After this course you can judge what your ISMS already delivers for NIS2 and what is missing. You carry out a gap analysis against section 30 BSIG and add what the standard does not cover: reporting processes, registration, management duties and a closer look at the supply chain. The course suits you if you own or are building an ISMS and your company falls, or may fall, under NIS2. It does not replace legal advice, but it shows you which questions to settle internally and with your legal team.
What you’ll take away.
- Explain the difference between ISO/IEC 27001 and the duties under the BSIG
- Set up and carry out a gap analysis against section 30 BSIG
- Build reporting and registration processes into the ISMS
- Cover the supply chain and management responsibility in a traceable way
Your training in detail
- Who is it for?
- ISMS owners, IT security leads and compliance specialists in organisations that fall under NIS2 or want to find out whether they do.
- Prerequisites
- You should know the basics of an ISMS and ISO/IEC 27001. You do not need a legal background.
- Format & planning
- Standard length: 5 training days. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
The NIS2 Directive and its German implementation in the BSIG
Checking applicability and comparing the ISMS scope
Risk management measures under section 30 BSIG mapped to ISO/IEC 27001:2022
Reporting duties under section 32 and registration under section 33 BSIG
Supply chain, incident handling and business continuity
Management duties under section 38 BSIG and audit-ready evidence
You compare a fictional company's ISMS with section 30 BSIG, document the gaps and draft a reporting process for a significant security incident.
Exams, licences & credentials
This is a vendor-independent NextNowa course. It does not lead to a certificate from a vendor or certification body and does not prepare you for a specific exam.
Vendor references & review date
Sources checked on 2026-11-04. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Is an ISO 27001 certificate enough for NIS2?
No. According to the BSI, ISO/IEC 27001 certification is not proof of NIS2 compliance. It is a good foundation, but it does not cover reporting duties, for example.
Do I get a NIS2 expert certificate?
No. The course does not lead to a personal certificate, and it does not confirm that your company complies with NIS2.
Is the course legal advice?
No. Whether and how your company is affected is something to settle case by case with your legal adviser.
Does Implementing NIS2 with ISO/IEC 27001: closing the gaps include a certificate?
This is a vendor-independent NextNowa course. It does not lead to a certificate from a vendor or certification body and does not prepare you for a specific exam.