Managed ICT service providers occupy a distinctive risk position: they hold privileged, permanent, remote access into their customers infrastructure. A single attacker who compromises such a provider reaches, through legitimate administration tooling, tens or hundreds of organisations at once, including essential entities in other sectors. Supply chain attacks have become a preferred route of entry precisely because they bypass the perimeter of each individual victim.
Directive (EU) 2022/2555 (NIS 2) lists ICT service management, in the business to business relationship, in Annex I, among the sectors of high criticality. Providers have security obligations of their own, but they are also the object of requirements their customers must impose contractually: supply chain security is one of the minimum measures the directive sets out explicitly.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The ICT service management sector
Essential entities:
Managed service providers and managed security service providers, in the business to business relationship.
- Managed service providers administering customer IT infrastructure
- Managed security service providers operating monitoring and response services
- Providers of remote administration, backup and patch management services
- Providers of identity and access management services
Sector-specific cyber threats
- Compromise of remote management tooling with access to many customers
- Abuse of privileged accounts held for customer administration
- Malicious updates distributed through the provider deployment channels
- Theft of customer credentials and configuration data
- Lateral movement from the provider network into customer environments
- Insufficient tenant separation between customers
NIS 2 requirements for the ict service management sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Direct exposure of essential entities in other sectors through a single provider
- Concentration risk when many customers rely on the same tooling
- Contractual chains where a subcontractor inherits the same level of access
- Dependency of incident detection on the provider own monitoring quality
For managed service providers, security is a service attribute rather than an internal cost. NIS 2 requires them to demonstrate it, and requires their customers to verify it, because in this sector one compromise is never limited to one organisation.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.