NIS2 compliance for health care MSPs: what you need to know and do

Twenty of 27 EU member states had transposed the NIS2 Directive into national law by January 2026 (Wavestone, NIS2 transposition status, 2026). The remaining seven are under formal infringement proceedings from the European Commission. If you run an MSP serving health care clients in the European Union, NIS2 compliance is no longer a regulatory horizon problem. It is the operating environment.

Health care is classified as an essential sector under Annex I of Directive (EU) 2022/2555. That makes every hospital, reference laboratory, pharmaceutical manufacturer and medical device manufacturer subject to the highest tier of NIS2 obligations. The question for MSPs is not whether NIS2 matters to those clients. It does. The question is whether NIS2 creates direct obligations for the MSP itself and what controls you need to implement before your health care clients start asking.

Yes, in most cases. Either directly, indirectly, or both.

Start with your health care clients. Hospitals, EU reference laboratories, pharmaceutical manufacturers and medical device manufacturers are listed as essential entities under Annex I of NIS2. Essential entities face proactive supervision and the highest penalty ceiling: EUR 10 million or 2% of total worldwide annual turnover, whichever is higher (Directive (EU) 2022/2555, Article 34). Managed service providers are listed in Annex II of NIS2 under ICT service management as important entities in the digital infrastructure sector. Important entities face reactive supervision and a lower penalty ceiling of EUR 7 million or 1.4% of global turnover. The size cap that triggers direct designation is medium enterprise or larger: 50 or more employees, or EUR 10 million or more in annual turnover. An MSP that meets either threshold is in NIS2 scope directly, regardless of who its clients are.

Below the threshold, you are still not off the hook. Article 21(2)(d) of NIS2 requires essential entities to manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers" (Directive (EU) 2022/2555, Article 21). Your health care clients are required to push NIS2-equivalent controls down to you contractually, even if your headcount keeps you out of direct designation. In practical terms, NIS2 supply chain security requirements travel through your DPA whether you signed up for them or not.

National transposition adds a layer of variability. Germany, France, the Netherlands, Belgium, Italy and others have all enacted national laws, but they did not enact identical laws. Some member states have designated MSPs directly regardless of size threshold. Germany's NIS2UmsuCG entered into force on 6 December 2025 with no transition period and brought roughly 30,000 organizations into scope on day one. If your MSP operates across multiple EU markets, scope assessment is per-jurisdiction, not pan-EU. That is the answer to the question of NIS2 scope: it depends on where your clients are and where you serve them from.

Article 21(2) of the NIS2 Directive lists 10 minimum risk-management measures. Each one has direct operational implications for an MSP delivering services to health care clients. This is the core of the NIS2 requirements you will be audited against, either directly or through your client's supervisory authority. Acronis has published a NIS2 Healthcare MSP Compliance Checklist that walks through each measure in detail, but here is the operational summary.

Risk analysis and information system security policies. You need a documented risk assessment for your own infrastructure and for each health care client's environment you manage. Annual is the minimum cadence. Evidence must be auditable, not best-efforts.

Incident handling. Detection, triage, escalation and reporting workflows must exist before an incident occurs. Article 23 timelines (covered next) leave no room for figuring it out under pressure.

Business continuity, backup and crisis management. Backup is named explicitly in Article 21(2)(c). Health care clients running on legacy clinical systems need recovery time objectives measured in hours, not days, and you need backups that survive ransomware attempts to corrupt them.

Supply chain security. This is Article 21(2)(d) and it works both ways. Your health care clients must assess you as a direct supplier. You must assess every subprocessor that touches health care client data on your behalf. The NIS2 supply chain security requirements explicitly cover "the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures" (Directive (EU) 2022/2555, Article 21(3)).

Security in network and information systems acquisition, development, and maintenance. Vulnerability handling and disclosure are named. You need a patch management cadence and a documented vulnerability response process.

Policies and procedures to assess the effectiveness of cybersecurity risk-management measures. Translation: you have to test what you say you do. Tabletop exercises, penetration tests, and audit cycles need to be on a documented schedule.

Basic cyber hygiene practices and cybersecurity training. Article 21(2)(g) makes training a legal obligation, not a best practice. You must document that your staff have received it.

Policies and procedures regarding the use of cryptography and, where appropriate, encryption. Backup data in transit and at rest. Endpoint disk encryption. Email transport encryption. Health care clients will not accept gaps here.

Human resources security, access control policies and asset management. Onboarding, offboarding, least privilege. The administrative side that most MSPs underinvest in until it shows up in an incident report.

Multifactor authentication or continuous authentication. Required on the systems you use to manage health care client environments. RMM and PSA platforms with single-factor authentication are a NIS2 finding waiting to happen.

Article 23 of the NIS2 Directive imposes the strictest incident reporting framework in EU cybersecurity law. Three stages, three clocks, and no flexibility on the early one.

Stage one: an early warning within 24 hours of becoming aware of a significant incident. The early warning must indicate, where applicable, whether the incident is suspected of being caused by unlawful or malicious acts, and whether it could have cross-border impact (Directive (EU) 2022/2555, Article 23(4)(a)).

Stage two: an incident notification within 72 hours. This update must include an initial assessment of the incident, including its severity and impact, and where available, indicators of compromise (Directive (EU) 2022/2555, Article 23(4)(b)).

Stage three: a final report no later than one month after the incident notification. The final report must include a detailed description of the incident, the type of threat or root cause, applied mitigation measures, and cross-border impact (Directive (EU) 2022/2555, Article 23(4)(d)).

Reports go to the national Computer Security Incident Response Team (CSIRT) or the competent authority designated by the member state. For health care clients operating across borders, this can mean parallel reporting to multiple national CSIRTs.

Then GDPR enters the picture. Health care MSPs handle personal data by definition: patient records, clinical communications, appointment systems, billing data. The General Data Protection Regulation requires breach notification to the supervisory authority within 72 hours of awareness (Regulation (EU) 2016/679, Article 33). The NIS2 notification goes to the national CSIRT. The GDPR breach notification goes to the data protection authority. They are not interchangeable. They run in parallel.

For a health care MSP, one ransomware incident can trigger both clocks at the same time, with different recipients and different content requirements.

And then Article 20. Management bodies of essential and important entities must approve cybersecurity risk-management measures, oversee implementation and can be held personally liable for infringements (Directive (EU) 2022/2555, Article 20). National transposition has translated that liability into temporary prohibitions from management roles, public censure, and individual sanctions. If your MSP's leadership cannot demonstrate active engagement with NIS2 obligations, the legal exposure is personal, not just corporate.

This is the NIS2 compliance checklist that actually fits MSP operations. Seven items, ordered by the sequence most MSPs miss. For the audit-ready version with control mapping and evidence templates, download the NIS2 Healthcare MSP Compliance Checklist.

One. Scope assessment. Determine whether your MSP meets the NIS2 size threshold (50+ employees or EUR 10M+ turnover) for direct designation as an important entity. Then determine whether any of your health care clients are pushing NIS2 obligations down to you contractually under Article 21(2)(d). Most MSPs are in scope through one route, the other, or both.

Two. Data processing agreements and contract review. Health care clients will start requiring NIS2-aligned DPAs if they have not already. Your subprocessor contracts need flow-down clauses that mirror the NIS2 supply chain security requirements your clients are pushing onto you. Update both directions of your contract stack.

Three. Technical control gap analysis against Article 21(2). For each of the 10 measures, document what you have, what is partial, and what is missing. Backup and DR is usually solid. Vulnerability management, MFA on management consoles, and supply chain audit trails are where most MSPs find gaps.

Four. Incident response plan with named roles for both clocks. Who calls the national CSIRT within 24 hours under Article 23. Who calls the data protection authority within 72 hours under GDPR Article 33. Tabletop exercise the dual-notification scenario. The first time you do this should not be in a real incident.

Five. Cybersecurity awareness training, documented. Article 21(2)(g) makes training a legal requirement, not a best practice. Article 20(2) makes board-level training mandatory for management bodies. Both need attendance records, completion evidence and a cadence (annual minimum).

Six. Supply chain audit. List every subprocessor that touches health care client data on your behalf. RMM vendors, backup vendors, email security vendors and helpdesk platforms. For each one, document their security posture, contract terms, incident notification commitments, and exit plan if they fail an audit.

Seven. Documentation and evidence. NIS2 supervisory authorities will assess compliance against evidence, not assurances. Risk assessments, training records, incident reports, vendor reviews, board minutes, change logs. Build the audit-ready record from day one. Reconstructing it after a regulator asks is far harder than maintaining it.

Health care MSPs already running a credible GDPR program have a head start on NIS2. The two frameworks overlap in three meaningful places. Then NIS2 goes further in one, and that is where most MSPs underestimate the gap.

Overlap one: risk management. GDPR Article 32 requires "appropriate technical and organizational measures" matched to the risk to personal data. NIS2 Article 21 requires technical and organizational measures matched to the risk to network and information systems. Same logic, different scope. The risk assessment you already produce for GDPR is reusable as the foundation of the NIS2 assessment, with the threat model widened.

Overlap two: incident notification. GDPR Article 33 requires notification of a personal data breach to the supervisory authority within 72 hours of awareness. NIS2 Article 23 requires an early warning within 24 hours and a notification within 72 hours of becoming aware of a significant incident. The 72-hour clock is the same. The 24-hour early warning is new under NIS2. And the recipients are different: the data protection authority for GDPR; the national CSIRT or competent authority for NIS2.

Overlap three: documentation, training, vendor management. Both frameworks require documented policies, evidence of staff training, and vendor management controls. The artefacts are largely reusable across both regimes.

Where NIS2 goes further. NIS2 mandates specific technical measures that GDPR leaves to risk-based interpretation: MFA, encryption, supply chain controls, vulnerability management. NIS2 also creates personal liability for management bodies under Article 20 that GDPR does not replicate. A GDPR-compliant MSP has a partial NIS2 foundation, not a complete one. NIS2 and GDPR compliance are complementary, not interchangeable.

Meeting the 10 measures in Article 21(2) across multiple health care tenants from separate point tools is operationally unworkable. The MSPs that scale health care books under NIS2 are running unified platforms: backup, EDR/XDR, vulnerability management and access controls on a single agent, in a single multitenant console, with audit-ready documentation that maps to each Article 21(2) sub-measure. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) is built on that model. Here is how it maps to NIS2 directly.

Article 21(2)(c), business continuity and backup. Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) consolidates backup, disaster recovery and malware-free recovery in a single agent. The integration matters because the NIS2 audit question is not "do you have backups." It is "can you recover from a clean point fast enough to maintain continuity." Integrated recovery removes the gap between incident containment and restore.

Article 21(2)(b), incident handling. EDR and XDR run from the same agent as backup. When a health care endpoint is compromised, the MSP can contain at the endpoint and roll back to a clean restore point from the same console. Mean time to recovery drops; documentation for the 24-hour Article 23 early warning is generated automatically.

Article 21(2)(e) and (f), vulnerability handling and effectiveness assessment. The platform includes vulnerability assessment and patch management across managed endpoints. Health care clients carrying legacy clinical OS exposures need this surfaced at the MSP level, not waiting for the client to discover the problem.

Article 21(2)(h), cryptography. Backup data is encrypted in transit and at rest. Endpoint disk encryption is managed from the console. Encryption coverage is one of the easier gaps for a regulator to find on an MSP audit, and one of the easier to close with the right platform.

Article 21(2)(j), MFA. The Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud) management console enforces MFA at the MSP and tenant administrator level. For DLP (an add-on tier), MSPs serving health care clients with outbound data movement requirements get policy controls that document Article 21(2)(i) access enforcement.

Supply chain audit trail. The multitenant console provides per-client visibility, policy documentation, and an audit-ready record of which security measures are applied to which health care tenant. When a health care client's supervisory authority asks for evidence of supply chain security under Article 21(2)(d), the MSP can produce it without manually reconstructing from logs.

And pricing that fits the EU operating reality. PAYG per-workload licensing means MSPs scaling across Germany, France, Italy, the Netherlands and other member states can add health care clients without locking into long-term minimum-commitment SKUs that fit a Datto or Kaseya enterprise model but not a growing health care MSP book. The cost of NIS2 compliance tools should scale with actual delivery, not be paid up front.

Health has been the most-affected sector reported through ENISA's Cybersecurity Incident Reporting and Analysis System for four years in a row, from 2020 to 2023 (ENISA, Cybersecurity of Critical Sectors: Health, 2025). Of health-sector incidents analyzed in the ENISA Threat Landscape 2024, 45% were ransomware and 28% were data breaches. That is the threat profile NIS2 is responding to. It is also the threat profile your health care clients are operating under right now.

Ransomware against an essential entity triggers everything at once. Article 23 reporting starts. GDPR Article 33 starts if personal data is involved (it will be). Article 20 management liability is on the table if the entity cannot demonstrate it had the required risk-management measures in place. And the MSP that manages the affected environment is in the breach forensics report under Article 21(2)(d). That is why NIS2 compliance is not a paperwork exercise. It is the operating condition for staying in the health care MSP market.

Yes, in most cases. MSPs are listed in Annex II of NIS2 as important entities under ICT service management. An MSP with 50 or more employees, or EUR 10 million or more in annual turnover, is in direct NIS2 scope regardless of client base. MSPs below that threshold are still pulled into scope indirectly through Article 21(2)(d), which requires their essential-entity clients (including health care organizations) to push NIS2-equivalent controls down the supply chain contractually.

Article 23 of NIS2 requires three stages: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours including an initial impact assessment, and a final report within one month of the incident notification. Reports go to the national CSIRT or competent authority designated by each member state.

Essential entities are listed in Annex I of NIS2 and include sectors such as health, energy, transport, and digital infrastructure. They face proactive supervision and maximum administrative fines of EUR 10 million or 2% of total worldwide annual turnover. Important entities are listed in Annex II and include sectors such as managed services and postal services. They face reactive supervision and maximum fines of EUR 7 million or 1.4% of global turnover.

Yes. Health care is classified as an essential sector under Annex I of NIS2. Hospitals, EU reference laboratories, pharmaceutical manufacturers and medical device manufacturers are all in scope. As essential entities, health care organizations face the highest tier of obligations and the highest penalty ceiling, and they are required to manage supply chain security under Article 21(2)(d), which extends compliance pressure to the MSPs that serve them.

Important entities face maximum fines of at least EUR 7 million or 1.4% of global turnover. Article 20 adds personal liability for management bodies, including potential temporary prohibitions from management roles.

NIS2 and GDPR overlap on risk management, breach notification timelines, and documentation requirements, but they are not interchangeable. GDPR Article 33 requires a 72-hour breach notification to the data protection authority. NIS2 Article 23 requires a 24-hour early warning and 72-hour notification to the national CSIRT. NIS2 also mandates specific technical measures (MFA, supply chain controls) and creates personal management liability under Article 20 that GDPR does not replicate.

Article 21(2)(d) of the NIS2 Directive requires essential and important entities to manage "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers." Article 21(3) adds that entities must take into account vulnerabilities specific to each direct supplier and the overall quality of their cybersecurity practices and secure development procedures.

The NIS2 transposition deadline was 17 October 2024. As of January 2026, 20 of 27 EU member states had completed transposition. The remaining seven are under formal infringement proceedings from the European Commission. National laws differ in detail, so MSPs operating across multiple EU markets must verify scope and obligations per jurisdiction.

NIS2 creates direct and indirect obligations for MSPs serving EU health care clients. The margin for under-preparation is smaller than it looks: personal management liability under Article 20, dual-framework reporting that runs the NIS2 and GDPR clocks in parallel and supply chain controls that flow down from your essential-entity clients whether your headcount triggers direct designation or not. The MSPs that build for NIS2 operationally, with control mapping, audit-ready documentation and tested incident playbooks, will keep the health care client relationships that non-compliant competitors will lose.

The MSPs that treat it as a contractual checkbox will not.

Download the NIS2 Healthcare MSP Compliance Checklist to get the full control mapping and gap-analysis template.