# When my customer falls under NIS2, does the MSP fall under it too?

Possibly in two ways: directly, because NIS2 lists managed service providers and managed security service providers among the sectors it covers, and indirectly, because customers in scope must manage security in their supply chain and will pass requirements to you by contract. Whether an MSP is directly in scope depends on its size and on how its country transposed the directive, so check your national law and the national authority's guidance. This is general information, not legal advice. Either way, expect security questionnaires, contract clauses on incident notification and audits, and requests for evidence. Prepare a description of your own controls, how you protect access to clients, and how you would report an incident to them.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/when-my-customer-falls-under-nis2-does-the-msp-too

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [What is in a NIS2 supplier questionnaire, and how do I answer it?](https://netsenx.com/en/faq/what-is-in-a-nis2-supplier-questionnaire)
- [What NIS2 evidence can an MSP give its clients every quarter?](https://netsenx.com/en/faq/what-nis2-evidence-can-an-msp-give-clients-every-quarter)
- [How can an MSP give clients incident evidence quickly?](https://netsenx.com/en/faq/how-can-an-msp-give-clients-incident-evidence-quickly)
- [Does an EU MSP need an EU-hosted security vendor for its clients?](https://netsenx.com/en/faq/does-an-eu-msp-need-an-eu-hosted-security-vendor)
- [How can an MSP show clients which AI tools their staff use?](https://netsenx.com/en/faq/how-can-an-msp-show-clients-which-ai-tools-their-staff-use)