Certified MSSP faces a supervisory request
A Belgian managed security service provider with 320 employees and €58 million turnover monitors networks for 140 customers, including hospitals and banks. It is an essential entity under the ICT service management business-to-business sector. The company holds ISO/IEC 27001 certification and a national cybersecurity certificate issued under a voluntary scheme. In April, its national NIS authority requests its risk-management documentation, evidence of management-body approval, and logs of a recent outage that affected 12 customers for five hours. The CEO replies that the company is certified, so it is deemed compliant and the authority should close the file. The authority insists. The company also wants to use its ISO 27001 certificate in customer contracts as proof of NIS 2 conformity.
1. Is the MSSP's certification sufficient to avoid supervision or establish deemed compliance with NIS 2?
Read the worked answer
No. Certification does not remove the entity from NIS 2 supervision or create automatic deemed compliance. ISO/IEC 27001 is a generic information security management system certificate; its scope may not cover every Art 21 measure, every service, or the specific outage. A national voluntary certificate may be relevant evidence, but it is not a blanket exemption. The authority can still request documents, examine management-body oversight, and investigate the outage. Refusing to cooperate because of certification is likely to be treated as non-cooperation and can lead to enforcement. The MSSP should treat certificates as supporting evidence, not as a substitute for demonstrating the legal duties.
2. What is the role of European cybersecurity certification under NIS 2, and how should the MSSP use certificates in customer contracts?
Read the worked answer
NIS 2 encourages the use of European cybersecurity certification schemes and allows Member States or the Commission to require certification in specified cases. Certification can help demonstrate that products, services or processes meet defined security requirements, and supervisory authorities may consider it as evidence. It does not automatically prove conformity with all NIS 2 obligations, especially governance, incident reporting and supply-chain duties. In customer contracts, the MSSP should say that the certificate supports its security programme and identify its scope, rather than claim 'NIS 2 certified' or 'deemed compliant'. It should map the certificate controls to the Art 21 measures and disclose any gaps, such as incident notification or management-body approval.
3. How should the MSSP respond to the authority's request, and what are the risks of refusal?
Read the worked answer
The MSSP should acknowledge the request, ask for any clarification on format or deadline, and provide the risk-management documentation, evidence of management-body approval, and outage logs in a secure manner, redacting only what is genuinely necessary. It should explain the scope of its certificates and provide a gap assessment against Art 21. If the outage was significant, it should also confirm whether it met its 24-hour, 72-hour and one-month reporting duties. Refusal risks supervisory measures, audits, fines and, for an essential entity, fines of at least €10 million or 2% of worldwide turnover, whichever is higher, depending on national law. It also damages customer trust. Cooperation and remediation are the better response.