NIS2
EU directive for cybersecurity resilience in critical sectors
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
NIS2 mandates cybersecurity resilience for EU critical sectors with strict reporting and fines, while ISO 28000 offers voluntary supply chain security certification globally. Companies adopt NIS2 for regulatory compliance; ISO 28000 for risk reduction and market trust.
NIS2
Directive (EU) 2022/2555 (NIS2)
Key Features
- Expands scope to medium/large entities across sectors
- Mandates strict 24/72-hour incident reporting timelines
- Enforces direct senior management accountability
- Requires continuous risk and supply chain management
- Imposes fines up to 2% global turnover
ISO 28000
ISO 28000:2022 Security management systems — Requirements
Key Features
- Risk-based supply chain security management system
- PDCA cycle for continual improvement and audits
- Supplier interdependency and third-party governance
- Integration with ISO 27001, 22301 standards
- Incident response and recovery planning
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
NIS2 Details
What It Is
NIS2 Directive (Directive (EU) 2022/2555) is an EU regulation expanding the original NIS to achieve high cybersecurity across member states. It targets essential and important entities in 18 sectors via a size-cap rule (50+ employees or €10M turnover). Adopts a risk-based, continuous assurance approach over static compliance.
Key Components
- Four pillars: risk management, incident reporting, business continuity, corporate accountability.
- Strict timelines: 24-hour early warning, 72-hour notification, one-month final report.
- Measures include supply chain security, access controls, encryption, training.
- Aligns with ISO 27001, NIST; enables spot checks, no formal certification.
Why Organizations Use It
- Mandatory compliance avoids fines up to €10M or 2% global turnover.
- Builds resilience against threats, protects infrastructure.
- Enhances trust, reputation; drives strategic cyber maturity.
- Supports cross-border cooperation, incident sharing.
Implementation Overview
Applies EU-wide to medium/large entities in critical sectors. Involves risk assessments, policies, reporting setup, management training. Member states transposed by Oct 2024; ongoing audits, spot checks required. Enterprise-wide transformation leveraging existing standards.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international management system standard titled Security and resilience — Security management systems — Requirements. It provides a risk-based framework for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain protection against threats like theft, sabotage, and disruptions.
Key Components
- Core clauses: Context, leadership, planning, support, operation, performance evaluation, improvement (PDCA-aligned).
- 10 main clauses emphasizing risk assessment, controls, supplier governance, incident response.
- Built on ISO High Level Structure (HLS) for integration with ISO 9001, 27001, 22301.
- Optional certification via accredited bodies per ISO 28003.
Why Organizations Use It
- Reduces incident costs, insurance premiums; enables trade facilitation.
- Meets contractual/regulatory drivers (e.g., C-TPAT equivalents).
- Enhances resilience, stakeholder trust, competitive edge in logistics, manufacturing.
Implementation Overview
- Phased: Gap analysis, risk assessment, controls deployment, audits (6-36 months).
- Scalable for all sizes/industries; requires supply chain mapping, training, continual improvement.
Key Differences
| Aspect | NIS2 | ISO 28000 |
|---|---|---|
| Scope | Cybersecurity risk management, incident reporting for critical sectors | Supply chain security management system, risk-based controls |
| Industry | Essential/important entities in EU sectors like energy, transport | Logistics, manufacturing, any supply chain organizations globally |
| Nature | Mandatory EU regulation with national transposition | Voluntary international certification standard |
| Testing | Incident reporting, national authority oversight, spot checks | Internal audits, management reviews, third-party certification audits |
| Penalties | Fines up to 2% global turnover or €10M | Loss of certification, no legal fines |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about NIS2 and ISO 28000
NIS2 FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
CIS Controls v8.1, Operationalized: Top 10 Reasons Compliance Monitoring Software Accelerates Real-World Implementation
Operationalize CIS Controls v8.1 with compliance monitoring software. Turn checklists into dashboards, tickets, and audit-proof workflows. Top 10 reasons it acc
Beyond Reactive: Transforming Compliance into Real-Time Threat Prevention
Discover how modern compliance monitoring tools leverage continuous, real-time oversight and automated alerts to shift organizations from reactive problem-solving to proactive threat detection and prevention, safeguarding against emerging risks before they escalate.
How to Implement CIS Controls v8.1 as a ‘Control Backbone’ for NIS2 & DORA (Step-by-Step Implementation Guide)
Deploy CIS Controls v8.1 as a control backbone for NIS2 & DORA compliance. Step-by-step roadmap (IG1→IG2), deliverables, metrics & evidence model for hybrid/clo
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
COPPA vs C-TPAT
Compare COPPA vs C-TPAT: Child privacy law meets supply chain security. Decode rules, fines ($170M YouTube case), compliance tips for apps & trade. Boost protection now!
PIPEDA vs AS9100
Compare PIPEDA vs AS9100: Canada's privacy law meets aerospace QMS standards. Uncover differences, compliance tips & strategies for seamless integration. Boost your ops now!
ISO 9001 vs HIPAA
ISO 9001 vs HIPAA: Compare global QMS standard for quality excellence with healthcare privacy rules. Discover ISO 9001 benefits, PDCA principles, certifications & adaptations like ISO 13485. Boost compliance now!