Industry
Managed service and cloud providers are named entity types under NIS2, and the ICT providers DORA-regulated clients must control by contract.
NIS2 lists cloud computing service providers, managed service providers and managed security service providers in Annex I. Whether a given provider is in scope depends on its size and the Member State law that applies. Financial-sector clients add DORA contract terms; US buyers often ask for SOC 2 as well.
Sector risks
Remote management tooling with standing administrator rights into many customers is the single largest risk an MSP carries - and the first thing a buyer asks about.
Controls that each side assumes the other operates: backups, patching, logging retention. They surface during an incident, or an audit.
A DORA bank, a NIS2 essential entity and a US SaaS client may each impose different notification windows and audit rights on the same service.
Evidence
Services
Delivery
Remote. Evidence comes from RMM, PSA, identity and cloud platforms; a site visit is only needed where you operate your own data-centre space.
Last verified 16 October 2026 against European Commission - NIS2 and EUR-Lex - Directive (EU) 2022/2555.
Last verified 16 October 2026 against EUR-Lex - Regulation (EU) 2022/2554 and European Commission - Digital operational resilience.
Not ready for a full review?
Start with a fixed-scope Mini Gap Review.
Scoped and priced on a short call. We hand back your top Stage 1 blockers and the single next step that matters most.
From the blog
SaaS is a recognised cloud service model - Recital 33 says so outright. But whether your specific product meets the operative Article 6(30) test is genuinely unsettled, and national regulators openly disagree on identical facts. Here is how to reason about it.
Read →vCISO & Security GovernanceA practical test for choosing between a vCISO and a Managed ISMS: what each produces, the decisions each one supports, and the signs you have outgrown one.
Read →Risk, Evidence & Supplier AssuranceBuild a reusable security answer library that speeds up every RFP
Read →Self-check
Nine yes-no questions on where information security management usually holds up - or falls apart - in msps & cloud providers.
Name the standard, the sites and the deadline. A specialist replies within one business day with a view on scope and whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.