NIS2 and ISO 27001: What Certification Covers—and What Is Still Needed for KSC Compliance

In many organisations, the NIS2 discussion begins with ISO 27001 certification. That is understandable, but it is the wrong starting point for senior management and process owners. The first step is to establish whether the organisation is subject to the relevant obligations, which services and assets are affected, and who is accountable for them. Only then can the organisation assess reliably what its current information security management system actually covers and what remains to be addressed for compliance with Poland’s National Cybersecurity System Act (KSC). In practice, this is where the difference between a controlled management system and a costly illusion of readiness becomes clear.

The most expensive mistake: treating certification as proof of compliance

The most serious initial mistake is not the absence of ISO 27001 certification. It is assuming that holding a certificate establishes compliance with obligations arising from NIS2 and the Polish legislation implementing it through the KSC framework. For senior management, the right question is not “Do we have ISO 27001?” but “Are we in scope, in what capacity, and in relation to which services, processes and assets?” Only after confirming the entity’s status, the activities covered by the requirements and management’s accountability can the organisation determine whether its existing system genuinely supports compliance or merely creates an appearance of control.

This distinction has direct implications for project scope and budget. A certificate confirms that a management system conforms to the standard within a defined certification scope, normally stated on the certificate and further supported by the Statement of Applicability. It does not replace an assessment of statutory obligations, identification of relevant services, evaluation of supplier dependencies or determination of the formal actions required of a regulated entity. Management should therefore distinguish between three areas that are often conflated: the management system, regulatory compliance and operational readiness to act under incident conditions.

Projects become most expensive when this sequence is reversed. The organisation first tidies its documentation and controls for the certification audit, only to discover later that critical processes, incident-reporting obligations, supplier requirements, management responsibilities or sector-specific requirements fall outside the scope. At that point, adding a few procedures is not enough. The system boundary, decision-making roles and response arrangements may all need to be redesigned.

From an operational perspective, the organisation should measure more than the existence of a certificate. Three issues matter in particular: alignment between the certification scope and critical services, the outcome of the KSC applicability self-assessment, and the number of gaps between documented procedures and the actual ability to respond. The natural first step is therefore not to produce more documentation, but to determine whether the organisation falls within the scope of the obligations and which formal actions are required. This sequence is also addressed in NIS2: self-assessment and entry in the KSC register—what must a manufacturing company do? This is where an organisation establishes whether it is building its system around real obligations or around a convenient but costly illusion of readiness.

What ISO 27001 covers in practice—not merely on paper

The primary practical value of ISO 27001 is not the certificate itself. A properly implemented system establishes information security as a managed business discipline. It provides its strongest support where the organisation needs a process-based approach: risk assessment and risk treatment, policies and governance controls, assignment of roles and responsibilities, identification of information assets, incident response, business continuity, and mechanisms for review and continual improvement. Where these elements operate in practice rather than solely for audit purposes, the organisation has a robust basis for demonstrating that information security is not a collection of isolated safeguards but a managed system connected to operational decision-making.

Senior management should nevertheless assess the certificate in terms of its relevance to services, processes and dependencies with regulatory significance. The same certificate may represent either a mature system covering critical processes, regular reviews, corrective action and effective process-owner oversight, or a narrowly defined arrangement limited to one part of the organisation. Before assessing readiness against NIS2 and KSC requirements, the organisation should therefore examine more than its Statement of Applicability. It should review the processes included in risk assessments, internal audit results, management review outputs, and whether risk decisions are reflected in budgets, contracts, service architecture and response arrangements.

This is particularly visible in supply-chain environments. ISO 27001 commonly helps structure contractual requirements, information classification, access rules, supplier responsibilities and the recording of exceptions. This is a useful foundation, especially where customers expect evidence of supplier oversight. It does not, however, automatically satisfy every industry expectation or sector-specific criterion. A similar issue is considered in ISO 27001 or TISAX—which should you choose when a customer requires information security across the supply chain? In practice, certification helps organise relationships and accountability, but it does not replace an assessment of the additional obligations that may need to be incorporated into contracts, escalation procedures and oversight of outsourced services.

The conclusion is straightforward: certification can significantly shorten the route to a controlled information security environment, but it is not standalone evidence that KSC obligations have been met. A certification audit assesses conformity of the management system with the standard within its defined scope. This is not identical to an assessment of statutory obligations or operational readiness. The organisation should therefore verify in parallel whether the system scope includes relevant processes, whether the risk assessment reflects actual services and dependencies, and whether incident response, continuity and supplier-control procedures work in practice.

Where certification is not enough

The first gap concerns regulatory compliance itself. An information security management system structures rules, roles and oversight, but it does not automatically determine whether an entity has been correctly classified under the KSC framework, who is responsible for formal notifications, who manages relations with the competent authority, or how decisions are escalated to senior management. This is not simply a missing document; it is a weakness in the accountability model. Unless these elements are embedded in the company’s actual operating model, certification provides internal structure but not yet effective regulatory control.

The second gap concerns scope. Many organisations hold certification limited to a particular site, legal entity, function or group of supporting services. KSC readiness, however, must be assessed against the actual map of services, critical processes, assets and dependencies—not the boundaries of the certification audit. If an essential or important service is delivered by several group entities with support from an external data centre, a shared maintenance team or a distributed incident-response process, a formally valid certificate may cover only part of the operating model. In this situation, management must decide not merely whether to extend certification, but whether to establish one integrated compliance programme or two coordinated workstreams: one for certification and one for regulatory readiness.

The third gap concerns evidence and usually becomes apparent only during an incident, exercise or inspection. The organisation may have procedures for incident response, business continuity and supplier oversight but be unable to demonstrate that these arrangements operate effectively. It may lack an incident register, records of management decisions, exercise results, post-incident reviews, performance indicators or documented corrective actions. In this condition, the system is described but not evidenced. This is often where the most expensive remediation begins, because the organisation must change not only its procedures but also management reporting, review cycles and process-owner accountability. The same pattern can be seen in other management systems, including the issues discussed in IATF 16949—which requirements cause the greatest operational difficulty, and how can they be managed without merely creating an appearance of conformity?

The fourth gap concerns the supply chain and external dependencies. The standard helps structure supplier requirements, but KSC compliance may require more detailed mapping: which outsourced services support critical service delivery, where single points of failure exist, which disruption scenarios are credible, and how replaceable a supplier, key personnel or location would be. In practice, organisations should measure more than whether contracts and supplier assessments exist. They should evaluate alignment between the certification scope and the actual critical-service map, the completeness of incident and exercise records, and the currency of supplier and dependency reviews. Only this combined view shows whether the organisation has a functioning system or merely its formal representation.

Build the compliance programme around services, not documents

A common starting error is to open the project with a review of ISO 27001 policies, procedures and records rather than asking which services must actually be maintained and which regulatory obligations apply to them. The correct sequence is the reverse: first identify the services, processes, assets and dependencies that are critical from the perspectives of continuity and KSC accountability; then map the relevant management-system and evidence requirements to them. This approach is the only reliable way to distinguish necessary documentation from documentation that adds no operational value.

For senior management, this means authorising the development of a critical-service map, a view of supplier and system dependencies, and an inventory of existing procedures that can be reused without duplicating controls. Only then does it become clear whether the current system covers what matters for service continuity and compliance, or merely what was historically included in the certification scope.

The second step concerns the accountability model. Where information security is distributed across IT, quality, compliance, maintenance and procurement without clearly assigned roles, the project quickly becomes a collection of local initiatives. The organisation must establish who owns each risk, who manages incidents, who oversees supplier relationships, who takes management decisions and who maintains compliance evidence. In practice, a straightforward responsibility matrix and a single management-review cycle are usually more effective than multiple parallel reporting lines. This is also the point at which to decide whether one steering committee should oversee compliance and security, and whether operational technology should be included in the same risk-management model.

This logic is particularly important in manufacturing and multi-site organisations. An incident in these environments may involve more than a loss of data confidentiality. It can stop a production line, disrupt planning, compromise batch traceability or remove the ability to deliver a service. Information security must therefore be linked to operational continuity, maintenance and operational technology environments. If the management system covers only office systems while excluding control systems, remote servicing, dependencies on integrators or site-level emergency arrangements, the risk picture may appear formally controlled while remaining operationally incomplete. The same project discipline applies in other highly controlled sectors, including those addressed in ASME, NQA-1 and ISO 19443—three references every nuclear supplier should know.

Once this foundation is in place, the existing ISO 27001 system can be used as the baseline for a separate KSC gap assessment. Such a review does not challenge the validity of the certificate. Its purpose is to identify where genuine coverage already exists and where additional procedures, registers, escalation paths or operating evidence are required. This approach limits unnecessary documentation and provides better control over the consistency of arrangements than separate, competing implementation projects.

How to verify the actual position before an audit or inspection

Before an audit, self-assessment or inspection, the organisation should not ask merely whether it “has ISO 27001”. It should determine whether it can demonstrate operational readiness and decision accountability. This readiness should be assessed across four layers: first, confirm scope and applicable obligations; second, review the management-system design; third, test process effectiveness; and fourth, verify the completeness of evidence. Only this structure distinguishes document control from operational capability.

The most useful questions are therefore not “Do we have a procedure?” but “Do we know when to activate it, who makes the decision, what the escalation thresholds are, how we will evidence the response, and whether we have exercised the scenario?” If incident handling depends on one person’s knowledge, supplier relationships contain no assigned security criteria, and management receives only general reports without decisions or deadlines, the system may conform to its own documented description while remaining unprepared for action under pressure.

The readiness review should therefore examine the interfaces between management, operations, IT, maintenance and suppliers, because gaps that remain invisible within individual procedures usually emerge at these boundaries. In practice, the most effective method is a gap assessment conducted in a form similar to an operational audit. This involves reviewing not only document content but also decision flows, escalation paths, incident records, test and exercise results, and the registers of nonconformities, observations and corrective actions.

A simple scenario provides a useful test: an incident occurs at a key supplier or a disruption affects the production environment. The organisation must establish who classifies the event, who initiates communication, who assesses the effect on service delivery and what evidence of those decisions will remain. If the answers are fragmented and the organisation relies on an established “practice” that cannot be reconstructed from records, readiness is only apparent—even where the management system is otherwise properly maintained.

If the organisation already conducts ISO 27001 internal audits, they can provide an effective vehicle for this verification. The audit criteria must, however, be extended to include applicable regulatory obligations and the evidence expected under the KSC framework. Audit capability is highly valuable here, as are the competencies developed by lead auditors and internal auditors. A useful related reference is ISO 27001 Lead Auditor: a practical guide to certification and the standard’s requirements. The sequence must nevertheless remain clear: audit competence helps evaluate the system, but it does not replace the analysis of which legal and organisational obligations actually apply to the company.

The management decision: use certification as a foundation, not an alibi

The most rational approach is to treat ISO 27001 as a foundation for management control—not as standalone proof that every obligation arising from NIS2 and the KSC framework has been met. Certification helps structure accountability, risk assessment, incident oversight, auditing and continual improvement. It does not remove the need to determine which obligations apply to the organisation, what their scope is and which evidence will be required to demonstrate operational effectiveness.

For senior management, the most significant risk is not a documentation gap but an illusion of readiness: the belief that a certified system is automatically prepared for the requirements of the Polish legal framework. The decision should therefore not be limited to whether certification should be maintained or extended. Management should first resolve three issues:

• confirm the organisation’s status and the scope of applicable obligations,
• perform a gap assessment between the current system and KSC requirements,
• establish the governance model for actions and evidence of effectiveness.

Only on this basis can the organisation decide whether it needs to extend the certification scope or whether it can retain the existing ISO 27001 scope while adding the missing legal, organisational and operational arrangements. Three practical management tools are particularly useful: the current certification scope mapped against critical processes, a gap register assessing the impact on risk and compliance, and an action plan with assigned owners, deadlines and closure criteria.

Where an organisation is still deciding on its approach, there is no universal implementation sequence. Where customer pressure or tender requirements are significant, building a certifiable management system may be a justified first step—provided the regulatory applicability assessment is not deferred. In organisations with high operational risk or fragmented accountability, it may be more appropriate to close regulatory gaps first and then refine the certification scope. This is not a debate about administrative sequencing; it is a decision about the order in which risk is reduced. In this context, ISO certification: benefits and the implementation process should be considered as part of the organisation’s wider compliance operating model rather than in isolation.

The strongest results come from a single, coherent programme in which information security, business continuity, supplier oversight and regulatory obligations are managed as elements of the company’s operating model rather than as separate initiatives owned by different functions. In Polish organisations, fragmented accountability is often what weakens both operational readiness and the ability to produce reliable evidence. The final conclusion is simple: certification can help and may significantly shorten the route to a controlled management system, but compliance must still be designed, implemented and supported by evidence appropriate to the NIS2 and KSC environment.