Home / Cybersecurity / NIS2 in Netherlands / Managed IT services (MSP / MSSP)

NIS2 for managed service providers in the Netherlands

Managed IT services (MSP / MSSP) is listed in Annex I of the NIS2 directive. Large companies are essential entities; medium companies are important entities. In Netherlands, the rules come from the Cyberbeveiligingswet (Cbw — Cybersecurity Act), applicable since 15 August 2026; the authority is the National Cyber Security Centre (NCSC) runs the register; supervision by the Rijksinspectie Digitale Infrastructuur (RDI) and the sector supervisors.

→ Talk to a cybersecurity advisor

Who is covered in this sector

• Managed service providers (MSP) delivering IT services to businesses
• Managed security service providers (MSSP)

Freelancers and micro-companies are below the size threshold, but their customers will still ask them for proof of security.

The threats we see most in managed it services (msp / mssp)

• Compromise of the remote-management tool, giving access to every client at once
• Stolen technician credentials
• Supply-chain attacks through software updates
• Ransomware spreading from one client to others

Five priority measures

1. 01 Hardened RMM platform with MFA, IP restrictions and full logging
2. 02 Separate admin accounts per client, no shared credentials
3. 03 Written incident-notification commitments towards clients
4. 04 Evidence pack for client questionnaires (policies, certificates, test reports)
5. 05 Register in the country of your head office (NIS2 rule for MSPs)

What Netherlands requires

• The Act entered into force on 15 August 2026, together with the Critical Entities Resilience Act (Wwke).
• Registration in the national register (Mijn.NCSC.nl) is mandatory since 15 August 2026: name, address, sector, EU countries served, contact details and, where relevant, IP ranges.
• Cloud, data-centre, DNS and managed-service providers register where their head office is; other entities register in every EU country where they operate.
• The duty of care (risk management) and the duty to report significant incidents apply from the same date.
• Non-compliance can lead to fines and to orders subject to a penalty payment (last onder dwangsom).

Significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month. Fines set by the directive: up to €10 million or 2% of worldwide turnover for essential entities, and up to €7 million or 1.4% for important entities (whichever is higher).

Tools and guides

Managed IT services (MSP / MSSP) in other countries

Other sectors in Netherlands

Frequently asked questions

Is my managed service provider company in scope of NIS2 in Netherlands?

Managed IT services (MSP / MSSP) is an Annex I sector. Large companies are essential entities; medium companies are important entities. Small companies are generally out of scope unless designated. Our NIS2 check gives you the answer in two minutes.

What should we do first?

Register if you are in scope, name an owner, run a short risk assessment, and fix the basics: MFA, tested backups, patching, incident routine.

We are a supplier to this sector. Does it affect us?

Yes, indirectly: your customers must secure their supply chain and will ask you for evidence. See our supplier questionnaire guide.

Sources

• NCSC — Cyberbeveiligingswet (NIS2)
• RDI — Registration duty
• Rijksoverheid — in force from 15 August 2026

Last checked: 28 September 2026. This page is general information, not legal advice.