NIS2 guide

NIS2 for managed service providers

NIS2 names managed service providers and managed security service providers as a sector of their own. If you run, maintain or secure IT for other businesses, this guide covers whether NIS2 applies to you, which EU country supervises you, and the detailed rules that apply to your type of business.

Article numbers refer to Directive (EU) 2022/2555 (NIS2) unless another law is named. "The Regulation" means Commission Implementing Regulation (EU) 2024/2690.

Last checked 3 November 2026 against the Directive's text and Implementing Regulation (EU) 2024/2690 on EUR-Lex. Each EU country puts the Directive into its own law, so check your country's law and authority as well. This is not legal advice.

1. Who counts as a managed service provider

Annex I of the Directive lists the sectors of high criticality. Point 9 is "ICT service management (business-to-business)", with two types of entity: managed service providers and managed security service providers. Article 6 defines both.

Article 6, point 39: "managed service provider" means "an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers' premises or remotely".

Article 6, point 40: "managed security service provider" means "a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management".

The first definition has three parts:

On its wording, that takes in an IT support company that looks after its customers' servers, laptops, networks or business applications, whether its staff visit or log in from their own office. The Annex heading says business-to-business, so the entry is about services to organisations, not to consumers.

A managed security service provider is a managed service provider whose work relates to cybersecurity risk management. Recital 86 names "incident response, penetration testing, security audits and consultancy" as examples of the areas these providers work in.

The Directive gives no further test, such as a minimum contract length or a share of revenue. If you are unsure whether your services fit, ask the authority in the country that would supervise you (section 3).

2. The size test

Managed service providers are not on the Directive's list of organisations covered at any size (Article 2(2) to 2(4)). So the general size test applies: NIS2 covers you if you are medium-sized or larger under Commission Recommendation 2003/361/EC (Article 2(1)). In short, that means 50 or more staff, or both annual turnover and balance sheet total above €10 million. Group figures count. The full table and the counting rules are in Does NIS2 apply to your business?

Because point 9 is in Annex I, your size also decides which group you are in (Article 3):

Your sizeGroup
Large: 250 or more staff, or turnover above €50 million and balance sheet total above €43 millionEssential entity (Article 3(1)(a))
Medium-sizedImportant entity (Article 3(2))
Small or microOutside NIS2, unless your country identifies you under Article 2(2), points (b) to (e)

A country can bring in a smaller provider if, for example, it is the sole provider of an essential service in that country or its disruption could cause a significant systemic risk. The authority identifies such providers. Essential and important entities take the same measures and report incidents the same way; supervision and maximum fines differ, as section 5 of Does NIS2 apply? explains.

A small provider outside NIS2 is still likely to hear about it, because customers in scope must manage the security of their suppliers (section 7).

3. Which EU country supervises you

Most organisations fall under the country where they are established. Managed service providers and managed security service providers are an exception: they fall under the country of their main establishment in the EU (Article 26(1)(b)). Only one EU country has jurisdiction over you, even if you serve customers in several (recital 114).

Article 26(2) finds the main establishment in three steps:

  1. the country where "the decisions related to the cybersecurity risk-management measures are predominantly taken";
  2. if that country cannot be determined, or those decisions are not taken in the EU, the country where cybersecurity operations are carried out;
  3. if that cannot be determined either, the country where you have the establishment with the most employees in the EU.

Recital 114 adds that the first step "will typically correspond to the place of the entities' central administration in the Union". Where your servers are is not decisive. For a group of companies, the main establishment of the controlling company counts as the main establishment of the group.

Registering. ENISA, the EU cybersecurity agency, keeps a registry of these providers (Article 27). You give your competent authority:

The Directive set 17 January 2025 for this (Article 27(2)). You tell the authority about changes without delay, and at the latest within three months (Article 27(3)). Your country's single point of contact forwards everything except your IP ranges to ENISA (Article 27(4)). This sits alongside the national list of essential and important entities in Article 3(4), and countries can collect both through the same national mechanism (Article 27(5)). Check your authority's website for how it takes registrations.

4. Providers outside the EU

A managed service provider that is not established in the EU, but offers services in the EU, must designate a representative in the EU. The representative must be established in one of the countries where you offer services, and you then fall under that country (Article 26(3)). The size test in section 2 still applies.

UK providers should read section 5 of NIS2 and UK businesses, which also covers the UK's own rules.

5. What Implementing Regulation 2024/2690 adds

Article 21(2) lists ten security measures in general terms. For managed service providers and managed security service providers, and nine other types of digital provider, the Commission had to set out the technical detail itself (Article 21(5)). Recital 84 gives the reason: these providers work across borders, so they "should be subject to a high degree of harmonisation at Union level".

The result is Implementing Regulation (EU) 2024/2690 of 17 October 2024. It is a regulation, not a directive: it is "binding in its entirety and directly applicable in all Member States", without national law in between. It does two things (Article 1):

Proportionate, but written down. You must take due account of your exposure to risks, your size, and the likelihood and severity of incidents (Article 2(2)). Many requirements apply "where appropriate", "where applicable" or "to the extent feasible". If you decide that one of those is not appropriate, applicable or feasible for your business, you must record your reasoning "in a comprehensible manner" (Article 2(2)).

The Annex has thirteen sections. Each names the Article 21(2) measure it belongs to; the links go to the matching section of our Article 21 checklist.

Annex sectionArticle 21(2) measure
1. Policy on the security of network and information systems(a) Risk analysis and security policy
2. Risk management policy(a) Risk analysis and security policy
3. Incident handling(b) Incident handling
4. Business continuity and crisis management(c) Business continuity
5. Supply chain security(d) Supply chain security
6. Security in acquisition, development and maintenance(e) Secure acquisition and maintenance
7. Assessing whether the measures work(f) Checking the measures work
8. Basic cyber hygiene and security training(g) Cyber hygiene and training
9. Cryptography(h) Cryptography
10. Human resources security(i) People, access and assets
11. Access control(i) People, access and assets; (j) MFA and secure communications
12. Asset management(i) People, access and assets
13. Environmental and physical security(c) Business continuity; (e) Secure acquisition and maintenance; (i) People, access and assets

Some section titles are shortened here. Four sets of requirements bear directly on how a managed service provider reaches its customers' systems. This selection is ours; the whole Annex applies.

Section 5 of the Annex also makes you manage your own suppliers: selection criteria, contract terms and a register of direct suppliers. Our guide to answering a NIS2 supplier questionnaire lists the eight contract items in point 5.1.4.

6. When an incident is significant

Entities in scope must report significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that notification (Article 23(4)). The steps are in NIS2 incident reporting.

For managed service providers and managed security service providers, the Regulation says exactly when an incident is significant. Article 10 sets four criteria for your service. An incident is significant if:

The general criteria in Article 3(1) also apply. An incident is significant if it causes, or could cause, any of these:

It is also significant if there has been "a successful, suspectedly malicious and unauthorised access to network and information systems" that is "capable of causing severe operational disruption" (Article 3(1)(e)).

The 30-minute test is the one to plan for. A complete outage of a managed service that lasts more than 30 minutes is significant whatever caused it, unless it was a scheduled interruption, so your monitoring has to tell you when a service is fully down and for how long.

7. Your customers will check you

Every organisation in scope must manage the security of its direct suppliers (Article 21(2)(d)). The Directive picks out your sector. Recital 85 says that addressing risks from suppliers "is particularly important", and names managed security service providers as an example of such a supplier. Recital 86 says these providers have "themselves been the target of cyberattacks and, because of their close integration in the operations of entities pose a particular risk", and that entities "should therefore exercise increased diligence in selecting a managed security service provider".

Expect security questionnaires, requests for evidence and security clauses in contracts, whether or not NIS2 applies to you. Our guide to answering a customer's NIS2 security questionnaire maps each Article 21 point to the evidence that answers it.

8. What to do next

  1. Compare the services you sell with the definitions in section 1, and write down your conclusion and why.
  2. Work out your size from your latest approved accounts, with your group's figures (section 2).
  3. If you are in scope, decide which country is your main establishment (section 3) and check that you are registered with its authority.
  4. If you are outside the EU and in scope, designate a representative in an EU country where you offer services (section 4).
  5. Work through the Regulation's Annex section by section. Where a requirement says "where appropriate" and you decide not to apply it, record why (section 5).
  6. Add the Article 10 thresholds to your incident procedure, and check that your monitoring would show a complete outage of more than 30 minutes (section 6).

Our NIS2 Small-Entity Compliance Kit has editable policies, registers and incident templates for the ten Article 21 measures, including an access control policy that covers privileged access. It follows the Directive, not the Regulation's Annex point by point, so a provider in scope should check each Annex requirement as well. One licence covers one organisation; to use the kit for your customers, email us before you buy.

Related guides: Does NIS2 apply to your business? · NIS2 Article 21 checklist

9. Sources