The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For managed service providersand MSSPs, all of the EU

Your rules, and your clients' rules. One system for both.

NIS2 names managed service providers in Annex I, and clients under NIS2 and DORA pass their security terms on to you.

Start your compliance system Check if NIS2 applies to you
Example data

The rules that reach you

What reaches an MSP, and from when

One law names you, one reaches you through your bank clients, one your clients ask for, and one comes with their data.

NIS2

Directive (EU) 2022/2555 · EU cybersecurity law

Medium-sized and up

Annex I point 9, ICT service management (business-to-business), names managed service providers and managed security service providers.

50+ staffor over €10M in both turnover and balance sheetArt 2(1)
Risk measuresSpelled out for MSPs in Implementing Regulation 2024/2690Art 21
24 h · 72 hEarly warning, then the incident notificationArt 23
One stateThe authority where your main establishment isArt 26
RegistrationYour details go to your authority for ENISA's registryArt 27
Annex I, 9Applies since Register by Each member state applies NIS2 through its own law, and transposition varies. State by state

DORA

Regulation (EU) 2022/2554

If clients are financial

If your clients are banks, insurers or investment firms, Articles 28 to 30 govern how they contract with you as their ICT provider.

Art 28 to 30Since

ISO 27001

ISO/IEC 27001:2022 · a standard

Not a law

Clients and tenders ask for the certificate, and its controls map onto the measures NIS2 Article 21 asks for.

Annex A, 93 controlsYour clients set the date

GDPR

Regulation (EU) 2016/679

Applies

As a processor of your clients' personal data, you work under an Article 28 contract with each of them.

Art 28Since

In numbers

Asked for by tenders, passed on by clients

1,285

EU tender notices for IT services mentioned ISO 27001 in the year to 10 October 2026.

Source: TED, the EU's tender journal, main classification CPV 72, read 11 October 2026

24 of27

member states have communicated an act transposing NIS2 to the Commission.

Source: EUR-Lex, national transposition measures, read 23 October 2026

18

NIS2 sectors whose entities must manage the security of each direct supplier.

Source: Directive (EU) 2022/2555, Annexes I and II, Article 21(2)(d)

What StandardOS does for an MSP

Your own file first, then the answers your clients want

Every tile is a screen in the product today.

Your ISMS and NIS2 file

ISO 27001 and NIS2 on one record, with the policies drafted for you to approve.

Questionnaires answered from your records

Paste a client's questions and each answer is drafted from your controls and evidence, with its source.

Evidence from your own stack

12 read-only integrations, Microsoft Entra ID and Intune among them, read on a schedule.

DORA answers for financial clients

DORA's rows for an ICT provider, the Article 30 terms and the register fields, tracked like any framework.

Trust center, then the audit

Show clients where you stand, and find an accredited auditor when you want the certificate.

For MSPs who serve regulated clients

Resell it to your clients

Each client gets its own organization, kept apart by the database, and you switch between them in the sidebar.

30%margin when you resell
20%of every payment for 12 months when you refer
Partner programme
Example data

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 4 on this page, and 23 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Or one file, once: NIS2 Registration Pack, €199See the pack

Done for you: NIS2 registration, done in a week, €490See the offer

Questions

What MSPs ask first

Short answers, each with the article it rests on.

Is an MSP with 30 staff in scope of NIS2?

Not by size, unless both your turnover and balance sheet exceed €10M. A member state can still name you, and clients in scope pass their supply-chain terms to you by contract.

Art 2(1)Art 2(2)Art 21(2)(d)
Do we need ISO 27001 for NIS2?

No. NIS2 asks for measures, not a certificate. ISO 27001's controls map onto the Article 21 measures, and we publish the map between them.

Art 21IR 2024/2690
Are we an essential or an important entity?

A large MSP, with 250 staff or more, or over €50M turnover and €43M balance sheet, is essential; a medium-sized one is important. Supervision and the fine ceilings differ.

Art 3Art 32 to 34
Which member state supervises us?

The state of your main establishment in the Union, usually where your cybersecurity decisions are taken, wherever your clients are.

Art 26(1)(b)Art 26(2)
A bank client sent a DORA questionnaire. Are we under DORA?

Not directly. DORA binds the bank, and Article 30 sets what its contract with you must contain; only providers designated as critical are overseen themselves.

DORA Art 30DORA Art 31

Start with your own file. Add clients when ready.

7 days free, no card and no sales call.

Start your compliance system Check if NIS2 applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk