years — a practitioner benchmark for effectiveness assessment that sits alongside the annual surveillance audit and recertification every three years (months 11-12), not in their place.

Months 9-10: stage 1 audit

In stage 1, the external certification body examines the documentation; any gaps identified are remedied before stage 2.

In practice, what is presented is exactly what was produced in months 3 to 8: the ISMS policy, the risk register, the risk treatment plan, the SoA, the policy set, and the records of the internal audit and the management review. The same documents can at the same time support the documentation under § 30(1) BSIG, which requires compliance with the measures to be documented — the gaps identified in the mapping remain unaffected by this. Where gaps are noticed, the "gap likelihood" column of the mapping table prioritises the rework — with the supply chain at the top (§ 30(2) no. 4 BSIG). This matches three findings that experience shows are frequent in audit practice (practice assessment): missing cybersecurity clauses in contracts, no documented KPIs, no phishing simulation.

Months 11-12: stage 2 audit

In stage 2, the certification body examines on site and on a sampling basis whether the ISMS is effective; at the end there is the certificate, valid for three years.

In practice, the samples cover the controls that the SoA identifies as applicable, and the evidence produced for them in operation: the risk register with the treatment decisions, the record of the internal audit and the outcome of the management review. Therefore, not only the ISMS officer should be available on site, but also the process owners for the ten areas of measures under § 30(2) BSIG and the management body responsible for the management review — under § 38(1) BSIG it is responsible for implementation and monitoring in any event. Deviations uncovered by the sampling enter the CAPA process described in months 7-8 and, in practice, are remedied before the certificate is issued.

With the issuing of the certificate, the ISO certification cycle begins: a surveillance audit annually, recertification every three years — a standards cycle, not a NIS2 deadline. For operators of critical installations, this certification can at the same time support the statutory evidence under § 39(1) BSIG, in which security audits, examinations and certifications stand side by side. For all other particularly important entities and important entities, the ongoing documentation obligation under § 30(1) BSIG remains — as do the three sets of obligations that the certificate does not close.

Costs + effort

The costs of certification are spread across three items: the certification body (stage 1 and stage 2 audits, then annual surveillance audits and recertification), external consultancy where it is brought in, and in-house effort — as an experience value 50–150 person-days. The amounts depend above all on the scope, company size, maturity of the existing ISMS and the chosen certification body and should be clarified by way of quotes.

What can be planned above all is the effort; the following are experience values: those who already operate a certified ISMS should expect 3 to 6 months and around 0.5 full-time equivalents for the NIS2 adjustment; without an ISMS it is 9 to 12 months of build-up and around 1 full-time equivalent. For ongoing operation, practice indicates around 0.5 full-time equivalents for ISMS maintenance. The 12-month path in this article therefore represents the build-up case — it is not a deferral of the obligations that have applied in Germany since 6 December 2025 (Austria: applicable from 1 October 2026).

Austria: § 33 NISG 2026 instead of § 39 BSIG

In Austria, the route to evidence does not run via a periodic audit obligation but via a self-declaration: essential entities and important entities transmit structured information on the risk-management measures implemented to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) within twelve months after the registration obligation arises (§ 33(1) NISG 2026). Upon request, implementation must be demonstrated within two years by an independent body; essential entities must demonstrate operational and organisational implementation within as little as two months of being requested to do so (§ 33(2) NISG 2026). The first such request may be made at the earliest two years after the NISG 2026 enters into force.

The timetable behind this: the NISG 2026 (BGBl. I Nr. 94/2025, promulgated on 23 December 2025) becomes applicable on 1 October 2026; registration with the Cybersecurity Authority must take place within three months of entry into force (§ 29(2) and (3) NISG 2026), and changes to the core data must be notified within two weeks (§ 29(4) NISG 2026). The catalogue of measures is set out in § 32(4)(a) to (j), the obligations of management bodies in § 31 NISG 2026 — the NISG 2026 does not contain an express internal-liability provision modelled on § 38(2) BSIG. Nor does it provide for an annual audit obligation.