Conformity, certification and good practices
Domain 4 - Conformity, certification and good practices
This domain tests how compliance is evidenced. NIS 2 is outcome-based: it does not create a single 'NIS 2 certificate', but it uses European certification and recognised good practice to support assurance.
Certification and conformity
Article 24 allows Member States to require essential and important entities to use ICT products, services and processes certified under European cybersecurity certification schemes adopted under Regulation (EU) 2019/881 (the Cybersecurity Act), particularly for critical supply chains. The Commission may specify categories by delegated act. Certificates issued under those schemes are mutually recognised across the EU. Certification can be self-assessment or third-party, depending on the scheme's assurance level; the certificate's scope and assurance level must match the risk.
The legal duty remains Article 21. A certificate is evidence supporting a risk-management measure, not a substitute for the entity's own risk assessment, supplier due diligence or supervisory accountability. Sector-specific rules may add requirements.
Good practice includes an ISO/IEC 27001-scoped ISMS, ISO 22301 business continuity, IEC 62443 for operational technology, NIST CSF or CIS Controls for control mapping, ENISA guidance, tabletop crisis exercises, coordinated vulnerability disclosure, and threat-information sharing in trusted communities. These help demonstrate state-of-the-art measures but do not automatically establish legal conformity.
Worked example
A hospital buys a cloud patient-record system. The supplier claims it is 'NIS 2 certified'. No such single certificate exists. The hospital should request the relevant European certificate where available, the ISO/IEC 27001 scope statement and audit report, incident-notification SLAs, encryption and access-control evidence, and exit terms; then record how these reduce its own supply-chain risk. The supplier's badge does not transfer the hospital's Article 21 duty.
Traps
Do not state that NIS 2 certification is mandatory for all entities. Do not treat ISO/IEC 27001 as a legal safe harbour or assume a certificate covers the whole entity when its scope is one product. Do not confuse Cybersecurity Act certification with NIS 2 supervision. Marketing claims of 'NIS 2 compliance' are not proof.