Covered are managed service providers and MSSPs as providers of managed services. How strict the obligations become is decided by company size. Additionally NIS-2 requirements come from customer contracts, because customers classify you as a critical supplier. OdySecure, the security platform by Cybervize, covers your own ISMS plus a multi-tenant platform for your customers.
Book the NIS-2 risk checkStandard case under § 28 of the German BSIG. "Wichtige Einrichtung" is the standard tier, "besonders wichtige Einrichtung" the stricter tier; the figures are annual values. Calculating them in annual work units, attributing partner and linked enterprises, special cases and the final classification under German law all require a case-by-case legal review. MSPs and MSSPs sit in Annex 1 as providers of managed services and managed security services. The reporting deadlines require a significant incident (§ 32 BSIG).
Anyone operating services for others is audited twice: by their own regulator and by every customer. The evidence goes by different names and asks for the same things. In OdySecure it sits in one catalogue.
The NIS2 Implementing Regulation applies directly to certain digital services, regardless of size thresholds. That classification is set out below.
Managed service providers (MSPs), MSSPs and IT service providers are via the supply-chain clause additionally exposed indirectly through their NIS-2-obligated clients. Four consequences of this classification for MSPs and IT firms. Sector alone is not enough: classification as managed service provider, MSSP or digital infrastructure provider follows from the concrete activity per NIS2UmsuCG plus size thresholds. The legally binding evaluation remains a matter for specialised counsel.
From 250 employees, or at annual turnover above €50M and annual balance sheet total above €43M, a "wichtige Einrichtung" becomes a "besonders wichtige Einrichtung" (the stricter tier): highest sanction level, active BSI supervision. Cyber incidents in MSP infrastructure can hit thousands of customers simultaneously, hence the sector’s strict classification.
IT service providers must meet their own cybersecurity obligations AND prove to customers that they support those customers' NIS-2 obligations. Customer security questionnaires become routine.
MSPs manage several customers on shared infrastructure. NIS-2 requires strict data isolation, cross-sector risk assessment and consolidated incident reporting.
Every NIS-2-affected customer must include you in their risk analysis. Assessments, contractual requirements and audit rights become standard. Whoever delivers evidence fast wins mandates.
§ 28 Abs. 6 Nr. 1 BSIG (section 28(6) no. 1 of the German BSIG) exempts financial entities under Article 2(2) DORA from core BSIG duties. There, financial entities are points (a) to (t); ICT third-party service providers sit in point (u). Group IT companies, spun-off security operations centres and platform providers are therefore classified under § 28 BSIG in their own right, and carry the DORA requirements on top, via the customer contract. Where the customer is a financial entity, the contractual pressure comes from Article 30 DORA, not from the NIS-2 supply chain.
Five NIS-2 minimum measures per §30, translated into MSP practice.
Risk register evaluating customer tenants separately but consolidated. Concentration risks with cloud providers, sub-suppliers and third-party software documented.
Sub-supplier inventory (e.g. cloud providers, tooling vendors, specialists), contractual requirements, concentration-risk heatmap. Customers demand this transparency in security questionnaires anyway.
MFA and just-in-time access for admin accounts in customer environments. Privileged access management as hygiene. Particularly critical in multi-tenancy.
Incident response plan with three layers: own infrastructure, individual customer tenants, sector-wide incidents with domino effect. BSI report plus customer notification with documented escalation thresholds.
BCM plans with customer SLA as input. RTO commitments must be backed by BCM tests. Restart sequence on multi-tenant incident documented.
OdySecure covers ISMS, BCM, TPRM and assessment in one solution. For MSPs, multi-tenancy and co-branding options additionally allow you to pass the platform on to customers.
Free 30-minute initial call with an indicative NIS-2 classification, top-5 gaps and a path recommendation.
Learn moreISMS, compliance and evidence from a single platform. Multi-entity, multi-country, AI-supported.
Learn moreThe platform, permanent CISO function bookable as an add-on. For organisations without an in-house CISO.
Learn moreGap assessment, roadmap, implementation via the platform. Fixed price from 4,500 euros.
Learn moreSelf-check available
Free, no signup, around 5 minutes. Detailed evaluation by email if desired.
Industry experience in IT services and MSSP structures from 25 years of ISMS practice at PwC, Deloitte and KPMG. OdySecure is built multi-tenant, with strict data isolation and co-branding options. Partner sales is a dedicated line.
No. Classification applies to the legal entity, not to the group. § 28 Abs. 6 Nr. 1 BSIG exempts financial entities under Article 2(2) DORA, which are points (a) to (t) there. DORA lists ICT third-party service providers separately in point (u). An IT company does not hold its parent’s supervisory status, so the carve-out does not reach it. Group membership does not help with the size thresholds either: § 28 Absatz 4 Satz 1 BSIG adds the figures of partner and linked enterprises. Sentence 2 drops that attribution only where you are independent of those enterprises in the design and operation of your information systems, which is a question of fact and has to be evidenced case by case.
With financial customers the contractual pressure does not come from the NIS-2 supply chain but from Article 30 DORA. Your customer has to anchor specific content in the contract: service description and locations of data processing, access and audit rights, termination and exit arrangements, rules on subcontracting, and participation in their resilience testing. They also keep a register of information on their ICT contractual arrangements, which your details feed into. That is a different axis from the supply chain clause in § 30 BSIG, and it does not replace your own NIS-2 duties.
Most likely yes. ICT service management (MSPs and MSSPs) falls under Annex I. From 50 employees, or when turnover and balance sheet total each exceed 10 million euros, you are usually an important entity. Essential entity follows from 250 employees, or annual turnover above 50 million euros and a balance sheet total above 43 million euros. The legally binding evaluation remains a matter for counsel. We provide the expert classification in the risk check.
NIS-2-affected customers must include you in their supply chain risk analysis. Expect: security questionnaires with similar depth to NIS-2 obligations, audit rights in contracts, incident reporting obligations, termination and exit clauses for critical outsourcing. Whoever delivers structured answers fast wins mandates.
Yes. OdySecure is built multi-tenant. You can resell as a partner, co-sell with Cybervize or offer it in co-branding. Strict data isolation per tenant, separate permissions, separate audit trail.
Incidents affecting multiple tenants need cross-sector assessment and parallel reporting obligations. A single cyber incident in MSP infrastructure can simultaneously trigger the BSI report under § 32 BSIG, notifications to every affected NIS-2 customer and possibly data-protection notifications. Structured incident response with documented escalation paths becomes mandatory.
NIS-2 gap assessment as a fixed price from 4,500 euros. Audit-ready readiness in 8 to 14 weeks, plus ongoing vCISO support recommended. Partner models for simultaneous customer delivery have their own pricing logic. Exact cost estimate comes from the risk check.
Free risk check with indicative NIS-2 classification, own and customer supply-chain requirements, path recommendation. Ideally with CISO or compliance plus management board present.
Book the NIS-2 risk checkIf the classification above fits your organisation, the path starts by determining where you stand, not with a project: once it is clear which obligations apply and where the gaps are, the modules that close them follow.
See the journey in five stationsMemberships, programmes and partnerships
Many companies treat NIS2 as a tick-box exercise. But compliance is not the same as resilience. The Cross-Border Cybersecurity Tour #2 in Saarbrücken made it clear: a functioning security operation outweighs any tool collection.
70% of SMEs treat NIS2 as a compliance checkbox. But organizations that see it as a strategic lever can turn regulatory requirements into operational excellence and genuine resilience.
The ten regulated sectors OdySecure runs in.
Learn moreStructured NIS-2 compliance: gap assessment, roadmap, and implementation in 12 weeks.
Learn moreFree self-check: where do you stand on the ten §30 BSIG measures? 30 questions, instant traffic light.
Learn more