This lesson is not legal advice. Check whether NIS2 applies to your company with Lithuania's National Cyber Security Centre (NKSC) ↗ (in Lithuanian) or with a lawyer.
## ISO 27001 in one sentence **It isn't an IT project but a management system:** the company decides what information it protects, assesses what could happen to it, chooses measures, applies them, checks whether they work, and keeps improving. The certificate doesn't confirm that a break-in is impossible. It confirms that this cycle really happens — and the auditor sees that from evidence, not from promises. ## What the standard is made of Two parts: - **Clauses 4–10** — requirements for the management system itself: scope, the role of management, risk assessment, training, internal audit, management review, improvement. Every one of them is mandatory. - **Annex A** — 93 security measures (controls), grouped into four themes. You decide which ones to apply based on your risks, and you justify the choice. > **Schema.** The 93 controls of ISO 27001:2022 Annex A by theme: organisational 37, technological 34, physical 14 and people 8. Most of the controls are not technological. Since November 2025, certificates are only issued against the 2022 version of the standard — if someone offers you a document set “based on 2013”, it's out of date. ## NIS2 and Lithuania: what has changed Lithuania transposed the EU's NIS2 directive through the updated **Cybersecurity Law** (Kibernetinio saugumo įstatymas), which came into force on **18 October 2024**. The supervising authority is **NKSC**. What a manager needs to know: - **More sectors and more companies.** The law covers not just energy or banks but many other sectors too. Companies are classed as essential or important entities. - **Responsibility lies with management.** Managers approve the security measures, oversee how they're implemented and must be trained themselves. - **Incident reporting** within set deadlines. The NIS2 model is an early warning within 24 hours, a notification within 72 hours and a final report within a month. Check the exact Lithuanian rules with NKSC. - **Fines** for essential entities — up to €10 million or 2% of annual turnover. **The link to ISO 27001:** a large share of the NIS2 measures overlaps with ISO 27001. A certified company has a solid foundation, but the legal obligations (registration, reports to NKSC) are handled separately. ## The road to certification > **Schema.** The road to an ISO 27001 certificate: the decision and the scope, risk assessment, choosing the controls and the Statement of Applicability, implementation and gathering evidence over several months, internal audit and management review, a certification audit in two stages, and annual surveillance audits after that. ## Five documents an audit can't start without 1. **Scope** — which part of the company, which locations, systems and processes. 2. **Information security policy** — short, approved by management. 3. **Risk assessment and risk treatment plan** — what could happen and what we do about it. 4. **Statement of Applicability (SoA)** — 93 controls: applied or not, and why. 5. **Internal audit and management review records** — proof that the system checks itself. On top of that — **evidence**: training lists, access reviews, backup tests, an incident log. That's exactly what the auditor looks for most. ## Where AI really helps — and where it doesn't **It helps with:** the gap analysis, first drafts of policies and procedures, a risk register template, an SoA draft based on your risks, training material, an internal audit questionnaire. That saves weeks of writing. **It doesn't help with:** creating reality. A document saying “all employees train every quarter” when nobody does is a straight road to a nonconformity at the audit. And one hard limit: an ISO project produces a lot of sensitive information — lists of systems, weaknesses, risks. Put it only into a **company-approved AI tool**. Why — in the lesson [How to start using AI at work (safely)](/en/lessons/using-ai-at-work-safely). ## A gap analysis in one afternoon The first step is always the same: where are we now? Copy this and paste it into your company-approved AI: ```text You are an ISO 27001:2022 consultant. Help me do a gap analysis for our company: where we are now and what's missing before certification. ABOUT US - Business, number of employees, number of offices: [...] - Why we need it: [client / tender / NIS2 / other] - Key systems: [e.g. Microsoft 365, accounting, CRM, website] - What we already have: [e.g. MFA, backups, antivirus, no documents] PROCESS 1. ASK. Ask questions based on clauses 4–10 and the four Annex A themes. One at a time. If I don't know the answer, mark it "unknown", not "in place". 2. TABLE. Requirement → status (in place / partly / missing / unknown) → what's missing → priority → who is responsible. 3. FIRST STEPS. Suggest a scope statement and the 10 most important tasks for the first three months. GOAL The job is finished when I have a gap table and a list of tasks for the first three months with the people responsible. RULES - Don't assume anything is "implemented". If in doubt, it's "unknown". - Don't give legal conclusions about NIS2 — tell me what to check with NKSC. - Don't quote the standard word for word; explain it in your own words. - Answer in English. AT THE END Separately — WHAT YOU DID NOT CHECK and which questions to ask the certification body. ```🤖 AI route recommended
You get the best result when you answer the AI's questions together with whoever looks after IT, and with the manager or the accountant. One afternoon instead of several meetings with a consultant.
“When we've finished the table, write a draft scope and a draft information security policy — each no longer than one page.”
Your job: answer “I don't know” honestly when you don't know, and read the drafts as if you were the auditor.
✋ Manual route