NIS2 vs GDPR vs NIST CSF 2.0 vs SOC 2 vs CIS Controls v8.1 vs ISO 27001: A Practical Comparison
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
NIS2 and GDPR are EU laws; NIST CSF 2.0, CIS Controls v8.1 and ISO/IEC 27001 are voluntary frameworks; SOC 2 is an audit report. NIS2 sets binding cybersecurity and incident-reporting duties for in-scope EU entities. NIST CSF describes security outcomes, CIS lists prioritised technical safeguards, ISO 27001 builds a certifiable management system, and SOC 2 proves controls to customers.
Key takeaways
- NIS2 and GDPR are legal obligations with fines. The other four are chosen voluntarily, or required by customers and contracts.
- NIST vs NIS2 is not either-or: NIS2 tells EU entities what they must achieve, while NIST CSF 2.0 is a free structure for organising that work.
- Incident reporting clocks differ: NIS2 expects an early warning within 24 hours and a notification within 72 hours; GDPR expects breach notification within 72 hours.
- Only ISO 27001 gives a certificate and only SOC 2 gives an auditor's attestation report. NIST CSF and CIS Controls are self-assessed or assessed by third parties without a formal certificate.
- Build one programme: an ISO 27001 ISMS as the backbone, CIS Controls for technical work, NIST CSF for reporting, and NIS2, GDPR and SOC 2 mapped on top.
Quick comparison of the six frameworks
Each framework answers a different question. The table summarises type, audience and what you end up showing.
| Framework | Type | Main purpose | Who asks for it | What you show |
|---|---|---|---|---|
| NIS2 (Directive (EU) 2022/2555) | EU directive, transposed into national law | Baseline cybersecurity and incident reporting for essential and important entities | National authorities | Risk-management measures, incident reporting capability, management oversight |
| GDPR (Regulation (EU) 2016/679) | EU regulation, directly applicable | Protect personal data and individuals' rights | Data protection authorities, customers | Records of processing, legal bases, breach process, security of processing |
| NIST CSF 2.0 | Voluntary framework | Common structure for managing cybersecurity risk outcomes | Boards, customers, US public sector | Current and target profiles, gap roadmap |
| SOC 2 | Attestation report (AICPA Trust Services Criteria) | Independent assurance on a service organisation's controls | Customers and procurement, especially in the US | Type I or Type II report from a CPA firm |
| CIS Controls v8.1 | Prescriptive control set | Prioritised safeguards against common attacks | Security teams, insurers | Implementation evidence per safeguard and Implementation Group |
| ISO/IEC 27001:2022 | Management system standard | Run information security risk as a managed, audited system | Customers, tenders, governance | Certificate from an accredited body, ISMS records |
NIST vs NIS2: what is the difference?
NIS2 is EU law that obliges in-scope organisations to manage cyber risk and report significant incidents. NIST CSF 2.0 is a voluntary US framework that describes good security outcomes. You must comply with NIS2 if it applies to you; you can choose to use NIST CSF to organise how you comply.
| Aspect | NIS2 | NIST CSF 2.0 |
|---|---|---|
| Legal status | Binding through national law in each EU member state | Voluntary guidance from the US National Institute of Standards and Technology |
| Scope | Essential and important entities in listed sectors | Any organisation, any size, any country |
| Structure | Articles on governance, risk-management measures (Article 21), reporting (Article 23), supervision and penalties | Six functions: Govern, Identify, Protect, Detect, Respond, Recover |
| Incident reporting | 24-hour early warning, 72-hour notification, final report within one month | Describes response outcomes; no reporting deadlines |
| Enforcement | Supervision, fines and management accountability | None |
| Certification | None at EU level; national schemes vary | None |
The two overlap a lot. NIS2's governance and management accountability duties line up with the CSF's Govern function, and its risk-management measures map onto Identify, Protect, Detect, Respond and Recover. Many EU organisations use a CSF profile to track NIS2 progress for the board.
1. NIS2: the EU cybersecurity law
NIS2 replaced the 2016 NIS Directive and widens both scope and duties. According to the European Commission, it covers 18 critical sectors, required transposition by 17 October 2024 and repealed NIS1 from 18 October 2024.
Who it applies to
Entities in sectors such as energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste management, chemicals, food and manufacturing, classified as essential or important. Size thresholds and national rules decide the final scope, so check your country's law. In Sweden that is the Cybersecurity Act (Cybersäkerhetslagen).
What it requires
- Cybersecurity risk-management measures, including policies, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and training.
- Management bodies that approve and oversee those measures, and can be held accountable.
- Staged incident reporting: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month, as set out in the Commission's NIS2 Q&A, which also lists the minimum fines below.
Fines
Member states must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. Our NIS2 compliance guide covers scoping and the full requirement list.
2. GDPR: the EU privacy law
GDPR governs how personal data is processed. It applies directly in every member state and to organisations outside the EU that target EU residents.
- What it requires: lawful bases for processing, records of processing, data subject rights, data protection by design, processor contracts and appropriate security of processing.
- Breach notification: the European Data Protection Board's SME guide confirms that breaches must be notified to the data protection authority within 72 hours, unless they are unlikely to result in a risk to individuals.
- Fines: the Commission notes fines of up to €20 million or 4% of total annual worldwide turnover.
NIS2 vs GDPR in one line: NIS2 protects the availability and integrity of services and systems; GDPR protects personal data and people. One incident can trigger both, with separate reports to separate authorities. See our GDPR compliance services.
3. NIST CSF 2.0: the outcome framework
The NIST Cybersecurity Framework 2.0 was published on 26 February 2024. It added a sixth function, Govern, to Identify, Protect, Detect, Respond and Recover.
- Best for: a shared language for the board, a current and target profile, and a roadmap from gaps to initiatives.
- Not: a checklist or a certification. It points to informative references, such as ISO 27001 and CIS Controls, for how to implement each outcome.
Opsio's NIST compliance service uses CSF profiles as the reporting layer.
4. SOC 2: the customer assurance report
SOC 2 is an independent CPA firm's report on a service organisation's controls against the AICPA Trust Services Criteria. Security is always in scope; Availability, Processing Integrity, Confidentiality and Privacy are optional.
- Type I tests control design at a point in time.
- Type II tests design and operating effectiveness over a period, commonly several months to a year.
SOC 2 matters most when you sell services to North American customers. European buyers more often ask for ISO 27001, so many SaaS and service providers end up with both.
5. CIS Controls v8.1: the technical to-do list
The CIS Critical Security Controls are 18 prioritised controls broken into safeguards. Version 8.1 added the Govern function from NIST CSF 2.0 and revised asset classes and safeguard descriptions.
- Implementation Group 1 (IG1): essential cyber hygiene for every organisation.
- IG2: adds safeguards for organisations with more complex IT and sensitive data.
- IG3: adds safeguards against sophisticated attackers.
Use CIS when you need to know what to deploy, and in what order. It is the most practical of the six for an IT team.
6. ISO/IEC 27001:2022: the management system
ISO 27001 specifies requirements for an information security management system (ISMS): scope, leadership, risk assessment and treatment, a Statement of Applicability against the Annex A controls, internal audit, management review and continual improvement. It is the only one of the six with accredited certification.
ISO 27001 does not force one control list. You select controls based on risk, which is why it pairs well with CIS for technical depth. See our ISO certification support.
Where the frameworks overlap
| Area | NIS2 | GDPR | NIST CSF 2.0 | SOC 2 | CIS v8.1 | ISO 27001 |
|---|---|---|---|---|---|---|
| Governance and accountability | Strong | Strong | Strong | Medium | Medium | Strong |
| Risk management | Strong | Medium | Strong | Medium | Medium | Strong |
| Technical controls | Medium | Low | Medium | Medium | Strong | Medium |
| Incident reporting deadlines | Yes | Yes | No | No | No | No |
| Supply chain security | Strong | Medium (processors) | Strong | Medium | Medium | Strong |
| External proof | Regulator supervision | Regulator supervision | None | Attestation report | None | Certificate |
The ratings are our practical judgement of emphasis, not an official mapping. For control-level mappings, use NIST's informative references and the CIS mapping documents.
Which framework should you start with?
- EU entity in NIS2 scope: lead with NIS2 as the legal driver, implement it through an ISO 27001 ISMS, use CIS Controls for the technical backlog and a NIST CSF profile for board reporting.
- SaaS or service provider selling to enterprises: ISO 27001 for European buyers, SOC 2 for North American ones, CIS for hardening.
- Mainly personal-data risk: lead with GDPR, and use ISO 27001 or CIS to make security of processing concrete and auditable.
- Small organisation starting out: CIS IG1 first. It gives the fastest real risk reduction and maps to everything else later.
How to combine them into one programme
- Backbone: an ISO 27001 ISMS defines scope, risk method, policies and audit rhythm.
- Reporting: a NIST CSF 2.0 current and target profile for management.
- Execution: CIS Controls safeguards as the technical backlog.
- Legal overlays: map NIS2 Article 21 measures and GDPR duties to ISMS controls and evidence, and build one incident process that meets both reporting clocks.
- Customer proof: ISO 27001 certification and, if needed, a SOC 2 report from the same control set.
Expect the same core artefacts everywhere: asset inventory, risk register, policies, supplier assessments, incident playbooks and evidence that controls run. Build them once and map them many times.
Example: NIS2 in practice at Löfbergs
Löfbergs, the coffee roaster from Karlstad, falls under NIS2 and Sweden's Cybersecurity Act. In the Löfbergs NIS2 case, Opsio ran the programme in four phases: a gap analysis against the NIS2 requirement areas, a prioritised roadmap based on risk, implementation that turned legal requirements into policies and technical controls (risk management, incident handling, access control, logging and monitoring, supply chain security), and continuous compliance support.
Frequently asked questions
Is NIS2 like GDPR for cybersecurity?
Partly. Both are EU laws with fines and reporting duties. GDPR protects personal data; NIS2 protects the security and continuity of network and information systems in critical sectors. One incident can require reports under both.
Does NIST CSF compliance mean we comply with NIS2?
No. NIST CSF has no legal status in the EU and no reporting deadlines. A CSF-based programme covers much of the technical and governance ground, but you still need NIS2-specific scoping, management approval, registration and incident reporting under your national law.
Is ISO 27001 enough for NIS2?
It is a strong foundation, because NIS2 risk-management measures map well to an ISMS. Gaps usually remain around incident reporting timelines, management accountability, registration with the authority and sector-specific national rules.
What is the difference between SOC 2 and ISO 27001?
ISO 27001 certifies that you run a management system for information security. SOC 2 is an auditor's report on whether specific controls were designed and, for Type II, operated effectively over a period. ISO 27001 is more common in Europe; SOC 2 in North America.
Which frameworks can we be certified against?
ISO 27001 offers accredited certification. SOC 2 gives an attestation report, not a certificate. NIST CSF and CIS Controls can be assessed but have no formal certification. NIS2 and GDPR are laws: you comply, and authorities supervise.
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.