IT Service Provider: The Complete NIS2 Guide

IT service providers face a dual role under NIS2: many are themselves Important or Essential Entities as managed service providers (MSPs) or cloud providers under NIS2 Annex II No. 6 (ICT Services). At the same time, as suppliers to other NIS2-obligated companies, they are subject to supply chain obligations under § 30 Para. 2 No. 4 BSIG-new. This guide is written for managing directors and CISOs of IT service providers, MSPs, and cloud providers.

Who is affected?

IT service providers fall directly under NIS2 Annex II No. 6 (providers of digital infrastructure) or Annex II No. 7 (ICT services B2B) when they exceed the SME thresholds: at least 50 employees or at least EUR 10 million in annual revenue (EU Recommendation 2003/361/EC Art. 2).

Large cloud providers, DNS resolvers, TLD registries, and internet exchange points fall under NIS2 Annex I No. 7-8 as Essential Entities - regardless of revenue thresholds.

Additionally: IT service providers that serve other NIS2-obligated entities (e.g., hospitals, energy suppliers, government agencies) are treated as critical suppliers by those customers under § 30 Para. 2 No. 4 BSIG-new. This means: even if not directly in scope, you may be required to be NIS2-compliant by customer demand.

An MSP with 60 employees serving hospitals, municipalities, and energy utilities is affected by NIS2 both directly and indirectly.

Obligations under § 30 BSIG-new

§ 30 BSIG-new requires seven technical and organizational measure areas that are especially significant for IT service providers as critical suppliers:

1. Risk analysis and management: IT service providers must assess their own security architecture and also the risks their services pose to their customers.
2. Incident handling: A security incident at the MSP can simultaneously affect many NIS2-obligated customers. The incident response plan must include customer notification and coordinated response.
3. Business continuity: IT service providers must maintain BCP plans for their own infrastructure and for the services they deliver to customers.
4. Supply chain security: IT service providers are themselves part of their customers' supply chains. They must demonstrate to customers that they meet the requirements of § 30 Para. 2 No. 4 BSIG-new.
5. Access control and MFA: Privileged Access Management (PAM) and MFA for all privileged access to customer systems are an absolute requirement.
6. Encryption: Customer data, configuration data, and communications must be fully encrypted.
7. Training and awareness: IT personnel managing customer systems must receive regular cybersecurity training.

Deadlines and reporting obligations

BSI registration under § 33 BSIG-new within three months. For security incidents under § 32 BSIG-new: initial report within 24 hours, full report within 72 hours, final report within 30 days.

Special aspect for IT service providers: an incident at the MSP that affects NIS2-obligated customers must both satisfy your own NIS2 reporting obligations and be communicated to affected customers. Those customers have their own reporting obligations to the BSI.

Fines and personal liability

Important Entity (Annex II): up to EUR 7 million or 1.4% of turnover. Essential Entity (Annex I): up to EUR 10 million or 2% of turnover.

§ 38 BSIG-new: personal liability for management. For IT service providers, contractual liability to customers following security incidents is an additional layer. NIS2 fines plus customer damages can be existential.

Supply chain obligation § 30 Para. 2 No. 4: MSPs as critical suppliers and contract design

§ 30 Para. 2 No. 4 BSIG-new obligates all NIS2 entities to address "security aspects in the relationships between the entity and its direct suppliers." For IT service providers as frequent suppliers, this means: NIS2-obligated customers will make security demands on you.

This materializes in contracts: SLA clauses on security, customer audit rights, obligations to notify the customer of security incidents, and proof of security certifications (ISO 27001, SOC 2). Many NIS2 entities are already beginning to renegotiate existing supplier contracts accordingly.

MSPs can use the supply chain obligation as a market opportunity: those who achieve NIS2 compliance early and get certified differentiate themselves from competitors. ISO 27001 or SOC 2 Type II are the standard certifications that NIS2-obligated customers will demand.

First steps

1. Clarify your direct NIS2 scope: Annex I, Annex II, or no direct scope?
2. Identify which of your customers are NIS2-obligated. They will make security demands on you.
3. Review your current contracts: do they include security SLAs, audit rights, and incident notification?
4. Build a Privileged Access Management (PAM) system if one is not already in place.
5. Create an MSP-specific incident response plan that includes customer notification.
6. Evaluate ISO 27001 or SOC 2 Type II as a certification basis for customer inquiries.
7. Register with the BSI if you have direct NIS2 scope.

Common pitfalls

"We are not directly affected" as an excuse: Even without direct NIS2 scope, customers will impose security requirements under § 30 Para. 2 No. 4 BSIG-new. Those who are not prepared will lose customers.

Missing Privileged Access Management: MSPs managing customer systems with shared passwords do not meet NIS2 requirements. PAM is not an optional add-on.

Customer incidents handled only internally: If a security incident at the MSP affects NIS2-obligated customers, those customers must be informed. Failure to do so breaches both contractual obligations and NIS2 requirements.

Certification treated as a future project: NIS2-obligated customers will demand security certifications promptly. Those who only start the process when customers ask are already too late.

Use the industry-specific NIS2 calculator for IT service providers to clarify your obligations.