Our organization is already ISO 27001 certified, so I expected that much of the NIS2 work would transfer directly. Our access controls, privileged-account management, audit logging, supplier-management process, Statement of Applicability, and evidence records cover a significant portion of the overlapping requirements.
The main gaps appear to be NIS2-specific operational expectations. Our incident process was not designed around the 24-hour early-warning and 72-hour notification timelines, and NIS2 seems to expect more concrete evidence from suppliers rather than simply having a documented supplier-management process. Smaller vendors may have reasonable security practices but lack formal documentation, which could make evidence collection slow.
Our credential evidence is fairly strong because shared and privileged accounts are managed through a password vault with per-user access logs. However, those records are only as reliable as our joiner-mover-leaver process, which has been inconsistent and needs tightening before we rely on the data too heavily.
With the October deadline approaching, I am deciding between making a smaller number of controls genuinely audit-ready while documenting remediation timelines for the rest, or spreading the effort across everything and ending up with shallow evidence everywhere. I am leaning toward the first option, especially for incident reporting, access reviews, offboarding, and supplier evidence, but I would appreciate practical advice from anyone who has prepared for NIS2 or dealt with a similar regulatory transition. How would you prioritize the work, and how much does the relevant member state's implementation affect the approach?
4 Answers
Your existing vault records are useful, but treat them as supporting evidence rather than proof that the entire access lifecycle works. Reconcile current accounts against HR records, verify recent departures and role changes, test privileged-access reviews, and document exceptions. A short, repeatable evidence-collection schedule will be more valuable than a one-time export assembled just before the deadline.
Do not wait until September to contact smaller suppliers. Give them a clear list of the evidence you need and offer acceptable alternatives where formal certifications are unavailable, such as security questionnaires, policies, incident contacts, access-control descriptions, test summaries, or contractual attestations. Record the requests, responses, gaps, risk decisions, and remediation dates. That evidence trail can show a controlled process even when a supplier cannot immediately provide every document.
ISO 27001 gives you a useful foundation, but it does not automatically satisfy every NIS2 obligation. The exact expectations and registration or reporting process depend on the country where the organization is regulated, and some countries have mapped NIS2 to their own cybersecurity frameworks. Confirm the applicable national law and enforcement guidance before locking in your priority order. An independent gap assessment from someone familiar with both frameworks could also help distinguish genuine gaps from controls you already satisfy with better evidence.
Prioritizing a smaller set of controls that you can actually demonstrate and defend is more sensible than checking every box superficially. Start with the 24-hour early warning and 72-hour notification process because that is operationally different from a typical ISO 27001 incident process and could matter during a real incident, not just an assessment. Define who makes the decision, who gathers the facts, who contacts the authorities, and what evidence is retained. I would also fix the joiner-mover-leaver workflow early, since it affects the reliability of your access and privileged-account evidence.
That makes sense. I was focusing on the quality of the vault logs while overlooking the process that determines whether the underlying account list is complete. I will move the joiner-mover-leaver review and incident escalation exercise closer to the top of the plan.