On this page
What is NIS2?
NIS2 is Directive (EU) 2022/2555, the EU's law on a high common level of cybersecurity. According to the European Commission, it covers 18 critical sectors, applies as a rule to medium-sized and large organisations in those sectors, and replaced the original NIS directive from 18 October 2024. Member States had until 17 October 2024 to turn it into national law.
Because it is a directive, each country applies it through its own national law, with its own authority, registration process and details. The Commission has also proposed targeted amendments, so check the current national rules rather than relying on the directive text alone.
This page is general information, not legal advice. Whether a particular client is covered, and as what type of entity, is a question for the client, their legal counsel and their national authority.
What does NIS2 ask of in-scope organisations?
In plain words, the directive asks four things of essential and important entities.
Management is accountable
Under Article 20, the organisation's management body must approve the cybersecurity risk-management measures, oversee how they are put in place, and can be held liable for failures. Members of management must also follow training, and organisations are encouraged to offer similar training to staff regularly.
Risk-management measures
Article 21 lists the minimum measures, using an "all-hazards" approach:
- Risk analysis and information security policies
- Incident handling
- Business continuity, including backups, disaster recovery and crisis management
- Supply chain security, covering the organisation's direct suppliers and service providers
- Security when buying, building and maintaining systems, including handling vulnerabilities
- Ways to check whether the security measures actually work
- Basic cyber hygiene and cybersecurity training
- Use of cryptography and, where appropriate, encryption
- Staff security, access control and asset management
- Multi-factor authentication and secured communications where appropriate
Incident reporting
Article 23 sets out staged reporting of significant incidents to the national CSIRT or authority: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification, with intermediate reports on request.
Penalties
For breaches of the risk-management or reporting rules, Article 34 requires Member States to set maximum fines of at least EUR 10 million or 2% of total worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher. National law can set higher maximums.
Where an MSP can help, and where it can't
Many of the Article 21 measures are things an MSP already does or can evidence for a client. Others belong to the client.
| Area | Where the MSP can help | What stays with the client |
|---|---|---|
| Scope | Gather facts about size, sector and customers | Decide legal status with counsel; register with the authority |
| Governance | Prepare clear reports for management | Approve measures and oversee them; take part in training |
| Technical measures | MFA, backups, patching, access control, encryption, asset inventory | Accept or reject risks; fund the work |
| Incident handling | Detect, contain and document incidents; draft report content | Submit reports to the authority on time |
| Supply chain | Answer supplier questionnaires about the MSP's own service | Assess all of their suppliers |
| Training | Deliver and track security awareness training | Make sure management and staff complete it |
Two points are easy to miss. First, NIS2 lists managed service providers and managed security service providers as a sector themselves, so a medium-sized or larger MSP may have its own obligations. Second, clients outside scope may still be asked for NIS2-style security commitments by in-scope customers, because supply chain security is one of the required measures.
How to track NIS2 preparation with a client
- Record the scope decision and who made it, with a date to revisit.
- Assess against the measures in Article 21, one check per requirement, with evidence for what is already in place.
- Tailor to the country. Replace generic references with the client's actual authority, CSIRT and reporting portal, and adjust for national rules.
- Turn gaps into planned work with owners, costs and dates, and add the significant ones to a risk register.
- Rehearse incident reporting so everyone knows who reports what within 24 and 72 hours.
- Report to management in plain language, because they must approve and oversee the measures.
Clients do not need to hear "Article 21(2)(j)". They need to hear "everyone signs in with a second factor, and here is the evidence". See How can MSPs show clients their compliance status?
How MSPortal supports NIS2 preparation
MSPortal's Compliance module includes ten NIS2 playbooks that MSP staff import as compliance checks, grouped by article:
- Scope and governance (Articles 2, 3 and 20), which records whether the client is an essential entity, an important entity or a supplier to one.
- Eight Article 21 playbooks covering risk analysis, incident handling, continuity and backup, supply chain, secure acquisition and vulnerabilities, cyber hygiene and training, cryptography and MFA, and HR security, access control and assets.
- Incident reporting (Article 23).
Each check starts with its article reference and includes how to check, why it matters, remediation, expected evidence, and cross-references to the implementing regulation, ISO/IEC 27001, CIS Controls and NIST CSF where they apply. The playbooks follow the directive text, so you tailor them for the client's country after import. They give structure to a review; they do not decide a client's legal status, replace legal advice or certify compliance.
Once imported, checks run like any other compliance work. Clients see their results, public notes and evidence in their portal, failed checks can become Planner items or tracked risks with owners and treatment plans, and compliance and risk blocks can go into the client's business review reports. The NIS2 playbooks guide lists every playbook. To see them, book a demo.
Related questions
Does NIS2 apply to small businesses?
As a rule, NIS2 applies to medium-sized and large organisations in the sectors it lists, though some smaller organisations can be covered for specific reasons. A small business may also be asked for security commitments by an in-scope customer. Confirm scope with legal counsel and the national authority.
What are the NIS2 incident reporting deadlines?
For significant incidents, the directive requires an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report no later than one month after the notification. National rules set the exact process and reporting channel.
Can an MSP make a client NIS2 compliant?
No. An MSP can implement and evidence many technical measures, but the client's management must approve and oversee them and remains accountable. Compliance also depends on national law, registration and reporting duties that only the client can fulfil.
Does NIS2 require security awareness training?
Article 20 requires members of management to follow training and encourages organisations to train staff regularly, and Article 21 includes basic cyber hygiene and cybersecurity training among the required measures. See How can MSPs deliver security awareness training to clients?