NIS2 and ISMS: What Your Existing System Doesn't Cover

ISMS tools manage controls, documents, and audits, but they deliver neither a NIS2-specific implementation path nor the concrete measures required by Section 30 BSIG. That is why most vendors sell NIS2 consulting as a paid add-on. NIS2Compass closes exactly this gap: structured NIS2 expertise, ready-made templates, and an 8-chapter guide that complements your existing system.

On the sufficiency question: If your ISMS is based on ISO 27001, a NIS2 gap analysis is essential — the BSI has explicitly stated that an ISO 27001 certification does not automatically result in NIS2 compliance. The full answer with the BSI quote and concrete gap list: Is an ISO 27001 certification enough for NIS2 compliance?

This article shows where ISMS tools reach their limits, why combining them with a NIS2-specific guide makes sense, and how the integration works in practice.

What Does an ISMS Tool Do Well, and Where Does Its Reach End?

An ISMS tool organizes your security management: controls, policies, audit trails, and evidence in one place. But NIS2 introduces specific requirements that go beyond pure administration, including the ten areas of measures under Section 30 BSIG, BSI registration, and German reporting obligations. An NIS2Compass analysis shows: The platform alone does not answer the question "What exactly do I need to do?"

What Does an ISMS Tool Do Well?

ISMS tools have clear strengths. They excel at:

• Document management -- managing policies, procedures, and evidence in a central location
• Control catalogues and mapping -- structuring ISO 27001 and BSI IT-Grundschutz frameworks
• Audit trail and compliance status -- providing seamless traceability for auditors
• Task and deadline management -- keeping responsibilities and deadlines in check
• Reporting -- supplying management and auditors with up-to-date metrics

These are important functions. For operating an ISMS, they are indispensable.

Where Do ISMS Tools Fall Short on NIS2?

The problem begins where NIS2-specific expertise is required. Four gaps appear particularly often:

• No NIS2-specific content: Tools provide structure, but no expertise on Section 30 BSIG, reporting obligations, or executive liability.
• No German legal specifics: International tools map the EU Directive, not the NIS2UmsuCG with its specific penalty frameworks and BSI requirements.
• No implementation guidance: A control point labelled "Conduct risk analysis" does not tell you how to carry it out for NIS2 specifically.
• Templates are missing or generic: No German-language risk register, no Section 30-compliant information security policy.

The numbers confirm this gap. According to a study by G DATA, only 12.1% of affected companies have fully implemented NIS2 -- even though many of them already have ISMS tools in place. The problem is not administration; it is the missing content.

Put differently: An ISMS tool is the bookshelf, but the books are missing. It organizes your security documentation reliably. It just does not tell you which documents you actually need for NIS2 and how to create them. For details on the consequences of failing to implement the Section 30 measures, see the article NIS2 Fines: What Penalties Can You Expect?.

Why Do ISMS Vendors Sell NIS2 Consulting on Top?

ISMS vendors know that their platform alone is not sufficient for NIS2. That is why most offer additional NIS2 consulting packages, from gap analyses and action planning to BSI registration support. At daily rates of EUR 1,000 to 2,000, this can significantly increase total costs for SMEs with limited budgets.

What Do ISMS Vendors Typically Offer as a NIS2 Add-on?

Most vendors bundle similar packages:

• Gap analysis and NIS2 readiness assessment -- comparing current status against Section 30 requirements
• Action planning and implementation support -- consulting on concrete implementation
• Training for executive management and IT teams -- particularly on executive liability under Section 38 BSIG
• BSI registration support -- guidance through the registration process
• Ongoing compliance consulting -- regular reviews and adjustments

What Does the Additional Consulting Cost?

The numbers paint a clear picture:

• Consultant daily rates: EUR 1,000--2,000 per day
• Typical NIS2 consulting project for SMEs: EUR 50,000--150,000 initial (CCVOSSEL)
• ISMS tool licence on top: EUR 10,000--50,000 per year
• Total cost in the first year: easily six figures, for a company that already has an ISMS tool

More than half of all companies still invest less than the 20% of their IT budget recommended by the BSI and Bitkom in security (Bitkom Wirtschaftsschutz 2025). Additional five-figure consulting costs only make this problem worse.

Is It Possible Without the Consulting?

The key question is: What does the consultant deliver that cannot also be conveyed in a structured way? The answer: the expertise, the guiding thread, and the concrete templates. These are exactly the three elements a specialized NIS2 compliance platform can provide. Without a daily rate.

Most ISMS tools are excellent administration platforms. But NIS2 compliance does not come from administration; it comes from the structured implementation of concrete measures. That is exactly what requires a guide, not just a dashboard." -

Why Don't ISMS Tools Provide a Clear Path for NIS2 Implementation?

ISMS tools present controls as a flat list or matrix, without prioritization, without sequence, and without a clear answer to the question "Where do I start?" According to ADVISORI, a lack of prioritization is one of the ten most expensive mistakes in NIS2 implementation for mid-sized companies. NIS2Compass solves this with a structured 8-chapter implementation path.

Controls Matrix Instead of Implementation Path -- Where Is the Problem?

• A typical ISMS tool lists over 100 controls, sorted by standard (Annex A, BSI building blocks), not by NIS2 relevance.
• It lacks the information on which control is actually required for NIS2 and which is not.
• No prioritization: What is urgent, what can wait? The matrix provides no answer.
• No dependencies: Which measure must be completed before which other one remains unclear.
• The result: companies work unsystematically, start in the wrong place, or lose track after just a few weeks.

What Does a Structured Implementation Path Do Differently?

The NIS2Compass Guide breaks down the entire NIS2 implementation into 8 chapters with approximately 124 steps, in a clear, sequential order:

1. Fundamentals and Registration -- verify applicability, determine classification, use the BSI portal
2. Risk Management -- asset inventory, threat analysis, risk matrix, gap assessment
3. Technical Measures -- access control, encryption, patching, network security
4. Incident Response and Reporting Obligations -- IR plan, BSI notification, exercises, forensics
5. Governance and Organization -- appoint an information security officer, create policies, executive duties, reporting
6. Supply Chain Security -- inventory, assessment, contractual safeguards
7. Business Continuity -- BIA, BCP, backup strategy, testing
8. Awareness and Training -- build a programme, mandatory training, phishing simulations, security culture

Each individual step answers the question: "What do I need to do?" Progress is measurable: a step is either completed or open. No room for interpretation, no guessing.

According to HvS-Consulting, without a clear methodology companies end up with "extensive risk registers with limited added value." ISMS implementations typically take 6 to 12 months. Companies that are only starting now will not be fully NIS2-compliant before the end of 2026 at the earliest. A focused implementation path significantly shortens this timeline.

"Treating NIS2 as an IT project is a recipe for failure. NIS2 requires a comprehensive integration of security measures, governance, workforce development, reporting, and supply chain management." -- Security Insider, 2026

How Do an ISMS Tool and NIS2Compass Work Together in Practice?

The combination follows a clear principle: NIS2Compass delivers the expertise, the implementation path, and the templates. Your ISMS tool manages the results. According to ISMS.online, ISO 27001 provides an excellent foundation, but the requirements of the NIS2UmsuCG go further. NIS2Compass closes this gap: tool-agnostic and without requiring a system change.

What Role Does NIS2Compass Play?

• NIS2 expertise (Knowledge Hub, 40+ articles) -- Your ISMS tool manages: document management
• Structured 8-chapter implementation path -- Your ISMS tool manages: control catalogues and mapping
• Ready-made templates (20+ templates, Word/Excel) -- Your ISMS tool manages: audit trail and evidence
• Gap analysis via Pre-Check -- Your ISMS tool manages: task and deadline management
• German legal specifics (NIS2UmsuCG) -- Your ISMS tool manages: reporting to auditors

What Does the Typical Workflow Look Like?

1. Complete the Pre-Check -- NIS2Compass shows which areas require action.
2. Follow the guide chapters -- work through the Section 30 measures step by step.
3. Download templates and customize them -- risk register, policies, IR plan, and more.
4. Import the results into your ISMS tool -- import finished documents, tick off controls.
5. Use the Knowledge Hub for detailed questions -- in-depth articles on individual topics available at any time.

Why Does This Work Without Switching Systems?

• Universal formats: All templates are available in Word and Excel, importable into any ISMS tool.
• No technical integration required: No API connection, no vendor lock-in, no configuration.
• Complement, not replacement: NIS2Compass fills your ISMS tool with NIS2 content instead of replacing it.

NIS2Compass covers all ten Section 30 areas of measures with over 40 expert articles, 20+ templates, and a 124-step guide. This matches the content scope of a typical NIS2 consulting project, for EUR 29 per month instead of five-figure consulting fees.

What Does ISMS-NIS2 Integration Look Like in Practice?

A mechanical engineering company with 130 employees has been using an ISMS tool for two years. When the NIS2UmsuCG enters into force, the IT manager realizes that the tool shows the ISO 27001 status but not what is specifically missing for NIS2. The vendor offers a consulting package for EUR 45,000. With the NIS2Compass Guide, it is also possible for EUR 29 per month.

What Was the Starting Point?

Starting point:

• Mechanical engineering, 130 employees, EUR 22 million annual revenue, classified as an "important entity"
• ISMS tool in use since 2024, ISO 27001 controls partially implemented
• IT team of 5, no dedicated information security officer
• The ISMS vendor offers a "NIS2 Readiness Package": gap analysis, consulting, and training for EUR 45,000

Problem:

The ISMS tool shows 114 ISO 27001 controls but does not indicate which ones are NIS2-relevant. There is no Section 30 mapping and no guidance for BSI registration. An incident response plan covering the 24-hour, 72-hour, and 1-month reporting deadlines is completely missing. The managing director does not know that he is personally liable under Section 38 BSIG. For details on what that means, see the article NIS2 Fines: What Penalties Can You Expect?.

Solution with NIS2Compass (EUR 29/month):

1. Completed the Pre-Check: immediately reveals that the IR plan, BSI registration, and supplier inventory are missing
2. Guide Chapter 1: BSI registration completed step by step
3. Guide Chapter 4: IR plan created using a ready-made template, reporting deadlines set up
4. Guide Chapter 5: Executive duties documented, training scheduled
5. Guide Chapter 6: Supplier inventory created using a template
6. All documents imported into the ISMS tool -- controls updated, evidence added

Result:

The NIS2 gaps were closed in 8 weeks. Total cost: EUR 232 (8 months x EUR 29) instead of EUR 45,000 for the consulting package. The ISMS tool remains the central platform, now filled with NIS2-compliant content.

This scenario is anonymized and serves illustrative purposes.

Frequently Asked Questions

Does NIS2Compass replace my ISMS tool?

No. NIS2Compass is not an ISMS tool and does not replace one. It complements your existing system with what is missing for NIS2: structured expertise across all ten Section 30 areas of measures, a concrete implementation path, and over 20 ready-made templates. Documentation and administration remain in your ISMS tool.

Does NIS2Compass work with every ISMS tool?

Yes, it is fully tool-agnostic. All templates are available in Word and Excel format, universally importable into any platform. There is no technical dependency and no API integration. NIS2Compass works as a standalone guide alongside any ISMS platform.

Is my ISMS tool alone enough for NIS2 compliance?

In most cases, no. ISO 27001 provides an excellent foundation, but according to G DATA, only 12.1% of affected companies have fully implemented NIS2. The NIS2UmsuCG goes beyond standard ISMS frameworks, particularly regarding reporting obligations, BSI registration, and executive liability under Section 38 BSIG.

What does NIS2Compass cost as an ISMS complement?

EUR 29 per month, cancellable monthly. For comparison: a typical NIS2 consulting project for SMEs costs between EUR 50,000 and 150,000 according to CCVOSSEL. The ISMS tool licence is an additional expense in either case. NIS2Compass delivers the same content scope, without daily rates.

Do I still need a NIS2 consultant?

For most SMEs, no. NIS2Compass covers all ten Section 30 areas of measures with its 124-step guide, over 40 expert articles in the Knowledge Hub, and 20+ templates. This matches the scope of a NIS2 readiness project. For special cases such as KRITIS operators or complex group structures, targeted consulting may still be advisable.