IT Partner? See how to deliver NIS2 audit-readiness

View partner offer →
← Free tools

FREE TOOL

Is your own MSP NIS2-ready, not just your clients?

Managed service providers and managed security service providers are themselves named under the Belgian NIS2 law, in the ICT service management group of Annex I. This 14-question self-check looks at your own privileged access, RMM hardening, MFA, logging, suppliers, incident reporting and staff training, and gives a score with what to fix first.

  1. 1. Is multi-factor authentication (MFA) enforced for every remote connection into a client environment (RMM console, VPN, remote desktop)?
  2. 2. Do your technicians do day-to-day work without standing administrator rights, using a separate admin account only when admin work is needed?
  3. 3. Is each technician’s access to client systems limited to the clients and systems their work actually needs, reviewed on a schedule?
  4. 4. When a technician leaves or changes role, is their access to every client environment revoked the same day?
  5. 5. Is your own RMM/remote-management platform itself hardened: a firewall, no open management ports to the internet, and alerts on new or changed admin accounts?
  6. 6. Is up-to-date anti-malware running on every machine that can reach client environments, including technicians’ own laptops?
  7. 7. Do you keep logs of who on your team accessed which client system and when, backed up and reviewed on a schedule?
  8. 8. Do you risk-assess your own suppliers (RMM vendor, backup vendor, cloud host) at least once a year?
  9. 9. Do your own supplier and subcontractor contracts set out security requirements, not just a service-level agreement?
  10. 10. If a subcontractor with access to client systems changes or loses staff, are you notified so their access can be updated?
  11. 11. Does your incident response plan explicitly cover an incident that starts inside YOUR systems and could spread to clients (a compromised RMM, a stolen technician credential)?
  12. 12. Do your contracts say when and how you must tell a client about a security incident that touches their environment?
  13. 13. Does your own team get regular security awareness training, the same as you recommend clients give theirs?
  14. 14. If your own PSA, RMM or documentation platform went down for a day, could you still support clients and would you recover without losing their data?

0 of 14 answered

Answer the 14 questions left to see your score.
By · Founder, Easy Cyber Protection · · How we write this

Why is an MSP itself in NIS2 scope?

The Belgian NIS2 law of 26 April 2024 puts a company in scope when it provides a service listed in Annex I or II and clears a size threshold [1][2]. The CCB’s own NIS2 Scope Assessment workbook lists "Managed service providers" and "Managed security service providers" under row 47-48, grouped into "ICT service management (business-to-business)", which the CCB explicitly folds into the Digital Infrastructure category (I.8) for scoring purposes [1].

That means an MSP with 50+ staff, or over €10M turnover and balance sheet (counting the group), is very likely in scope in its own right, before any client conversation starts. Below that threshold, an MSP may still be out of direct scope but still face supplier due diligence from clients who are themselves in scope.

This check does not replace the full NIS2 scope test. Use the NIS2 scope check for a size-and-sector verdict on your own entity; use this check for the security questions an MSP specifically gets judged on, because it holds privileged access into many other companies at once.

See also the NIS2 scope check and the who must comply with NIS2 page.

What does a result look like?

An MSP with MFA enforced on client RMM access, least-privilege technician accounts and a written incident plan, but no yearly supplier risk review and no logged access trail, scores around 70%. That is a "good start" band with two or three concrete fixes, each mapped to CyFun control ids a client or auditor would ask to see evidence for.

A smaller shop still using one shared admin login across the team for every client would score much lower. The fix list would open with the two highest-impact items: MFA on remote access and removing standing admin rights from day-to-day accounts.

Want to know what NIS2/CyFun as a service earns you? Try the MSP revenue calculator.

No yearly supplier review in place? The free Supplier Security Questionnaire is ready to send.

Frequently asked questions

Is a managed service provider itself in scope for NIS2?
It can be. MSPs and MSSPs are a named sector in Annex I (ICT service management, folded into Digital Infrastructure by the CCB). So an MSP that clears the size threshold is an NIS2 entity in its own right, independent of what sector its clients are in [1][2].
Is this the same as the NIS2 scope check?
No. The scope check decides whether an entity is essential, important or out of scope by sector and size. This tool assumes an MSP context and checks the specific security controls an MSP is judged on because of its privileged access into client systems.
Does a low score mean my MSP is breaking the law?
Not by itself. This is a self-check on your own answers, not a conformity assessment. A low score flags gaps worth fixing and documenting before a client, insurer or auditor asks for proof.
Why does privileged access get so much weight?
An MSP that is compromised can become the single path into every client it manages. Several real supply-chain incidents have followed exactly this scenario. MFA on remote access and least privilege for technicians are consistently the highest-impact fixes.
What do the CyFun control ids next to each answer mean?
Each question maps to one or more CyberFundamentals (CyFun) controls (packages/api/src/frameworks/cyfun/controls.yaml in ECP’s own framework data). They are shown so you can go straight to the matching control if you later work through a formal CyFun self-assessment.

Related free tools

Who must comply with NIS2 · NIS2 scope check · For IT partners and MSPs

Use this with your clients

#CYBERLEARN

Train the team: MSP owner

See the course →

Sources

  1. CCB, NIS2 Scope Assessment workbook v1.0.4 (rows 47-48, ICT service management)
  2. Belgian NIS2 law of 26 April 2024 (Annex I)