Managed service providers (MSPs) and managed security service providers (MSSPs) are an Annex I sector under NIS2: “ICT service management (business-to-business)”. If you are a medium-sized enterprise or larger and provide services in the EU, you are in scope. Medium-sized providers are important entities, large ones are essential entities. It does not depend on whether your customers are themselves covered by NIS2.
This guide covers what counts as an MSP, how size decides your category, which country supervises you, what you must register, the security and reporting rules, what your customers will now ask of you, and a checklist.
| Question | Answer for an MSP or MSSP | Where it comes from |
|---|---|---|
| In scope? | Yes, if medium-sized or larger, or identified by a Member State | Article 2, Annex I point 9 |
| Category | Large: essential. Medium-sized: important | Article 3 |
| Supervised by | Member State of main establishment in the EU | Article 26 |
| Register with | Your competent authority, feeding ENISA’s EU registry | Article 27 |
| Security rules | Article 21 plus the annex of Implementing Regulation 2024/2690 | Article 21(5) |
| When an incident is significant | Articles 3, 4 and 10 of Implementing Regulation 2024/2690 | Article 23(11) |
| Reporting | 24 hours, 72 hours, one month | Article 23 |
| Fine ceiling | At least €10M or 2% of turnover (essential), €7M or 1.4% (important), whichever is higher | Article 34 |
What counts as a managed service provider under NIS2?
Article 6(39) defines a managed service provider as an entity that provides services “related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely”. That covers most IT outsourcing, managed infrastructure and managed workplace services.
A managed security service provider is an MSP that “carries out or provides assistance for activities relating to cybersecurity risk management” (Article 6(40)). Recital 86 gives examples: incident response, penetration testing, security audits and consultancy.
Are MSPs and MSSPs in scope of NIS2?
Yes, by size. NIS2 applies to entities of a type listed in Annex I or II that qualify as medium-sized enterprises or exceed that size, under the EU definition in Recommendation 2003/361/EC (Article 2(1)).
In practice, you are out of the size rule only if you are a small or micro enterprise: fewer than 50 staff, and annual turnover or balance sheet total of €10 million or less. Staff are counted in annual work units, and the figures of partner and linked enterprises, such as the rest of your group, generally count too. A 30-person MSP inside a large group can therefore be in scope.
Size is not the only route. A Member State can identify a provider of any size, for example where it is the sole provider of an essential service in that country, or where its disruption could have a significant impact on public safety or a systemic effect (Article 2(2)).
Is an MSP an essential or an important entity?
| Your size (EU SME definition) | NIS2 category |
|---|---|
| Micro or small | Out of scope, unless identified by a Member State |
| Medium-sized: fewer than 250 staff, and turnover up to €50M or balance sheet up to €43M | Important entity, unless a Member State identifies it as essential |
| Above the medium-sized ceilings | Essential entity |
The obligations are the same for both. What differs is supervision and the fine ceiling. An essential entity can be audited regularly by an independent body or the authority. An important entity is supervised after the fact, when there are indications that it does not comply. The difference is explained in essential vs important entities.
Which country supervises an MSP?
MSPs and MSSPs follow the main establishment rule (Article 26(1)(b)). Your main establishment is in the Member State where decisions on cybersecurity risk-management measures are predominantly taken. If that cannot be determined, or those decisions are not taken in the EU, it is where your cybersecurity operations are carried out. Failing that, it is the establishment with the most employees in the EU.
A provider not established in the EU but offering services there must designate a representative in one of the Member States where it offers services. It then falls under that country’s jurisdiction. The detail is in NIS2 jurisdiction and main establishment.
What must an MSP register?
MSPs and MSSPs are among the providers listed in ENISA’s EU registry (Article 27). You submit to your competent authority your name, sector and type, the address of your main establishment and other EU establishments, contact details, the Member States where you provide services, and your IP ranges. The directive set 17 January 2025 as the date for this information. Changes must be notified without delay, and in any event within three months. The single point of contact forwards the data to ENISA, except the IP ranges.
National laws organise this differently, often through a self-registration form. If you have not registered yet, do it now: the obligation still applies.
What security requirements apply to MSPs?
The ten measures of Article 21, explained in NIS2 Article 21. For MSPs and MSSPs they are made concrete by Commission Implementing Regulation (EU) 2024/2690. Its annex sets technical and methodological requirements in 13 sections, from security policy and risk management to incident handling, business continuity, supply chain security, access control, asset management, and environmental and physical security.
For an MSP, the risk that matters most is concentration. One set of remote management tools and administrative accounts can reach hundreds of customer environments. Access control, multi-factor authentication on management tools, separation between customer environments, and logging of administrative sessions are where an authority and a customer will both look first.
When must an MSP report an incident?
When an incident is significant. Under Article 23, you send your CSIRT or competent authority, without undue delay, an early warning within 24 hours of becoming aware of it and an incident notification within 72 hours, an intermediate report if asked, and a final report within one month of the notification. Where appropriate, you also notify the recipients of your services without undue delay.
Implementing Regulation (EU) 2024/2690 sets the criteria for “significant”. Some apply to all the providers it covers: for example, an incident that causes or can cause direct financial loss above €500,000 or 5% of annual turnover, whichever is lower, and recurring incidents that meet the conditions of its Article 4. Article 10 adds criteria specific to MSPs and MSSPs, including a managed service being completely unavailable for more than 30 minutes, or limited for more than 5% of its EU users (or more than 1 million, whichever is smaller) for over an hour, and data compromised by a suspected malicious action. When an incident affects a customer’s environment, both you and the customer may have reporting duties. Agree in advance who reports what. The general clock is covered in the NIS2 incident reporting timeline.
What do customers now expect from their MSP?
More than before, and in writing. Every customer that is in scope must manage the security of its direct suppliers and service providers (Article 21(2)(d) and (3)). Recital 86 asks entities to exercise “increased diligence” when selecting a managed security service provider, because MSSPs are closely integrated in their customers’ operations and have themselves been targeted.
Expect contract clauses on security requirements, incident notification, audit rights, vulnerability handling, subcontracting and exit, which is the list the implementing regulation sets for supplier contracts. The customer side of this is in NIS2 supply chain security. If you are small and outside NIS2 yourself, the same requirements reach you through these contracts.
Is anything changing for MSPs?
Two things are in progress, neither of them law yet for you.
- Certification of managed security services. Regulation (EU) 2025/37 amended the Cybersecurity Act so that managed security services can be certified. ENISA is preparing a candidate scheme (EUMSS) at the Commission’s request of April 2025.
- NIS2 amendments. On 20 January 2026 the Commission proposed targeted amendments (COM(2026) 13), including a new “small mid-cap” category intended to reduce compliance costs, and simpler jurisdiction rules. Until adopted and transposed, the current rules apply.
Where MSP compliance programmes go wrong
MSPs are good at running controls and bad at proving them for themselves. The evidence an authority or a customer asks for sits across the remote management platform, the identity provider, the ticketing system and each customer tenant. Assembled by hand for each audit and each questionnaire, it costs days and is out of date the week after.
The better approach is to collect it continuously from those systems, per customer where needed, and have a person review what the data does not settle. That is how the CloudSoul platform works: automation for the evidence, human expertise for the judgement calls. To see where you stand first, a security audit against Article 21 and the implementing regulation is the fastest route. The wider programme is on the NIS2 compliance page.
NIS2 checklist for MSPs and MSSPs
- Check your size against the EU SME definition to confirm important or essential status.
- Identify your main establishment and competent authority.
- Register, or check your registration and IP ranges are current.
- Map your controls to the annex of Implementing Regulation (EU) 2024/2690.
- Enforce MFA and session logging on every tool that reaches customer environments.
- Set up incident classification against the regulation’s criteria and the 24-hour clock.
- Agree incident reporting roles with each customer in the contract.
- Prepare one reusable evidence pack for customer questionnaires and audits.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 6, 21, 23, 26, 27, 32 to 34, Annex I and recital 86, EUR-Lex.
- Commission Recommendation 2003/361/EC, SME definition, Annex, Article 2, EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690, Articles 3, 4 and 10 and Annex, EUR-Lex.
- ENISA, candidate scheme on managed security services (EUMSS), ENISA certification.
- European Commission, Cybersecurity package questions and answers, 20 January 2026, Shaping Europe’s digital future.
Frequently asked questions
Does NIS2 apply to managed service providers?
Yes. Managed service providers and managed security service providers are listed in Annex I of NIS2 under ICT service management (business-to-business). An MSP or MSSP that is a medium-sized enterprise or larger and provides services in the EU is in scope, whether or not its customers are covered by NIS2.
Is an MSP an essential or an important entity under NIS2?
It depends on size. An MSP that exceeds the EU ceilings for medium-sized enterprises is an essential entity. A medium-sized MSP is an important entity. A Member State can also identify a smaller provider, for example if it is the sole provider of an essential service.
Does NIS2 apply to small MSPs?
Generally not directly. Small and micro enterprises are outside the size rule unless a Member State identifies them. But customers that are in scope must manage supply chain risk, so small MSPs are receiving the same security requirements through contracts and questionnaires.
Which country supervises an MSP under NIS2?
The Member State of its main establishment in the EU, which is where decisions on cybersecurity risk-management measures are predominantly taken (Article 26). An MSP not established in the EU but serving EU customers must designate a representative in a Member State where it offers services.
What must an MSP report under NIS2?
Significant incidents affecting its services: an early warning within 24 hours, an incident notification within 72 hours and a final report within a month. Implementing Regulation (EU) 2024/2690 sets specific criteria for when an incident at an MSP or MSSP is significant.
