NIS2 for Managed Service Providers (MSPs and MSSPs)

Are you an MSP or MSSP under NIS2?

NIS2 (Directive (EU) 2022/2555) lists managed service providers and managed security service providers in Annex I, sector 9, "ICT service management (business-to-business)". Article 6 defines them:

• Managed service provider (Article 6(39)): an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers' premises or remotely.
• Managed security service provider (Article 6(40)): a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management, for example a SOC, managed detection and response, or managed firewalls.

The definition is broad. Remote monitoring and management, managed workplace, managed cloud operations and outsourced IT support usually fit; selling licences without managing anything usually does not.

The size rule still applies

MSPs are not on the list of entities covered regardless of size. NIS2 applies if you are at least medium-sized: 50 or more staff, or both annual turnover and balance sheet total above €10 million, counting partner and linked enterprises (Article 2(1) and Commission Recommendation 2003/361/EC). Medium-sized MSPs are important entities; large ones are essential, because ICT service management is an Annex I sector (Article 3(1)(a)). See Does NIS2 apply to my company? for the full test.

Which country supervises you

MSPs and MSSPs fall under the jurisdiction of the member state of their main establishment in the EU, not of every country where they have customers (Article 26(1)(b)). The main establishment is where decisions related to cybersecurity risk-management measures are predominantly taken (Article 26(2)). A provider not established in the EU but offering services there must designate a representative in one of the member states where it offers services (Article 26(3)).

Registration

MSPs and MSSPs are among the entities ENISA keeps in a registry. Member states had to require them to submit their name, sector and type, addresses of their establishments, contact details, the member states where they provide services and their IP ranges, by 17 January 2025, and to notify changes within three months (Article 27). Check your national authority's registration portal; this is in addition to the general entity list under Article 3(4).

The detailed rules: Implementing Regulation (EU) 2024/2690

For MSPs and MSSPs, the Article 21 measures are not left to interpretation. The Annex to Implementing Regulation (EU) 2024/2690 sets technical and methodological requirements in 13 areas, applied proportionately to your exposure, size and the likelihood and severity of incidents (Article 2):

For an MSP, the supply chain section cuts both ways: you must manage your own suppliers, such as RMM and PSA vendors and cloud platforms, and your customers will apply the same rules to you. Our NIS2 supply chain guide covers section 5 in detail.

When an incident is significant

Article 3 of the Implementing Regulation sets general criteria: for example, direct financial loss above €500,000 or 5% of annual turnover, whichever is lower; exfiltration of trade secrets; or a successful, suspectedly malicious and unauthorised access capable of causing severe operational disruption. Article 10 adds criteria specific to MSPs and MSSPs. An incident is significant if:

• a managed service or managed security service is completely unavailable for more than 30 minutes;
• its availability is limited for more than 5% of the service's users in the EU, or more than 1 million users, whichever is smaller, for more than one hour;
• the integrity, confidentiality or authenticity of data related to the service is compromised as a result of a suspectedly malicious action;
• such data is compromised with an impact on more than 5% of the service's users in the EU, or more than 1 million, whichever is smaller.

Scheduled maintenance does not count (Article 3(2)), and repeated incidents with the same apparent root cause within six months can together count as one significant incident (Article 4). Significant incidents follow the NIS2 timeline: early warning within 24 hours, notification within 72 hours, final report within one month. See our NIS2 incident reporting guide.

The 30-minute rule changes how you monitor: an outage of your RMM platform or SOC service for more than half an hour can be reportable. Make sure monitoring and on-call escalation can classify it in time.

First steps for an MSP

1. Confirm size (including group companies) and main establishment, and register with your authority.
2. Map your services against the MSP and MSSP definitions, and note which customers are themselves under NIS2 or DORA.
3. Run a gap assessment against the 13 Annex sections of 2024/2690.
4. Set incident classification rules that include the Article 10 thresholds, and rehearse a 24-hour early warning.
5. Prepare a standard security pack for customers: policies, certifications, incident notification commitments.

Start the gap assessment today. The NIS2 Compliance Starter Kit includes a gap-assessment workbook, an incident response plan template, a supply chain security policy template and a board briefing deck.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 6, 23, 26 and 27, Annex I, EUR-Lex
• Commission Implementing Regulation (EU) 2024/2690, Articles 2 to 4 and 10, Annex, EUR-Lex

Related tools