NIS2 Directive: obligations, risks and growth levers

NIS2: why the directive also concerns MSPs

This positioning is not theoretical. As ENISA points out in its recent threat reports, so-called pivot attacks, where a provider is compromised in order to reach several of its clients, have become one of the preferred methods of cybercriminal groups.

The digital supply chain is now identified as a major risk vector across Europe.

For an MSP, NIS2 is therefore not simply one more regulatory constraint. It is a redefinition of its responsibility within the European digital ecosystem.

Can an MSP be in scope even if it is not a large company?

Yes, and it is one of the most misunderstood points of the directive.

The NIS2 Directive distinguishes two categories of entities:

• essential entities
• important entities

Applicability depends first on the nature of the activity (MSPs are explicitly targeted as B2B managed IT service providers), and then on size thresholds (medium-sized companies and above).

However, size is not always a sufficient or exclusive criterion.

The text explicitly provides that some entities may be subject to NIS2 regardless of their size, in particular when they are considered critical by a Member State, for example:

• when they are the sole provider of an essential service in a territory,
• when a disruption of their activities is likely to create a significant systemic risk,
• or when they play a key role at national or regional level.

In practice, an MSP that administers critical systems, privileged access, backups or security tooling may be identified as a high-impact player in the digital value chain, beyond its headcount or turnover alone, depending on the assessment criteria adopted in national transposition.

MSPs and the supply chain: the NIS2 cascade effect

The NIS2 Directive explicitly introduces an obligation to manage supply chain risks. In-scope entities must take into account the risks associated with their suppliers, subcontractors and IT providers.

ANSSI, France’s national cybersecurity agency, also insists on this point in its recommendations: control of cyber risk can no longer be limited to an organisation’s internal perimeter.

For MSPs, this has very concrete consequences, even when they are not directly subject to NIS2:

• security audits requested by clients who are subject to the directive,
• strengthened contractual requirements,
• requests for evidence of cyber maturity (DRP/BCP, access management, monitoring, incident procedures).

Even a client not directly subject to NIS2 may demand these guarantees, simply out of business continuity and supplier risk management logic.

Executive liability: a turning point for MSPs

NIS2 introduces strengthened accountability for management bodies in matters of cybersecurity.

Executives must in particular:

• approve cyber risk management measures,
• oversee their effective implementation,
• be able to demonstrate their effectiveness.

The directive provides for administrative sanctions in the event of non-compliance and, depending on national transposition arrangements, opens the possibility of individual measures against executives.

For the head of an IT services company, cybersecurity is therefore no longer an exclusively technical subject: it is a matter of governance and managerial responsibility.

What concrete obligations does NIS2 impose on an MSP?

The NIS2 Directive does not impose specific tools, but defines clear security objectives, to be adapted proportionately to the organisation’s context.

Among the central requirements applicable to IT providers:

• rigorous access management and strong authentication (MFA),
• encryption and cryptography policies,
• business continuity measures (backups, documented and tested DRP/BCP),
• structured management of security incidents,
• basic cyber hygiene and ongoing staff training.

Securing administration tools (RMM, VPN, remote access), logging and monitoring of security events are consistent operational translations of these requirements, widely expected in a compliance framework.

Incident management is, however, the most structuring point.

Incident notification: what the directive actually provides for

Directive (EU) 2022/2555 imposes a multi-step notification process for significant incidents:

• an early warning within 24 hours of becoming aware of the incident,
• a detailed notification within 72 hours,
• intermediate reports, if requested by the competent authority,
• a final report submitted no later than one month after the initial notification or, if the incident is still ongoing, a progress report followed by a final report within one month of resolution.

For an MSP, this means being able to detect, analyse and qualify incidents in a way that is fast, structured and documented.

Field example: what NIS2 concretely changes for an MSP

This kind of situation is becoming more and more common.
NIS2 does not create the risk; it makes it visible, measurable and enforceable, including contractually.

How to get compliant? NIS2 checklist

An MSP able to demonstrate its compliance must have, at a minimum:

• a clear map of its tools and privileged access,
• formalised incident management procedures,
• a documented and regularly tested DRP/BCP,
• continuous monitoring of its critical environments,
• an operational incident response capability,
• an identified and owned cyber governance structure.

Without these elements, compliance remains theoretical and hard to defend in front of a client or an auditor.

Risks and penalties: beyond fines

The financial penalties provided for by NIS2 can reach:

• up to €10 million or 2% of worldwide turnover for essential entities,
• up to €7 million or 1.4% of worldwide turnover for important entities.

For an MSP, however, the main risk is often elsewhere:

• loss of strategic contracts,
• breakdown of the relationship of trust,
• public exposure after an incident notification.

Conversely, an MSP able to demonstrate its compliance and cyber maturity positions itself as a trusted provider, a differentiator in an increasingly selective market.

Key takeaways on the NIS2 Directive

The NIS2 Directive profoundly redefines the role of the MSP in the European digital ecosystem. It turns the IT provider into a key player in cyber resilience, with increased technical, legal and organisational responsibilities.

In operational reality, few MSPs have in-house:

• a 24/7 SOC,
• a full incident response capability,
• a team dedicated to regulatory compliance.

For MSPs who anticipate, NIS2 becomes a new quality standard and a lasting differentiator. For the others, it risks becoming a factor of gradual exclusion from the most strategic environments.

That is why many providers choose to rely on specialist partners to cover the most critical areas, in particular detection, investigation and incident response, while keeping the client relationship and control of their offering.

Players such as Cyna support MSPs on these challenges, bringing operational expertise and an industrial-scale capability that is hard to maintain in-house, within a framework that meets NIS2 requirements.