Who this lesson is for

Two managers. The first has a big client or a tender saying: “An ISO 27001 certificate is required.” The second has received a letter about NIS2 and isn’t sure whether it applies to their company.

Both need the same thing: to understand what it’s about, how much time it takes and where to start — without consultant jargon.

This lesson is not legal advice. Check whether NIS2 applies to your company with Lithuania's National Cyber Security Centre (NKSC) ↗ (in Lithuanian) or with a lawyer.

ISO 27001 in one sentence

It isn’t an IT project but a management system: the company decides what information it protects, assesses what could happen to it, chooses measures, applies them, checks whether they work, and keeps improving.

The certificate doesn’t confirm that a break-in is impossible. It confirms that this cycle really happens — and the auditor sees that from evidence, not from promises.

What the standard is made of

Two parts:

  • Clauses 4–10 — requirements for the management system itself: scope, the role of management, risk assessment, training, internal audit, management review, improvement. Every one of them is mandatory.
  • Annex A — 93 security measures (controls), grouped into four themes. You decide which ones to apply based on your risks, and you justify the choice.

Annex A: 93 controls, four themes

Organisational37
Technological34
Physical14
People8
More than half of the controls aren't about technology but about procedures, people and premises. That's why an ISO project can't be “an IT thing”.

Since November 2025, certificates are only issued against the 2022 version of the standard — if someone offers you a document set “based on 2013”, it’s out of date.

NIS2 and Lithuania: what has changed

Lithuania transposed the EU’s NIS2 directive through the updated Cybersecurity Law (Kibernetinio saugumo įstatymas), which came into force on 18 October 2024. The supervising authority is NKSC.

What a manager needs to know:

  • More sectors and more companies. The law covers not just energy or banks but many other sectors too. Companies are classed as essential or important entities.
  • Responsibility lies with management. Managers approve the security measures, oversee how they’re implemented and must be trained themselves.
  • Incident reporting within set deadlines. The NIS2 model is an early warning within 24 hours, a notification within 72 hours and a final report within a month. Check the exact Lithuanian rules with NKSC.
  • Fines for essential entities — up to €10 million or 2% of annual turnover.

The link to ISO 27001: a large share of the NIS2 measures overlaps with ISO 27001. A certified company has a solid foundation, but the legal obligations (registration, reports to NKSC) are handled separately.

The road to certification

From decision to certificate

  1. Scopewhich part of the company and what information we protect
  2. Riskswhat could happen and what it would cost
  3. Controls and SoAwhich of the 93 we apply and why
  4. Implementationwe work by the procedures and gather evidence
  5. Internal auditand management review
  6. Certificationan audit in two stages
  7. Every yeara surveillance audit
For a small company the whole road usually takes six months to a year. The longest part is step 4, because the auditor needs to see the system working over time.

Five documents an audit can’t start without

  1. Scope — which part of the company, which locations, systems and processes.
  2. Information security policy — short, approved by management.
  3. Risk assessment and risk treatment plan — what could happen and what we do about it.
  4. Statement of Applicability (SoA) — 93 controls: applied or not, and why.
  5. Internal audit and management review records — proof that the system checks itself.

On top of that — evidence: training lists, access reviews, backup tests, an incident log. That’s exactly what the auditor looks for most.

Where AI really helps — and where it doesn’t

It helps with: the gap analysis, first drafts of policies and procedures, a risk register template, an SoA draft based on your risks, training material, an internal audit questionnaire. That saves weeks of writing.

It doesn’t help with: creating reality. A document saying “all employees train every quarter” when nobody does is a straight road to a nonconformity at the audit.

And one hard limit: an ISO project produces a lot of sensitive information — lists of systems, weaknesses, risks. Put it only into a company-approved AI tool. Why — in the lesson How to start using AI at work (safely).

A gap analysis in one afternoon

The first step is always the same: where are we now? Copy this and paste it into your company-approved AI:

You are an ISO 27001:2022 consultant. Help me do a gap analysis for our
company: where we are now and what's missing before certification.

ABOUT US
- Business, number of employees, number of offices: [...]
- Why we need it: [client / tender / NIS2 / other]
- Key systems: [e.g. Microsoft 365, accounting, CRM, website]
- What we already have: [e.g. MFA, backups, antivirus, no documents]

PROCESS
1. ASK. Ask questions based on clauses 4–10 and the four Annex A themes.
   One at a time. If I don't know the answer, mark it "unknown", not "in place".
2. TABLE. Requirement → status (in place / partly / missing / unknown) →
   what's missing → priority → who is responsible.
3. FIRST STEPS. Suggest a scope statement and the 10 most important tasks
   for the first three months.

GOAL
The job is finished when I have a gap table and a list of tasks for the
first three months with the people responsible.

RULES
- Don't assume anything is "implemented". If in doubt, it's "unknown".
- Don't give legal conclusions about NIS2 — tell me what to check with NKSC.
- Don't quote the standard word for word; explain it in your own words.
- Answer in English.

AT THE END
Separately — WHAT YOU DID NOT CHECK and which questions to ask the certification body.

🤖 AI route recommended

The AI asks, the team answers

You get the best result when you answer the AI's questions together with whoever looks after IT, and with the manager or the accountant. One afternoon instead of several meetings with a consultant.

“When we've finished the table, write a draft scope and a draft information security policy — each no longer than one page.”

Your job: answer “I don't know” honestly when you don't know, and read the drafts as if you were the auditor.

✋ Manual route

Ten questions to ask yourself

  1. Do we know what information we protect and where it is?
  2. Has anyone assessed what could happen to it?
  3. Is there a security policy approved by the manager?
  4. Do we know who has access to what — and does anyone review it?
  5. Have the backups been tested? Is MFA switched on for everyone?
  6. Are employees trained, and is it recorded?
  7. Do we log incidents, even small ones?
  8. Have the suppliers with access to our data been assessed?
  9. Does anyone check that the procedures are really followed?
  10. Does management review all this at least once a year?

What to do this month

  1. Check whether NIS2 applies to your company (on the NKSC website or with a lawyer).
  2. Use the prompt above to do the gap analysis together with your IT person.
  3. Switch on three quick wins: MFA for everyone, a backup test, protection on every computer.

If you’d like us to do the gap analysis with you — pagalba@itbroliai.lt

Check yourself

Five questions on what you’ve just read. At the end you’ll get a certificate with your score.