When my customer falls under NIS2, does the MSP fall under it too?
Possibly in two ways: directly, because NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. lists managed service providers and managed security service providers among the sectors it covers, and indirectly, because customers in scope must manage security in their supply chain and will pass requirements to you by contract. Whether an MSPMSP: managed service provider. A company that runs IT for other companies. is directly in scope depends on its size and on how its country transposed the directive, so check your national law and the national authority's guidance. This is general information, not legal advice. Either way, expect security questionnaires, contract clauses on incident notification and audits, and requests for evidence. Prepare a description of your own controls, how you protect access to clients, and how you would report an incident to them.
Read next
Related questions
- What is in a NIS2 supplier questionnaire, and how do I answer it?
- What NIS2 evidence can an MSP give its clients every quarter?
- How can an MSP give clients incident evidence quickly?
- Does an EU MSP need an EU-hosted security vendor for its clients?
- How can an MSP show clients which AI tools their staff use?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- MSP (managed service provider)
- A company that runs IT for other companies.