NIS2 + DORA Financial Sector: Banks & Insurers

NIS2 for the financial sector: banks, insurers and Investment Firms under DNB and AFM supervision — often in conjunction with DORA.

What is ISO 27001?

ISO 27001 is the international standard for information security and describes the requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS). The standard applies to organisations of any size and sector. With the ISO 27001:2022 version, 93 Annex A controls are organised into four categories: organisational, people, physical and technological. Certification demonstrates that your organisation complies with international standards for information security.

Why ISO 27001 now?

Information security is no longer optional — it is a market requirement. ISO 27001 certification is increasingly required in procurement processes, strengthens client and partner confidence, and provides a solid foundation for NIS2, DORA and GDPR compliance.

• Procurement: Increasingly, contracting authorities require ISO 27001 as a minimum qualification
• NIS2 compliance: ISO 27001 covers a large portion of the NIS2 security requirements
• Risk Management: A systematic approach that prevents incidents and limits damage
• Stakeholder confidence: Clients, partners and regulators trust demonstrable security

ISO 27001:2022 — What has changed?

The 2022 revision brought significant changes: from 114 to 93 Controls, a reorganisation into four thematic categories and 11 new Controls focused on cloud security, threat intelligence and data masking. Organisations still certified on the 2013 version must migrate by October 2025 (deadline passed; non-migrated certificates have expired) at the latest. Our approach: from initial assessment to certificate We follow a proven four-phase approach that combines realistic timelines with sustainable implementation:

• Phase 1 — Gap analysis: Baseline assessment of your current security level against the ISO 27001 standard. Clear insight into the distance to certification.
• Phase 2 — Implementation: Establishing the ISMS — risk analysis, Statement of Applicability, policy, procedures and controls in conformance with Annex A.
• Phase 3 — Certification: Internal audit, management review and full guidance through the external Stage 1 and Stage 2 certification audit.
• Phase 4 — Maintenance: Continuous support for surveillance audits, recertification and continuous improvement of your ISMS.

GRC Platform — your ISMS in one system Our ISO2700X GRC Platform runs on-premise at your location and integrates all your ISMS documentation, Risk Register, Annex A Controls and audit evidence in one overview. Compli AI generates policy suggestions tailored to your organisation profile — 64 templates, 113 sections, 398 questions.

Learn more about the GRC Platform →