FAQEU NIS2

Are managed service providers in scope of NIS2?

Yes, when the entity provides covered managed service or managed security service activities in the Union and meets the NIS2 size or special-case scope rules.

Use the service definition, Annex I sector entry, Article 2 scope rule, Article 3 entity category, and Article 26 jurisdiction rule before treating an MSP or MSSP as in scope, out of scope, essential, or important.

Author
Sorena AI
Published
May 9, 2026
Updated
Jul 25, 2026
Questions
3

Structured answer sets in this page tree.

Primary sources
6

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 25, 2026
Overview

NIS2 lists business-to-business managed service providers and managed security service providers in Annex I. Coverage is not automatic from an MSP or MSSP label. Confirm that the legal entity performs the Article 6 service, provides services or carries out activities in the Union, meets the Article 2 size or special-case rule, and then classify it under Article 3. An Annex I entity above the medium-enterprise ceilings is generally essential; an in-scope medium-sized provider is generally important unless another Article 3 rule applies.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

Short answer

Annex I lists ICT service management (business-to-business), including managed service providers and managed security service providers. Article 6 defines a as an entity providing services related to installation, management, operation, or maintenance of ICT products, networks, infrastructure, applications, or other network and information systems through assistance or active administration on customer premises or remotely. A is an MSP that performs or assists with cybersecurity risk-management activities.

The sector entry is only the first step. Article 2 generally covers an Annex I provider that qualifies as medium-sized under Recommendation 2003/361/EC or exceeds the medium-enterprise ceilings and has the required Union activity. Article 3(1)(a) generally makes an Annex I provider above those ceilings essential. A covered medium-sized MSP or MSSP that does not meet an essential-entity limb is important under Article 3(2). Small providers need a separate Article 2(2) special-case and national-law check before being treated as outside scope.

  • Start with the legal entity, not the brand name or product line.
  • Confirm the activity involves assistance or active administration of the customer's ICT environment or cybersecurity risk management, not only resale, staffing, or delivery of a product.
  • Check whether the service is provided or carried out within the Union.
  • Apply the size-cap and any Article 2 special-case rule before deciding the entity is outside NIS2.
  • Classify the result as essential, important, outside current scope, or escalated for Member State legal review.

Are managed service providers in scope of the EU NIS2 Directive?

They can be. NIS2 Annex I includes business-to-business managed service providers and managed security service providers. Verify the Article 6 service definition, the Article 2 medium-or-larger size test or a size-independent special case, the Union activity, and the Article 3 tier. A provider above the medium-enterprise ceilings is generally essential; a covered medium-sized provider is generally important unless another essential-entity rule applies.

Citations
Directive (EU) 2022/2555 (NIS2)

Article 6 defines managed service provider and managed security service provider, Article 2 supplies the size and special-case scope rule, and Annex I lists MSPs and MSSPs under ICT service management.

European Commission NIS2 FAQ

Commission FAQ context confirms NIS2 replaced the old OES/DSP split with essential and important entity categories and lists ICT service management among high-criticality sectors.

Question 2

Evidence to keep for an MSP or MSSP scope decision

The classification file should show why the service meets, or does not meet, the NIS2 MSP or MSSP definition. A sales category is not enough; the record should explain the actual installation, management, operation, maintenance, active administration, or cybersecurity risk-management activity provided to customers.

The record should also show the entity-level analysis. Identify the contracting legal entity and apply the Recommendation's partner- and linked-enterprise aggregation rules where relevant. Then record the main-establishment decision, any Union representative, and the national registration and authority route.

  • Covered service evidence: service catalogue entry, statement of work, managed platform description, runbook, customer responsibility matrix, or remote administration model.
  • MSSP evidence where relevant: incident response, monitoring, security administration, penetration testing, security audit, consultancy, or other cybersecurity risk-management services.
  • Scope evidence: Union service footprint, customer country list, establishment details, size-cap analysis, and any special-case rule considered under Article 2.
  • Classification evidence: whether the entity is essential, important, out of current scope, or escalated for country-specific interpretation.
  • Jurisdiction evidence: where cybersecurity risk-management decisions are predominantly taken; if that does not identify a Member State or those decisions are not taken in the Union, where cybersecurity operations are carried out; if that also fails to identify a Member State, the Union establishment with the highest employee count.
  • Non-Union provider evidence: the Union representative, the Member State where it is established, and the Member States where services are offered.
  • Registry evidence: the Article 27 submission, including the main and other Union establishments or representative, current contacts, service countries, and IP ranges, plus change notifications required by national implementation.
  • Governance evidence: accountable business owner, legal reviewer, security reviewer, approval date, and trigger for reassessment after service, corporate, country, or national-law changes.
  • Implementation evidence: for a covered MSP or MSSP, map Article 21 measures to the binding technical and methodological requirements in Implementing Regulation (EU) 2024/2690, document any 'not appropriate', 'not applicable', or 'not feasible' reasoning required by that regulation, and retain the evidence ENISA guidance recommends.
Citations
Directive (EU) 2022/2555 (NIS2)

Article 3 requires Member States to keep lists of essential and important entities and requires entity details such as contact information, sector, subsector, and Member States where services are provided.

NIS2 Technical Implementation Guidance

ENISA guidance supports implementation of the NIS2 implementing regulation for digital infrastructure, ICT service management, and digital providers, including evidence examples and mappings.

Question 3

Common scope traps for managed services

A provider can be an MSP or MSSP even when the customer owns the environment because Article 6 includes assistance or active administration on customer premises or remotely. A supplier is not necessarily an MSP merely because it sells software, cloud capacity, hardware, professional services, or staff. Classify the activity from the contract and actual operating model.

assigns an MSP or MSSP to the Member State of its main establishment in the Union using a three-step test: predominant cybersecurity risk-management decisions; if that Member State cannot be determined or those decisions are not taken in the Union, cybersecurity operations; and, if that Member State also cannot be determined, the Union establishment with the highest number of employees. A provider not established in the Union that offers services there must designate a representative in a Member State where it offers those services.

  • Do not classify only from a marketing label such as MSP, MSSP, SOC, cloud partner, or IT outsourcer.
  • Separate pure project work from a service involving installation, management, operation, maintenance, assistance, active administration, or cybersecurity risk management. Duration alone does not decide the definition.
  • Check each legal entity in a group; one affiliate's status does not automatically settle another affiliate's NIS2 classification.
  • Keep cloud, data centre, content delivery, trust service, and electronic communications classifications separate when the same group offers multiple NIS2-relevant services.
  • Escalate country-specific questions because Member States transpose and operate NIS2 through national competent authorities and registration mechanisms.
  • For incident reporting, add the Regulation 2024/2690 thresholds to the playbook: complete unavailability for more than 30 minutes; limited availability affecting more than 5 percent of Union users or more than 1 million Union users, whichever is smaller, for more than one hour; and specified compromises of service-related data.
Citations
Directive (EU) 2022/2555 (NIS2)

Recitals 113-117 and Article 26 explain jurisdiction, main establishment, Union representative, and ENISA registry considerations for cross-border MSPs and MSSPs.

European Commission NIS2 FAQ

The Commission FAQ highlights ICT service management as a high-criticality sector and explains the differentiated supervisory regime for essential and important entities.

Recommended next step

Record the service, entity, tier, and jurisdiction

Sorena can help convert the service definition, entity analysis, Member State route, and evidence list into a cited NIS2 scope record for managed service and managed security service providers.

Primary sources

References and citations

eur-lex.europa.eu
Referenced sections
  • The implementing regulation sets technical and methodological cybersecurity-risk-management requirements for covered digital and ICT service management entities, including MSPs and MSSPs.
"managed service providers"
eur-lex.europa.eu
Referenced sections
  • Recitals 113-117 and Article 26 explain jurisdiction, main establishment, Union representative, and ENISA registry considerations for cross-border MSPs and MSSPs.
"main establishment in the Union"
digital-strategy.ec.europa.eu
Referenced sections
  • The Commission FAQ highlights ICT service management as a high-criticality sector and explains the differentiated supervisory regime for essential and important entities.
"ICT service management"
enisa.europa.eu
Referenced sections
  • ENISA guidance supports implementation of the NIS2 implementing regulation for digital infrastructure, ICT service management, and digital providers, including evidence examples and mappings.
"ICT service management"
Related guides

Explore more topics

EU NIS2 Directive applicability test for entity scope
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
EU NIS2 Directive deadlines and compliance calendar | Article 23 clocks
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
NIS2 24-hour early warning: what to send and when
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 72-hour incident notification FAQ
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
NIS2 Annex I and Annex II Sector Scoping Guide
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
NIS2 Article 21 control baseline and evidence checklist
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
NIS2 Article 21 control-by-control evidence checklist
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
NIS2 Article 21 Gap Assessment Workflow: controls, evidence, and owners
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
NIS2 Article 23 incident notification workflow
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
NIS2 Compliance Checklist: scope, controls, reporting
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
NIS2 Compliance Guide: scope, controls, reporting, and evidence
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
NIS2 Country Implementation Matrix: Authorities, Portals, and Local Deltas
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
NIS2 entity classification FAQ
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
NIS2 Entity Classifier Workflow: essential vs important entity scoping
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
NIS2 entity supervision guide
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
NIS2 essential vs important entities: Article 3 scope and supervision guide
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ: scope, Article 21 controls, incident reporting, and penalties
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
NIS2 incident clock triage workflow
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
NIS2 Incident Reporting Workflow: 24-hour, 72-hour, and final report steps
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
NIS2 Management Body Accountability: board duties, training, and evidence
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
NIS2 Member State Transposition: What Teams Must Check
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
NIS2 National Transposition Tracker: EU Member State Evidence Register
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 penalties and fines: Article 34 maximum levels and factors
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
NIS2 Registration and Authority Notification Guide
Map NIS2 Article 3 entity-list duties, Article 27 registry submissions, competent-authority contacts, and national registration portal evidence without inventing country deadlines.
NIS2 Requirements: scope, Article 21 controls, reporting, and evidence
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
NIS2 Size Cap Rule and Special Scope Cases
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
NIS2 size-cap rule: when medium and large entities are in scope
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.
NIS2 Supply Chain Security Program: Article 21 Guide
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
NIS2 vs CER Directive comparison: cyber obligations and critical-entity resilience
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
NIS2 vs DORA: scope, overlap, and evidence for EU cyber compliance
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
NIS2 vs GDPR breach reporting: EU deadlines and overlap
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
NIS2 vs ISO/IEC 27001: legal duties, ISMS evidence, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
NIS2 vs ISO/IEC 27017: legal duties, cloud controls, and reuse limits
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
NIS2 vs NIS1: what changed in EU cybersecurity compliance
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.