Does DORA exempt your bank from NIS2? See the Article 2(3) exclusion list and the 6 NIS2 obligations that survive lex specialis for all financial entities.
NIS2 Art.23 notification belongs to the client, not the MSSP. Here’s the cascade, clock trigger, and SLA clause your contract must include under Article 21(2)(d).
ENISA: ransomware accounts for 54% of health sector cyber threats. What NIS2 Article 21 requires from hospitals, clinics, and medical device manufacturers.
NIS2 transport compliance: which entities in aviation, rail, maritime, and road owe what under Article 21(2) — mode-by-mode gap analysis against Part-IS, IMO MSC-FAL.1, and the CER Directive.
NIS2 compliance guide for all five energy subsectors — scope decisions, Article 21 controls for OT environments, the 24h-72h-30d incident chain, NCCS overlay for electricity, and Article 34 penalty exposure.
Your SOC is also your own CIR §6.9 compliance control — and your clients can audit you under Art.21(2)(d). Map the dual MSSP NIS2 obligation under Annex I Sector 9.
Your cloud provider routes traffic through sub-processors you’ve never audited. CIR Annex 5 requires contractual flow-down — here’s exactly what to verify and document.
Your RMM agent has full endpoint access across every client environment — and NIS2 Article 21(2)(d) requires a written assessment for it. Map your MSP toolchain risk in five steps.
Annex II excludes universities from NIS2’s research sector definition — which legal track applies to your R&D lab or university, and what obligations follow?
ICT service management (B2B) sits in NIS2 Annex I — not Annex II. If your MSP meets the size threshold, you are directly regulated. Here is what Article 21, CIR 2024/2690, and the five-clause contract your clients will require actually demand from you.
