NIS2 vs ISO 27001: a clause-by-clause working mapping (and where ISO stops short)
A practitioner mapping of every NIS2 Article 21(2) measure category to ISO 27001:2022 Annex A controls, grounded provision-by-provision. Plus the three places ISO leaves a real gap: the 24h/72h reporting clock, management liability, and supply chain depth — and why an ISO certificate is not NIS2 compliance.