ISO/IEC 27001 is the international standard for information security management systems. Many organisations use it as the backbone of their security programme, and as a way to demonstrate security to customers.
TEMERON supports organisations that want to implement or strengthen an ISO/IEC 27001-based management system. Certification itself is carried out by accredited certification bodies; our role is to help you get ready and stay ready.
How we help
- Gap analysis of your current practices against the standard and against NIS2 risk-management measures.
- Risk assessment and risk treatment planning.
- Security governance: policies, roles and procedures that match how your organisation actually works.
- Technical controls and evidence: security monitoring and logging with TEMERON's XDR (our own Wazuh deployment), access control, system hardening, secure development practices.
- GDPR and AI governance alignment where personal data or AI systems are involved.
ISO/IEC 27001 and NIS2
NIS2 asks organisations to take state-of-the-art measures "where applicable, [considering] relevant European and international standards" (Directive (EU) 2022/2555, Art. 21(1)). ENISA's technical implementation guidance maps each requirement to ISO/IEC 27001:2022 and other frameworks, while noting that the mapping is not a statement of equivalence. An ISO/IEC 27001 programme is therefore a strong starting point for NIS2 — but it still needs to be checked against the NIS2 requirements, including incident reporting.
Frequently asked questions
Does TEMERON issue ISO/IEC 27001 certificates?
No. Certificates are issued by accredited certification bodies. TEMERON helps you prepare: gap analysis, risk assessment, policies, technical controls and evidence.
Does ISO/IEC 27001 make us NIS2 compliant?
Not automatically. ENISA maps NIS2 requirements to ISO/IEC 27001:2022 but states that the mapping does not mean equivalence. NIS2-specific duties such as the incident reporting timeline (Art. 23) must be covered as well.
Where do we start?
With a gap analysis and a risk assessment. They show which controls exist, which are missing and what to prioritise.
Can you also implement the technical controls?
Yes. Next to governance work, TEMERON configures security monitoring, logging and alerting, access control and system hardening, and supports secure development practices.
Sources
- Directive (EU) 2022/2555 (NIS2), Art. 21(1) and 23
- ENISA, Technical implementation guidance on cybersecurity risk-management measures, version 1.0, June 2025 (guidance, not legally binding)