NIS2 for ICT service management (business-to-business)
A managed service provider is regulated from two sides: as an entity in scope in its own right, and as a direct supplier whose security its customers must take into account under article 21(2)(d) and 21(3). For managed security service providers, recital 86 asks essential and important entities to exercise increased diligence in selecting one.
Which entities are covered
Managed service providers — entities providing services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely (art. 6(39)) — and managed security service providers, the managed service providers that carry out or provide assistance for activities relating to cybersecurity risk management (art. 6(40)).
Sub-sectors named in the annex
None. Annex I divides this sector into no sub-sectors: it names the types of entity directly.
Essential or important
A large entity of this sector — one exceeding the ceilings for medium-sized enterprises of Recommendation 2003/361/EC — is essential (art. 3(1)(a)); a medium-sized one is important (art. 3(2)). A small or micro entity is covered only under article 2(2) or 2(3). Whatever its size, an entity is essential where article 3(1)(e) to (g) applies: identification by the member state as an essential entity under article 2(2)(b) to (e), critical-entity status under Directive (EU) 2022/2557, or, where the member state so provides, earlier identification as an operator of essential services. An entity the member state identifies as an important entity under the same points is important (art. 3(2)).
Essential entities face ex ante and ex post supervision (art. 32, recital 122) and, for infringing article 21 or 23, administrative fines with a maximum of at least EUR 10,000,000 or 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher (art. 34(4)); important entities face ex post supervision only (art. 33) and a maximum of at least EUR 7,000,000 or 1.4% of that turnover (art. 34(5)).
Traps specific to this sector
Trap 1
Jurisdiction lies with the member state of the main establishment in the Union — where decisions on cybersecurity risk-management measures are predominantly taken — not with each customer's member state (art. 26(1)(b), 26(2)). A provider not established in the Union that offers services within the Union designates a representative there (art. 26(3), recital 116).
Trap 2
Managed service providers and managed security service providers submit the information of article 27(2) — including their IP ranges — to the competent authority, and the single point of contact forwards it to ENISA for its registry, all but the IP ranges (art. 27(1), 27(2), 27(4)). Changes are notified to the competent authority without delay and in any event within three months (art. 27(3)); changes to the details given for the national list of entities, without delay and in any event within two weeks (art. 3(4)).
Trap 3
Implementing Regulation (EU) 2024/2690 applies to them: it sets the technical and methodological requirements of their article 21(2) measures and the cases in which their incidents are significant (art. 1).
Trap 4
Below the medium-sized threshold a managed service provider is covered only where article 2(2)(b) to (e) applies — for instance as the sole provider in a member state of a service which is essential for the maintenance of critical societal or economic activities (art. 2(2)(b)).
What else applies to you
Implementing Regulation (EU) 2024/2690 (technical and methodological requirements, significant incidents); Regulation (EU) 2022/2554 (DORA), whose article 30 sets the key contractual provisions financial entities include in contracts for ICT services; Delegated Regulation (EU) 2024/1366, for managed security service providers identified as high-impact or critical-impact entities (art. 2(1)(j)).
Article 4 disapplies a NIS2 provision only where a sector-specific Union act requires cybersecurity risk-management measures or incident notification at least equivalent in effect — and only for the entities that act covers.