NIS2 vs ISO 27001: Which Does Your SaaS Need First?

One prospect’s questionnaire asks for NIS2 alignment. Another asks for ISO 27001. You have the budget and time to chase one this quarter, not both. So which comes first? The answer depends on who is buying, but there is a shortcut that satisfies the technical part of both at once.

They Are Not the Same Kind of Thing

The first mistake is treating NIS2 and ISO 27001 as competing certifications. They are different categories entirely.

NIS2 is a law. It is an EU directive, transposed into each member state’s national law, that obliges covered companies to manage cybersecurity risk. There is no “NIS2 certificate” you frame on a wall. You demonstrate NIS2 alignment by showing you meet the Article 21 risk-management measures. If you are unsure whether it applies to you, our NIS2 scope self-check walks through the two routes that pull a SaaS in.

ISO 27001 is a certification. It is a voluntary international standard for an information security management system. An accredited auditor assesses you and issues a certificate valid for three years, with annual surveillance audits. It is recognised globally, not just in the EU.

So the honest framing is: NIS2 is an obligation you may be legally bound by, and ISO 27001 is a badge you choose to earn because buyers trust it.

What Each One Signals to a Buyer

The two answer different buyer questions.

An enterprise procurement team in the EU asks about NIS2 because their own supply-chain duty under the directive requires them to. When they ask “are you NIS2 aligned?”, they are discharging a legal obligation and they need evidence they can file.

A buyer anywhere asks about ISO 27001 because it is a widely accepted shorthand for “this vendor has a real security program.” It carries weight in the US, the UK, and beyond, where NIS2 means nothing.

The practical read:

• Selling mostly to EU enterprises? NIS2 alignment is the more urgent ask, because it arrives as a hard requirement in supply-chain reviews.
• Selling globally, or into large accounts that standardise on ISO? ISO 27001 is the badge that opens the most doors, and it partially covers NIS2 expectations too.
• Selling to German entities specifically? NIS2 and the BSI registration duty dominate. See our checklist for German SMBs.

The Overlap Is Larger Than You Think

Here is the useful part. ISO 27001 Annex A controls and NIS2 Article 21 measures cover much of the same technical ground: access control, cryptography, vulnerability management, incident handling, and secure configuration. A control you implement for one counts toward the other.

That means the work is not doubled. If you build an ISO 27001 management system, you are most of the way to demonstrating NIS2 Article 21 alignment. If you document your NIS2 measures first, you have a running start on an ISO audit later.

The external-posture evidence, the part a reviewer can verify without trusting your paperwork, is nearly identical for both:

• TLS configured with no deprecated versions
• Security headers present, including HSTS
• No exposed admin panels, staging environments, or source maps
• Email authentication (SPF, DKIM, DMARC) in place
• No public JavaScript with known CVEs

Both frameworks expect this. Neither certificate nor legal alignment saves you if a reviewer scans your domain and finds TLS 1.0 and an open admin panel.

A Practical Sequence for a Small Team

For a B2B SaaS under 200 people deciding where to spend first, this order works:

1. Fix and prove your external posture now. It is cheap, fast, and required by both frameworks. Run a free external scan and see your A-F grade today. This is the evidence a supply-chain questionnaire asks for, and you can produce it this week.
2. Document your NIS2 Article 21 measures next if you sell into the EU. It is a legal obligation, not an optional badge, and the documentation is lighter than a full ISO audit. Our breakdown of what auditors actually ask for under Article 21 maps each measure to its proof.
3. Pursue ISO 27001 certification when deal sizes justify it. The audit runs €15,000 to €40,000 and takes months. Worth it once enterprise contracts depend on the badge, premature before that.

This sequence front-loads the cheap evidence that closes deals and defers the expensive certification until revenue justifies it.

The Shortcut for the Technical Half

Whichever framework a buyer names, the external-posture section of their review is the same short list, and it is the piece you can answer in 60 seconds instead of 60 days.

SaaSFort scans your domain across 60 external checks, grades it A to F, and maps each finding to both its NIS2 Article 21 control and its ISO 27001 Annex A reference. The one-time audit pack is €39: a branded PDF you attach to a security review under either framework, no subscription and no card on the first scan. It does not replace an ISO certificate or your NIS2 documentation. It answers the observable, technical half of both, which is the part reviewers check first.

Get your NIS2 and ISO 27001 evidence pack for €39

FAQ

Does NIS2 require ISO 27001? No. NIS2 does not mandate any specific certification. It requires you to implement appropriate risk-management measures under Article 21. Holding ISO 27001 helps demonstrate those measures, but it is not compulsory. You can be NIS2 aligned without an ISO certificate.

If I get ISO 27001, am I automatically NIS2 compliant? Not automatically, but you are close. ISO 27001’s Annex A controls overlap heavily with NIS2 Article 21 measures. You would still need to confirm NIS2-specific obligations such as incident reporting timelines and, for German entities, BSI registration. The security controls themselves largely transfer.

Which is cheaper to demonstrate? NIS2 alignment, in the short term. It is documentation of measures rather than a paid third-party audit. ISO 27001 involves an accredited auditor and typically costs €15,000 to €40,000 for a first certification. The external-posture evidence both require is available for far less.

We sell to both EU and US customers. What do we do? Prove external posture first (both need it), then prioritise by revenue. If EU enterprise deals are stalling on NIS2, document Article 21. If US or global accounts want the ISO badge, plan that audit. The overlap means neither effort is wasted.