NIS2 for IT Service Providers and MSPs

For MSPs and MSSPs, the Commission Implementing Regulation takes precedence under §30(3) BSIG. Its annex specifies the ten measures from §30(2) BSIG with technical and methodological requirements, for example on privileged accounts and administration systems, network segmentation, patch management and an independent review of your own security. Where the annex requires something only "where appropriate" and you do not apply it, you document your reasoning comprehensibly (Art. 2(2)).

You are affected from two directions. Towards your own vendors, the regulation requires a supply chain security policy, selection criteria and an up-to-date directory of direct suppliers and service providers (Annex points 5.1 and 5.2). Contracts should, where appropriate, cover among other things security requirements, incident notification by the service provider and a right to audit or to receive audit reports (point 5.1.4). The same points show what NIS2-obliged customers can expect from you contractually as their supplier.

You report significant incidents to the joint reporting office of BSI and BBK: early warning within 24 hours, notification within 72 hours, final report after one month. For MSPs, Art. 10 of the Implementing Regulation defines when an incident is significant, among other things: the managed service is completely unavailable for more than 30 minutes, or data related to the service is compromised by a suspectedly malicious action. The general criteria of Art. 3 also apply, such as direct financial loss above €500,000 or 5% of annual turnover, whichever is lower.

Entities in the ICT service management sector communicate without undue delay to customers potentially affected by a significant cyber threat, and to the BSI, the measures or remedies they can take, and inform them about the threat itself, where the customers' interests prevail (§35(2)). In addition, the BSI can order you to inform the recipients of your services about a significant incident (§35(1)).

MSPs register with the BSI like all entities and additionally submit information under §34 BSIG, including their main establishment in the EU, the member states where they provide services and their public IP address ranges. The BSI is only competent if your main EU establishment is in Germany, but then for the entire EU (§60 BSIG).

Management must implement the measures, monitor their implementation and attend training regularly. For MSPs this concerns in particular decisions on remote maintenance access, administration accounts and their own suppliers.