Digital service companies (DSC) · NIS2

IT Services Companies & NIS2: the critical link in the supply chain

The NIS2 directive explicitly targets managed service providers and ICT service management (B2B). An IT services company exceeding the size threshold is primarily concerned, both for its own security and because it constitutes a critical link in its clients' supply chain. This guide clarifies qualification criteria, the measures under Article 21, the notification regime, and management liability.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: NIS2.
  • Any IT services company providing managed services, managed IT services, or ICT service management, above the size threshold, is concerned.
  • Managing risks (Article 21).
  • Securing the supply chain.
  • Notify incidents.
  • For important entities, up to €7M or 1.4% of global turnover (€10M or 2% for essential entities), with potential personal liability for senior management.

Regulatory deadlines

The key dates of this regulation.

January 2023

Entry into force (EU directive)

In force

October 2024

Transposition deadline (EU)

In force

2026

French transposition (Resilience Act)

In force

What does NIS2 cover?

NIS2 classifies organisations into essential and important entities based on their sector (Annexes I and II) and size. ICT service management (B2B) and managed service providers are among the sectors covered.

An IT services company may qualify as an important entity or, depending on its criticality, as an essential entity, subject to more stringent oversight.

Is the 'Digital Service Companies (DSC)' sector concerned?

Any IT services company providing managed services, managed operations or ICT service management, beyond the size threshold, is concerned. Some, deemed critical, may be subject to it regardless of their size.

Below the threshold, the IT service provider remains indirectly affected: its clients subject to NIS2 must secure their supply chain and pass their requirements down by contract.

Detailed obligations

Manage risks (Article 21)

Deploy technical and organisational measures: security policy, incident management, continuity, encryption, access control, multi-factor authentication.

Secure the supply chain.

Assess and govern its own suppliers and components, and provide its clients with the expected assurances regarding its own security.

Notify incidents

Submit an early warning after becoming aware of a significant incident, followed by intermediate and final reports within the required timeframes.

Ensure continuity

Have a business continuity and recovery plan, tested backups and a crisis management organisation in place.

Involve management

Have the scheme approved and monitored by the governing body, which is now accountable and trained on the risks.

Sanctions & risks

For important entities, up to €7M or 1.4% of global turnover (€10M or 2% for essential entities), with potential personal liability for senior management.

The commercial risk is significant: a compliance failure can disqualify the IT service provider from the tenders of its regulated clients, who must secure their supply chain.

Application timeline

  • 1Directive. Adopted end of 2022.
  • 2France. Transposition currently being finalised; anticipate measures without waiting.

Common mistakes in the sector

  • 1"Too small for NIS2". Ignoring the threshold, reached at 50 employees or €10M.
  • 2Customer safeguards absent. Being unable to demonstrate its own security to customers subject to NIS2.
  • 3Uncontrolled supply chain. Neglecting the security of its own subcontractors and components.
  • 4Absent leadership. Leaving cybersecurity solely to the technical team.

Practical case

An IT services company of 120 employees manages outsourced IT for several local authorities and hospitals. As a managed service provider exceeding the threshold, it falls under NIS2 and, as a link in the chain of essential clients, must provide strong guarantees. It rolls out MFA across the board, formalises its incident response plan, controls its subcontractors, and has the framework validated by its management.

Compliance roadmap

  1. 1

    Qualify. Determining status (important, essential, out of scope).

  2. 2

    Analyse. Carry out a risk analysis and gap assessment with regard to Article 21.

  3. 3

    Deploy. Implement missing measures and an incident response plan.

  4. 4

    Secure suppliers. Map and govern its own supply chain.

  5. 5

    Equip the notification process. Implement the alert and reporting process.

Frequently asked questions

Most often important, but it may be essential depending on its criticality and its role in the supply chain of essential sectors.

Back to the Digital service companies (DSC) guideDigital service companies (DSC) & GDPR Digital service companies (DSC) & AI Act Digital service companies (DSC) & DORA

Take action on NIS2

Free assessment or a chat with an expert dedicated to digital service companies (dsc).

Start my free assessment Talk to an expert

They already trust us

See how organisations in the digital service companies (dsc) sector secured their compliance with DCO.

See testimonials