NIS2 · Information and IT
NIS2 and the Law on Information Security
Montenegro transposed NIS2 into its law in December 2024. Essential entities must hold a certificate to MEST ISO/IEC 27001 — the deadline is June 2027. Here is who is covered, which deadlines are running and why NIS2 and NIST are not the same thing.
NIS2 or NIST — not the same thing
These two names are constantly confused because they sound alike, but they are two completely different things. What is now mandatory in the European Union is called NIS2.
- NIS2 — Directive (EU) 2022/2555. A European law that every member state transposes into national legislation. It is not voluntary: it brings supervision, incident reporting obligations and penalties. The transposition deadline was 17 October 2024, and during 2026 supervisory authorities across the EU are already actively imposing fines.
- NIST — the US National Institute of Standards and Technology. Its Cybersecurity Framework 2.0 is a voluntary framework, not a regulation. There is no body that issues a NIST certificate and no audit to pass or fail.
In practical terms: if a customer, bank or regulator in Europe asks you something, they are asking about NIS2 and ISO 27001. NIST comes up when you work with a US partner — more on that below.
What Montenegrin law requires
The Parliament of Montenegro adopted the Law on Information Security on 19 November 2024, and it has been in force since 5 December 2024. The law is aligned with Directive (EU) 2022/2555, i.e. with NIS2.
The law divides obliged entities into essential and important entities. For essential entities the obligation is not described vaguely as "apply security measures" — the law explicitly requires a certificate of conformity with MEST ISO/IEC 27001, within 30 months of the law entering into force. That points to June 2027. The certificate also comes with an obligation of periodic conformity checks.
If you are not sure whether you are on the list of essential or important entities: the list is adopted by the Government, by the sectors set out in the law and regardless of the organisation's size, and the competent ministry notifies the entities on it. Important entities apply the prescribed measures without a mandatory certificate, and the law also requires other companies that use information systems to apply basic security measures and designate an employee to monitor them. Call us and we will check together — it is a five-minute question, and the answer changes your plan for the next two years.
Deadlines already running
- 5 December 2024 — the Law on Information Security entered into force.
- 31 October 2025 — the transition period from ISO/IEC 27001:2013 to the 2022 version ended. Certificates to the old version are no longer valid from that date. If your certificate says 2013, you do not have a valid certificate — regardless of the expiry date printed on it.
- June 2027 — the deadline by which essential entities in Montenegro must hold a certificate to MEST ISO/IEC 27001 (30 months from the law entering into force).
- ongoing — by 2026, 22 of the 27 EU member states had transposed NIS2, and supervision and penalties are already being applied. If you export or work for a European customer, the information security question comes from them, not from an inspector.
Implementing ISO 27001 realistically takes from four months to over a year, depending on the size of the system, so a 2027 deadline is not something you plan for in 2027.
Why everything revolves around ISO 27001
The law did not invent a new Montenegrin security system — it referred to an international standard that already exists. That is good news: what you do for the law also counts with a customer in Germany, in a tender and with a bank.
ISO/IEC 27001 provides what the regulation requires but does not describe: an inventory of information assets, a risk assessment, a Statement of Applicability (SoA), policies and procedures, staff training, incident reporting and handling, internal audit and management review. The certificate is issued by an independent accredited certification body — we prepare you for it.
When you really need NIST
The NIST Cybersecurity Framework 2.0 makes sense when you work with a US customer, parent company or partner who speaks that language. In that case you are asked to describe your security through their categories, not to be certified against them — because there is no NIST certification.
The good news is that you do not have to do the work twice. NIST publishes an official mapping of CSF 2.0 to ISO/IEC 27001:2022 (through the OLIR catalogue), so the same system you build for the law and the certificate can be translated into NIST terms. The mapping is one-directional and not one-to-one, but it covers most of the work.
Our advice is the same as for any dual requirement: ISO 27001 as the backbone, NIST as the vocabulary for the US side. The other way round — building to NIST and then getting certified to 27001 — means doing the same work twice.
What we actually do
- Checking whether you are an obliged entity — a short analysis of your sector and activities, and what the law means for you.
- Gap analysis — where you are now against ISO/IEC 27001:2022 and the requirements of the law.
- Implementation — risks, SoA, documentation, staff training, internal audit.
- Certification preparation and support on audit day, with an accredited certification body.
- Transition from 2013 to 2022 — if your certificate is still on the old version.
- Mapping to NIST CSF 2.0 when a partner requires it.
NIS2 and information security — frequently asked questions
Does NIS2 apply to Montenegro when we are not in the EU?
Not directly — the directive binds member states. But Montenegro has transposed its content into the Law on Information Security, in force since 5 December 2024. So the obligation reaches you through Montenegrin law. On top of that, if you work for an EU customer, under NIS2 they are required to check the security of their supply chain — so the question comes from that side as well.
Do I need a NIST certificate?
No such certificate exists. The NIST Cybersecurity Framework is a voluntary framework and there is no accredited body that issues certificates against it. If a partner asks for "NIST compliance", it is demonstrated by describing your own measures, most often by mapping to ISO 27001, which is a certifiable standard.
We have an ISO 27001 certificate from 2019 — is it valid?
Check which version of the standard it shows. If it says ISO/IEC 27001:2013, that certificate is no longer valid — the transition deadline to the 2022 version expired on 31 October 2025. The transition is then not done as an update but as a new certification.
How long does it take to implement ISO 27001 up to certification?
For small and medium-sized organisations, usually four to eight months, depending on process maturity and team availability. For large systems with several sites, more than a year. Because of the June 2027 deadline, that means work has to start much earlier.
What if we are an important rather than an essential entity?
The obligations are lighter — the focus is on risk management and incident reporting, with no explicit requirement for a certificate. That does not mean a certificate makes no sense: for most organisations it pays off because of customers and tenders, not because of inspections.
Related pages
The EU, the US and other markets
NIS2 is the same standard wherever you certify it — what differs is the designation, the accreditation behind the certificate and what your customers ask for.
In the European Union the standard is adopted with an EN prefix, and what your buyer in the Netherlands, Germany or France looks at is not the prefix but the accreditation behind the certificate: a body accredited by a signatory of the international recognition arrangement (Global Accreditation Cooperation, formerly IAF) is recognised in other markets too. What EU partners and EU regulation expect is on the page about the EU market.
For companies with customers in the United States — supplier audits, security questionnaires and how ISO sits alongside SOC 2 — see the page about the US market.
Wherever your customer is, we run the project remotely in English — over Teams, WhatsApp or Viber, with documentation and records in English — and on site when that is easier.
Some of our references
More than 400 organisations in Montenegro and the region have gone through implementation with us — from banks and public bodies to manufacturing, IT, laboratories and hospitality.
These are only some of our clients. More about us →
Does a tender require a standard?
Send us an extract from the tender documentation — we will check free of charge exactly what you need. Call us or send an inquiry — we reply within 24 hours.