NIS 2 and ISO 27001: the practical mapping in Luxembourg

At a glance — ENISA’s Technical Implementation Guidance (26/06/2025) provides NIS 2 ↔ ISO/IEC 27001/27002 correspondences and, crucially, expected examples of evidence. Key point: no 1‑to‑1 mapping; you must evidence implementation per Implementing Regulation (EU) 2024/2690, which the ILR references in Luxembourg.

The matter

• Authority and date — ENISA, Technical Implementation Guidance v1.0 (26/06/2025) with mapping tables and « examples of evidence ». Press and publication: enisa.europa.eu.
• Anchor text — Implementing Regulation (EU) 2024/2690 of 17/10/2024: technical and methodological requirements under Article 21(2) NIS 2, plus sectoral thresholds for “significant incidents”. Full text: eur-lex.europa.eu.
• Luxembourg context — The ILR officially points to 2024/2690 and ENISA resources. See ILR – Implementing Regulation and ILR – Security Measures.

For a local roadmap, refer to our NIS 2 framework in Luxembourg and, for assessment, our cybersecurity and ISO 27001 audit.

The legal reasoning

• Legal basis — NIS 2 Article 21 mandates cybersecurity risk-management measures. Regulation 2024/2690 specifies the “how” for relevant entities across 13 requirements (security policy, risk/incident management, business continuity/crisis, supply chain, acquisition/development, effectiveness evaluation, hygiene/training, cryptography, HR security, access control, asset management, physical/environmental security). Text: eur-lex.europa.eu.
• Reference to standards — Recital (3) aligns with ISO/IEC 27001/27002 and other standards, with proportionality (size, criticality, exposure, impact). ISO 27001 helps but does not by itself prove compliance with 2024/2690.
• ENISA guidance — Implementation parameters, examples of evidence, and mappings to ISO/IEC 27001/27002: ENISA publication and PDF.

What changes in practice

For Luxembourg entities in “network and digital services” (cloud, MSP/MSSP, DC, CDN, online platforms…), compliance goes beyond ISO 27001 certification:

1. Evidence implementation (2024/2690) — Example “Access control” (item 11): beyond a policy and SoA, produce living evidence (signed access reviews, prod/non‑prod separation, phishing‑resistant MFA, privileged elevation traceability). See ENISA’s « examples of evidence » (PDF).
2. Supply chain security (item 5) — Dedicated policy, evaluation criteria, minimum contractual requirements, audit/assurance evidence (certificates, SOC 2 Type II, shared vulnerability scans), and consideration of coordinated assessments (Art. 22(1) NIS 2). EU cybersecurity certifications (Reg. 2019/881) may support. Text: eur-lex.europa.eu.
3. Effectiveness evaluation (item 7) — A formal procedure linked to risk results, the BIA (4.1.3) and asset classification (12.1). Sample indicators: detection rates on critical use cases, orphan access revocation time, logging coverage. See Annex 2024/2690.
4. Continuity and crisis (item 4) — BIA, scenarios, tests and lessons learned, with demonstrable deliverables expected by the ILR: ILR – Security Measures. For BIA/BCP/DRP orchestration, see our business continuity and recovery support.
5. Local expectations — ILR will assess against 2024/2690 and ENISA guidance: ILR references.

Common pitfalls

• Certification ≠ regulatory compliance — ISO 27001 does not automatically cover the 13 Annex requirements (supply chain, measured effectiveness, BIA artefacts). Auditors will request ENISA‑listed « evidence » (ENISA).
• Forgetting proven proportionality — Justify control levels by criticality, exposure and impact (recital 4): 2024/2690.
• Reducing supply chain to an annex — Item 5 expects a policy, evaluation criteria, coordinated assessments and EU certifications where relevant (Eur‑Lex).
• Neglecting traceability — Verifiable artefacts: logs, tickets, review minutes, IAM exports (see ENISA PDF).
• Missing “significant incident” thresholds — Integrate sectoral criteria from 2024/2690 into detection/notification and playbooks.

Act now

Start from the 2024/2690 Annex, use ENISA’s guidance as your operating manual, and build an evidence dossier per requirement. In Luxembourg, align deliverables with ILR references. For operational steering, an outsourced CISO can structure your ISO/NIS 2 mapping, and for local context see NIS 2 Luxembourg (ILR).

Need a quick review of your posture? Get in touch.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.