ISO 27001 · NIS 2
ISO 27001 and NIS 2 on AWS: what to check
Neither ISO 27001 nor NIS 2 lists any AWS setting. Yet many of their technical requirements can be checked in an account's configuration: identities, encryption, logging, backups, vulnerabilities. Here are the Annex A controls and Article 21 measures involved, what to look at on AWS, and what a configuration audit does not cover.
In short
- ISO/IEC 27001:2022 certifies an information security management system (ISMS). Its Annex A has 93 controls, 34 of them technological.
- NIS 2 (Directive (EU) 2022/2555) requires essential and important entities to take ten minimum risk-management measures (Article 21) and to report significant incidents (Article 23).
- AWS's certifications do not cover your accounts: AWS secures its infrastructure, the configuration of your resources is up to you.
- An AWS configuration audit provides dated evidence for part of the technical requirements. It replaces neither the ISMS, nor the certification audit, nor the processes NIS 2 requires.
ISO 27001: the Annex A controls you can check on AWS
The 2022 edition groups its 93 controls into four themes: organisational (37), people (8), physical (14) and technological (34). On an AWS account, it is mostly the technological controls and a few organisational ones that show in the configuration.
| Control (Annex A) | What to check on AWS |
|---|---|
| 5.9 Inventory of information and other associated assets | Inventory of resources in every region, tagging by application and environment |
| 5.15 to 5.18 Access control, identities, authentication | Root account without access keys, MFA, key rotation, inactive users and keys |
| 5.23 Information security for use of cloud services | Security Hub with the FSBP and CIS AWS Foundations v5.0 standards |
| 5.30 ICT readiness for business continuity | Multi-AZ architecture, recovery plans, achievable recovery objectives |
| 8.2 Privileged access rights | No *:* policy, cross-account trust roles, IAM Access Analyzer |
| 8.8 Management of technical vulnerabilities | Amazon Inspector, exposed software versions, end-of-life Lambda runtimes |
| 8.9 Configuration management | Gaps against FSBP and CIS v5.0, IMDSv2 on EC2 |
| 8.13 and 8.14 Backup and redundancy | AWS Backup plans, snapshots, Multi-AZ databases |
| 8.15 and 8.16 Logging and monitoring | Multi-region CloudTrail, VPC flow logs, GuardDuty |
| 8.20 to 8.22 Network security and segregation | Security groups, open administration ports, public subnets |
| 8.24 Use of cryptography | Encryption at rest (S3, EBS, RDS), KMS keys and rotation, TLS on entry points |
These checks feed the risk assessment (clause 6.1.2) and support the choices in the Statement of Applicability. They say nothing about clauses 4 to 10 of the ISMS: policy, roles, internal audit, management review, continual improvement.
NIS 2: the ten Article 21 measures on AWS
Article 21(2) lists ten minimum measures. Some can be checked on an AWS account, others are processes or policies that no configuration review can observe.
| Measure (Art. 21(2)) | What can be checked on AWS | Configuration audit |
|---|---|---|
| (a) Risk analysis and security policies | Findings ranked by severity, attack paths linking several gaps | Partial: feeds the analysis |
| (b) Incident handling | Detection capability: CloudTrail, GuardDuty, alarms on sensitive events | Partial: detection, not the process |
| (c) Business continuity, backups, recovery | Backups, Multi-AZ, multi-region recovery | Yes, except restore tests |
| (d) Supply chain security | Access granted to third-party accounts, cross-account trust roles | Partial: access, not contracts |
| (e) Acquisition, development, vulnerabilities | Inspector, vulnerable software versions, optional web scan | Yes |
| (f) Assessing the effectiveness of measures | Scores per domain, comparable from one audit to the next | Yes |
| (g) Cyber hygiene and training | CIS and FSBP benchmarks | Partial: hygiene, not training |
| (h) Cryptography and encryption | Encryption at rest and in transit, KMS key management and rotation | Yes |
| (i) HR, access control, asset management | IAM identities, least privilege, resource inventory | Partial: not HR security |
| (j) MFA and secured communications | MFA on the root account and console access, TLS | Yes |
NIS 2 also binds management: Article 20 requires it to approve these measures, oversee their implementation and take training. Article 23 sets the deadlines for reporting a significant incident: early warning within 24 hours, notification within 72 hours, final report within one month.
Is your entity in scope for NIS 2?
- Sectors: 18 sectors, 11 of high criticality (energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, space...) and 7 other critical sectors (postal services, waste, chemicals, food, manufacturing, digital providers, research).
- Size: as a rule, medium-sized and large companies in these sectors. Some entities are in scope whatever their size, such as DNS service providers and qualified trust service providers.
- Cloud providers and managed service providers: their technical requirements are detailed in Implementing Regulation (EU) 2024/2690.
- In France, ANSSI is the NIS 2 authority. It publishes the state of transposition and provides MonEspaceNIS2 to check whether your entity is in scope.
What an AWS configuration audit does not cover
- The ISMS itself: security policy, roles, formal risk assessment, Statement of Applicability, internal audit, management review.
- People: awareness, training, joiner and leaver procedures (Annex A theme 6).
- Processes: incident handling and reporting, supplier management and contracts, restore tests.
- Anything outside AWS: workstations, corporate directory, SaaS applications, other clouds.
- Certification: only an accredited body can certify an ISO 27001 ISMS. No configuration audit makes an entity "NIS 2 compliant".
Turning the audit into evidence
- Date every check and keep the report: the certification auditor and the NIS 2 authority judge a state at a given date.
- Link every gap to a risk in your register and to a control in your Statement of Applicability.
- Track remediation resource by resource in a risk treatment plan.
- Repeat before each annual surveillance audit, and after any major architecture change. Between two reviews, AWS Config and Security Hub monitor continuously.
- Present the results to management: both ISO 27001's management review (clause 9.3) and NIS 2 Article 20 expect it.
The Silamir audit reads your AWS accounts read-only across 10 domains, names every resource in breach, computes a CIS AWS Foundations v5.0 score and an FSBP score, and delivers a prioritised action plan and a management summary, for USD 299 per audit. It issues neither an ISO 27001 certification nor a NIS 2 compliance statement.
ISO 27001, NIS 2 and AWS: frequently asked questions
AWS is ISO 27001 certified: does that make my AWS hosting certified too?
No. AWS's certification covers the infrastructure and services AWS runs. Your ISMS, and your accounts' configuration, must be assessed for your own certification. AWS's reports (AWS Artifact) serve as evidence for the part AWS manages.
Is an ISO 27001 certification enough for NIS 2?
It helps a lot, but it is not enough. The Article 21 measures overlap widely with Annex A, and Article 25 encourages the use of international standards. But NIS 2 adds obligations of its own: registration with the authority, incident reporting within 24 and 72 hours, management accountability. And the certified scope does not always cover every system concerned.
How many Annex A controls apply to an AWS account?
About twenty can be checked directly in the configuration, mostly in theme 8 (technological controls): privileged access, vulnerabilities, configuration, backup, logging, networks, cryptography. Organisational, people and most physical controls are evidenced in other ways.
How often should the AWS configuration be audited?
Continuously with AWS Config and Security Hub, and through a dated review at least once a year, before the ISO 27001 surveillance audit. NIS 2 also requires assessing the effectiveness of the measures (Article 21(2)(f)): running the same audit again lets you compare scores year on year.
Where does your AWS account stand?
Ten questions, three minutes, no access to your account: a security score, a FinOps score and the article to read for each of your three weakest points. Your answers stay in your browser.
Ready to audit your AWS account?
Subscribe on AWS Marketplace, deploy the read-only role and get your reports within the hour.