NIS2 for UK MSPs: what it is and whether it applies to you

NIS2 is an EU directive on cybersecurity that took effect with a transposition deadline of 17 October 2024. It names managed service providers and managed security service providers directly. A UK based MSP is not automatically bound by NIS2, but it can fall in scope if it provides services to entities operating in EU member states. The UK has its own parallel route, the Cyber Security and Resilience Bill, which is moving in the same direction.

What is NIS2 in plain English?

NIS2 is the second version of the EU Network and Information Security Directive. It widens the original 2016 rules to cover more sectors and, for the first time, names IT managed services and managed security services as in scope. It splits organisations into two tiers, essential entities and important entities, with heavier supervision for essential ones. The core demand is risk-based security management, incident reporting within tight deadlines, and management accountability.

The sectors it covers are wide. Essential entities include energy, transport, banking, health, water and digital infrastructure. Important entities include postal services, waste management, chemicals, food, manufacturing of certain products, and digital providers. The reason MSPs care is that managed service providers and managed security service providers are listed in their own right, and almost every MSP also sells into one or more of those sectors, so the obligation arrives from both directions.

Does NIS2 apply to a UK based MSP?

It depends on where your clients operate, not only where you are registered. Three rough cases:

• You serve only UK clients with no EU operations: NIS2 does not bind you directly, but UK regulation is heading the same way. A questionnaire from a client’s insurer or bigger customer can ask NIS2-style questions anyway.
• You serve clients that operate in one or more EU member states: those clients are likely in scope and will push NIS2-style requirements down to you as their provider through contracts and supplier assessments.
• You provide managed or security services into the EU directly: you may be in scope as a provider in your own right under the member state’s implementing law.

The practical point: even when NIS2 does not bind you on paper, it reaches you through your clients’ supply chain obligations.

How is NIS2 different from the UK Cyber Security and Resilience Bill?

The UK left the EU NIS regime and is building its own. The Cyber Security and Resilience Bill brings managed service providers under UK oversight. It passed the Commons and reached Lords report stage in October 2026. It is aligned in spirit with NIS2 though not identical in detail. The direction for UK MSPs is clear even while the exact text is still moving.

What does NIS2 actually require?

Stripped of the legal language, the obligations land in four areas.

• Risk management: documented, proportionate security measures covering policies, access control, encryption, supply chain and continuity.
• Incident reporting: an early warning within 24 hours of becoming aware of a significant incident, a fuller report within 72 hours, and a final report within a month.
• Supply chain security: organisations must assess and manage the security of their providers, which is the line that pulls MSPs in.
• Management accountability: senior leaders can be held personally responsible for failures, so this is not only an IT problem.

Which MSP sizes are most exposed to NIS2?

Exposure tracks your client base, not your headcount. A 12-person MSP with three manufacturing clients that ship into Germany carries more NIS2 exposure than a 60-person MSP serving only UK retail. Size affects how much capacity you have to respond, not whether the obligation reaches you. Map by client footprint first, then worry about resourcing.

What evidence will an in-scope supplier assessment cover?

You watch every client’s systems, but nobody checks yours. NIS2 changes that for in-scope clients. The law makes them assess the security of their providers, so the obligation reaches you as a supplier assessment or a contract clause. Expect it to cover:

• A documented information security policy, owned and dated.
• Evidence of access control and enforced MFA across your estate.
• An incident response plan with reporting timelines that match the 24-hour and 72-hour rule.
• Backup and continuity testing results, not just a policy saying you have them.
• A named accountable owner, because management responsibility is part of the regime.

The MSPs that lose these accounts are the ones who treat each request as a fire drill. The ones that keep them have the evidence ready before the assessment lands.

What do UK MSPs most often get wrong about NIS2?

• Assuming that because the UK left the EU, NIS2 cannot reach them at all.
• Treating it as only an EU client’s problem and not a supplier obligation that flows down a contract.
• Waiting for the final UK Bill text before doing anything, when the underlying controls are the same either way.
• Treating it as a documentation exercise when the demands are operational and time-bound.

What to do this week

List every client that has staff, offices or customers in the EU. That list is your NIS2 exposure. Everything else is preparation you should be doing for UK regulation anyway.

NIS2 will not catch every UK MSP directly, but the question behind it, who checks the MSP, will reach many of them through supplier questionnaires, and in-scope MSPs through UK law. Assurix independently assesses 59 controls: 40 security controls aligned to NCSC CAF 4.0 and 19 operational controls built for MSPs. The evidence sits in one place. Live measures such as SLA response, patching and supported operating systems are refreshed every six hours, other controls on a set cycle. The result sits on a Trust Portal anyone can open. Leave a failure unfixed for 30 days and the Trustmark is suspended publicly.