Implementing NIS-2 on the Basis of ISO 9001
Transitioning from quality management to robust information security governance—with a worked example, roadmap and evidence model for mid-sized companies
For management and quality managers in companies that fall under NIS-2 in Germany, already operate a certified quality management system under ISO 9001 and do not yet have an information security management system under ISO/IEC 27001.
BSI Registration Is Just Step One
Germany's NIS-2 Implementation Act (NIS2UmsuCG), which amends the BSI Act (BSIG), has been in force since December 6, 2025, with no grace period. The number of companies affected is very large: by September 30, 2026, 20,141 entities had registered with the Federal Office for Information Security (BSI)—13,252 of them as "important entities" (BSI, NIS-2 in Zahlen).
However, BSI registration fulfills only a single statutory obligation (Section 33 BSIG). The core legal mandate—implementing continuous, enforceable security controls and documenting compliance under Section 30 BSIG—remains fully in effect.
NIS-2: Reuse Existing Processes. Target Your Budget. Implement Faster.
Organizations with an active ISO 9001 system don't need to build a NIS-2 compliance framework from scratch. They extend their existing system and put budget and expertise where NIS-2 genuinely requires something new: in the security measures.
Compared with a separate information security management system built alongside the quality management system, this approach has four advantages:
- Your budget goes into security, not into organization. Document management, internal audits, corrective action and regular management review already exist. A greenfield ISMS forces you to reinvent these workflows; building on ISO 9001 lets you focus immediately on technical hardening.
- Executive leadership oversees security through familiar governance workflows. Under Section 38 BSIG, management must ensure that the security measures are implemented and must oversee their implementation. Your existing QMS management review cycle provides a built-in framework for this oversight. A separate system would need a new one.
- One unified system, not two. Employees, auditors and management work with one set of procedures and one audit program. Eliminates redundant documentation and audit overhead.
- Keeps the path open for formal certification. Because ISO 9001 and ISO/IEC 27001 share the same Harmonized Structure (HS, formerly High-Level Structure), you extend the system once more instead of rebuilding it if a customer later requires an ISO/IEC 27001 certificate.
Where QMS falls short: A quality management system does not replace technical or IT-specific security measures. Technical cybersecurity controls must still be engineered from the ground up. ISO 9001 does, however, provide a suitable organizational framework for them.
Questions the Whitepaper Answers
- What must you do immediately, and which deadlines apply?
- How do you verify compliance in practice, beyond paper checklists?
- Which of your quality management processes can you reuse, and where is the quality management system not enough?
- Which security measures do you need to build from scratch?
- In what order should you proceed?
- What resource investment should you anticipate, and what drives costs?
- How do you provide evidence of implementation, and how does management keep track?
Key Points for Management
What must be clarified immediately: Is your registration data with the BSI up to date, and is someone responsible for it? Can your company report a significant security incident within 24 hours—including on the weekend? Has management attended training? These obligations already apply.
Existing assets: With ISO 9001, you already have document management, internal audits, corrective action and regular management review. These procedures can be used for information security—provided they are practiced day to day and extended to the whole company.
Where you will probably need to invest: first in information security expertise—internal or external. A formal risk assessment identifies mandatory controls while preventing over-engineering; without one, it is easy to invest in the wrong place. Technical hardening flows directly from that risk assessment—typically including offline backups, multi-factor authentication (MFA) for remote access, incident detection, and network segmentation between corporate IT and OT/production.
What you need to decide: who coordinates information security; which risks are treated first and which residual risks are accepted; what budget is available; and whether you will later seek certification under ISO/IEC 27001.
The next three steps:
- Establish the ability to report incidents and train management—these obligations apply immediately.
- Carry out an assessment across all ten areas of Section 30 BSIG, including all sites.
- On this basis, adopt a prioritized action plan.
The Complete Whitepaper
With a continuous worked example, roadmap, effort model and an example of the result of an assessment.
Your Next Step: NIS-2 Assessment for Companies With ISO 9001
- Scope: Assessment across all ten areas of Section 30 BSIG and all sites; rating of your quality management processes (reuse, extend, build new, verify).
- Result: a gap overview, a prioritized action plan and a decision paper for your management.
- Duration: usually a few weeks, depending on size and number of sites.
More about this service: ISMS under ISO/IEC 27001 including NIS-2 requirements
About the Author
Derek Carson—AI governance and information security, Künzell near Fulda, Germany. Passed the Lead Implementer exams for ISO/IEC 42001 and ISO/IEC 27001 · ISC2 Certified in Cybersecurity. Native English speaker, working in English and German. More about me
Another whitepaper: Managing AI Risk in Your Enterprise