Your sector in the annexes: managed service and managed security service providers, word for word

In this lesson

• Quote Annex I, point 9, word for word, and draw the consequences of its layout for registration and classification.
• Test each service in your catalogue against the definitions of article 6(39) and 6(40), element by element.
• Recognise the services that add a second entity type with different rules: authoritative DNS, domain name resale, self-service cloud, data centre and public connectivity.
• Separate the two positions a managed service provider holds at once: a regulated entity in its own right, and a supplier inside its customers' supply chain programmes.

Point 9, word for word

Annex I, point 9

Annex I of Directive (EU) 2022/2555 is headed “SECTORS OF HIGH CRITICALITY” and is laid out in three columns: sector, subsector and type of entity. Point 9 reads, in full:

Sector	Subsector	Type of entity
9. ICT service management (business-to-business)	(none)	Managed service providers Managed security service providers

Three consequences follow from that single row.

• There is no subsector. When you submit your details for the national list, article 3(4)(c) asks for “where applicable, the relevant sector and subsector referred to in Annex I or II”; for the ENISA registry, article 27(2)(b) asks for “the relevant sector, subsector and type of entity referred to in Annex I or II, where applicable”. For point 9 the subsector is not applicable, so the type of entity, managed service provider or managed security service provider, is what identifies you.
• The row is in Annex I, not Annex II. That placement decides your class once you are in scope: article 3(1)(a) makes essential the Annex I entities that exceed the ceilings for medium-sized enterprises. The next lesson works through it.
• The row cites no other Union act. Energy and transport rows borrow their definitions from sector directives and regulations. Point 9 relies only on the definitions in article 6 of the directive itself.

The heading carries a qualifier, “(business-to-business)”, that the directive does not define. The two definitions below speak of “customers” without qualifying them. A provider whose managed services go only to households should write down how it reads the heading and check the position of its member state on the transposition tracker.

The managed service provider, element by element

Art. 6(39)

Article 6(39) defines a ‘managed service provider’ as “an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely”. Read it as five elements, all of which must be present:

1. An entity. Article 6(38) defines it as “a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations”. A sole trader is an entity; whether a sole trader is in scope is a question of size, not of definition.
2. One of four activities. Installation, management, operation or maintenance. The list is joined by “or”: an integrator that only installs and a support company that only maintains both perform a listed activity.
3. A wide object. ICT products (defined by reference to Regulation (EU) 2019/881 in article 6(12)), networks, infrastructure, applications “or any other network and information systems”. Article 6(1) makes a network and information system an electronic communications network, any device or group of interconnected or related devices that carry out automatic processing of digital data, and the digital data those elements store, process, retrieve or transmit. Laptops, firewalls, servers, a line-of-business application and a customer's cloud tenant are all inside it.
4. Two modes. “via assistance or active administration”: doing the work yourself with your own privileges on the customer's systems, or assisting the customer's own staff who do it.
5. Any place. “either on customers’ premises or remotely”. A technician on site and a remote operations centre are treated alike.

The definition sets no minimum contract value, no service level and no particular tooling. What it does require is a service of one of the four kinds. A company that only resells licences or hardware, with no installation, management, operation or maintenance, does not meet the activity element; once it starts installing or maintaining what it sells, it may.

The managed security service provider

Art. 6(40)

Article 6(40) defines a ‘managed security service provider’ as “a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management”. It is a subset: every managed security service provider must first meet the five elements of article 6(39). Running a customer's security monitoring, operating its firewalls or endpoint detection tools, or handling its incidents are the clear cases.

Recital 86 describes managed security service providers “in areas such as incident response, penetration testing, security audits and consultancy”. Some of those examples, a point-in-time penetration test or an audit report, do not obviously involve installing, managing, operating or maintaining a customer's systems, which the definition requires. The recital points to a broad reading; the definition remains the test. A firm that sells only tests, audits or advice should record its reasoning rather than assume either answer.

The label does not change your obligations. Every article that sets a rule for one type names the other beside it: article 21(5), article 23(11), article 26(1)(b), article 27(1), and article 10 of Implementing Regulation (EU) 2024/2690. The distinction shows in two places: the type of entity you declare (Art. 27(2)(b)), and the way customers must choose you, since recital 86 concludes that essential and important entities “should therefore exercise increased diligence in selecting a managed security service provider.”

Other types your services may add

Annex I, point 8

A managed service catalogue may not stop at management. Several add-on services are entity types of Annex I, point 8, or of article 2(4), with rules of their own:

Service you may also sell	Entity type	What changes
Operating your own authoritative name servers for customers' domains	DNS service provider: “authoritative domain name resolution services for third-party use” (Art. 6(20)(b))	In scope regardless of size (Art. 2(2)(a)(iii)); essential regardless of size (Art. 3(1)(b)); incident criteria in article 5 of 2024/2690
Registering domain names for customers as a reseller or agent of a registrar	Entity providing domain name registration services (Art. 6(22))	In scope regardless of size (Art. 2(4)); listed, not classified (Art. 3(3)); article 28 registration data duties
A platform where customers provision scalable, shared computing resources themselves, on demand	Cloud computing service provider (Art. 6(30))	Size rule; incident criteria in article 7 of 2024/2690
Colocation: accommodating customers' IT equipment in data centre structures you operate	Data centre service provider (Art. 6(31))	Size rule; incident criteria in article 8 of 2024/2690
Internet access or another publicly available electronic communications service	Provider of public electronic communications networks or publicly available electronic communications services	In scope regardless of size (Art. 2(2)(a)(i)); essential if medium-sized or larger (Art. 3(1)(a), (c))

The line between managed and cloud services is drawn by the texts themselves. The managed service provider works “via assistance or active administration”; recital 33 describes the on-demand administration of cloud computing as the user's capability to self-provision “without any human interaction by the cloud computing service provider”. A provider that runs both models is both types.

The directive classifies the entity, the natural or legal person, not the service line. If any point of article 3(1) applies to a legal person, it is essential, because article 3(2) covers only entities that do not qualify as essential. Its article 21 measures then cover the systems it uses “for their operations or for the provision of their services” (Art. 21(1)), across every service. Recital 21 acknowledges these complex business models and notes that the Commission could provide guidance on them.

Two positions at once

Art. 21(2)(d), 21(3)

An in-scope managed service provider is regulated in its own right: its management body approves and oversees the measures (Art. 20), it applies article 21, reports under article 23, registers under articles 3(4) and 27 and is supervised under article 32 or 33. At the same time it is a direct service provider to customers who must manage supply chain security, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” (Art. 21(2)(d)). Recital 83 adds that the customers' obligations apply “regardless of whether those entities maintain their network and information systems internally or outsource the maintenance thereof”. Outsourcing to you moves none of their obligations onto you, and none of yours onto them.

The supplier-side work, answering questionnaires, negotiating clauses and notifying customers in time for their own deadlines, is the subject of the role certification NIS2 for ICT Suppliers to Regulated Entities. This certification treats the managed service provider as the regulated entity.

What a supervisor will ask

• Which of your services fall under Annex I? The service catalogue mapped, line by line, to the article 6 definitions, per legal entity.
• Why did you declare yourself a managed security service provider, or not? The reasoning under article 6(40), including how you treated tests, audits and advice.
• Do you operate any infrastructure for third parties? Name servers, self-service platforms or hosting facilities, with the entity type each adds.
• What did you register? The sector and types declared under articles 3(4) and 27.

Key points

• Annex I, point 9, “ICT service management (business-to-business)”, lists two types, managed service providers and managed security service providers, and no subsector.
• Article 6(39) has five elements: an entity, one of four activities, a wide object, assistance or active administration, on premises or remotely.
• A managed security service provider is a managed service provider whose activities relate to cybersecurity risk management; both types carry the same obligations.
• Authoritative DNS, domain resale, self-service cloud, data centre and public connectivity services add entity types with their own scope and incident rules.
• Classification attaches to the legal person, and article 21 covers all the systems it uses for its operations and services.