NIS2 and ISO 27001 do not answer the same question.
NIS2 scope depends on applicable law and the facts of the organisation. ISO 27001 is a management-system standard and may be a customer or governance choice. Overlap does not make one a substitute for the other.
The short version.
Keep legal scope and certification choices separate.
NIS2 scope depends on applicable law and the organisation's facts. ISO 27001 is a separate standard and certification choice.
Check the current position in primary sources.
Dated guidance and general descriptions cannot replace an assessment of the organisation's specific position.
A customer requirement is not direct regulatory scope.
A customer may ask for evidence or certification without that request determining the supplier's legal status.
Reuse controls and evidence, not conclusions.
The same material may support both workstreams, but each decision still needs its own owner, source and professional boundary.
Examine NIS2 scope when:
- The organisation's sector, size, services or other facts may place it within direct legal scope
- A regulator request or customer clause relies on a particular scope position
- Management needs to distinguish a legal duty from a supplier requirement
- The current position cannot be traced to applicable primary text or qualified legal advice
Examine the ISO 27001 choice when:
- A named customer or market process requires certification
- Management wants a documented management system as a separate governance choice
- The intended scope of a possible certificate is unclear
- Ownership, existing evidence and the external certification role are not clearly separated
Some organisations must handle both questions.
When both questions are live, controls and evidence may be reused. The conclusions must still remain separate and sit with the right decision owners.
Bring the work together while keeping the decisions separate.
A focused engagement can map existing evidence, overlap, distinct requirements, and decision owners. Certification remains the role of an independent certification body, and legal scope requires appropriate legal advice.
Start with the scope question.
Use the decision tree to identify the facts and sources that need to be checked. It is not a legal determination.
Open the NIS2 scope decision treePut the requirement into a plan that leadership and the responsible people can run.
A requirement becomes useful only when the company has chosen the goal, assigned responsibility, planned capacity and supplier contributions and agreed how the result will be checked. Accel Comply can advise leadership and lead the agreed work from decision to handover.
Which decision is blocking the work?
Describe the customer requirement, the possible legal position and the owner who is missing. The conversation does not promise a legal conclusion.
You will receive a direct answer on fit, what the first deliverable could be and what information is needed to begin.