What to outsource for NIS2 and what to keep in-house

If a customer, contract or supervisor now expects NIS2 measures, the split is clear on the governance side: the management body must keep approval, oversight, risk acceptance, training and liability for the entity's Article 21 measures. Under Article 20(1), management bodies approve the cybersecurity risk-management measures and oversee their implementation, and they can be held liable for infringements. Under Article 20(2), members of the management body must follow training that lets them identify risks and assess the practices and their impact on services. Those duties cannot be handed to a provider. Monitoring, testing, backups and the delivery of staff training can be outsourced, and Article 21(2)(d) makes the supply chain part of the entity's own obligations, so each provider is a dependency the entity must manage.

The organization owns its controls. An implementation partner or service provider can configure systems, prepare procedures and assemble evidence, but the entity decides what is accepted, who is accountable and whether the measure works in its own environment. Keep a written record of which duties sit with management, which with internal staff and which with each provider, and confirm in the contract who produces the logs, test results and training records that a supervisor would ask for. Ask each provider what it hands over at exit, because Implementing Regulation (EU) 2024/2690 expects contracts to cover exit obligations and audit rights.

NIS2 creates no certificate of compliance. National competent authorities supervise through inspections, security audits, security scans and information requests, and independent reviewers assess the result when the entity commissions one. Reviews must be carried out by people with audit competence outside the line of authority of the area reviewed, or under alternative impartiality measures where size does not allow this. Do not let the team that runs a measure also certify that it works. Confirm with your national authority which evidence it expects, and treat any firm that offers a NIS2 certificate as a claim to question.

Which NIS2 duties management cannot hand to a provider

Providers can build, test and document the Article 21 measures, but the management body must approve them, oversee them and carry the accountability. Each card below names one duty that stays with management and the evidence that shows it was done, so the split with outside help is clear before any contract is signed.

Approving the Article 21 measures

Article 20(1) requires the management body to approve the cybersecurity risk-management measures the entity takes under Article 21. A provider can draft the policies and the measure set, but the approval has to come from the people who answer for the entity. Evidence is a board or management minutes entry that names the measures approved, the version approved and the date. Check that the approval covers the current measure set, not an earlier draft that a provider handed over.

Overseeing measure implementation

Approval is not enough. The management body must oversee how the measures are implemented, which means receiving regular reports on open gaps, incidents, test results and supplier issues. A provider can produce those reports, but management has to ask for them, review them and decide what happens next. Evidence is a recurring agenda item, the reports presented and the minutes recording questions asked and actions assigned.

Completing the Article 20(2) training

Members of the management body must follow training that gives them enough knowledge to identify cybersecurity risks and judge the risk-management practices and their effect on the entity's services. A provider can deliver the course, but the training must reach each board member, not only the security team. Evidence is attendance records, course content and completion dates for each member, kept with the governance file. Confirm with your national authority whether the course content must meet any specific expectations.

Accepting residual risk

Some risks will remain after controls are applied. A provider can rate them and recommend treatment options, but accepting a residual risk is a management decision with a named owner. Evidence is a signed risk acceptance record stating the risk, the owner, the reason for accepting it, the review date and the approver. Check that acceptances are reviewed when the threat picture or the provider changes, not left to expire silently.

Personal liability for Article 21 infringements

Article 20(1) provides that management bodies can be held liable for the entity's infringements of Article 21, without prejudice to national liability rules for public institutions and officials. Outsourcing does not move this liability to the provider. Evidence that supports a defense is the full record of approvals, oversight reports, training and risk decisions. Ask counsel how your Member State's transposition law sets out the liability and any personal exposure for board members.

Deciding Article 23 incident reporting

Management owns the decisions on whether and how the entity reports a significant incident under Article 23, including the early warning, notification and final report. A provider's monitoring team may detect the incident and draft the reports, but the entity must decide, sign off and send them on time. Evidence is the incident record showing who decided, when, and on what basis, with the submitted reports. Confirm with your national competent authority, and your transposition law, who is the legal filer and whether a provider may submit on the entity's behalf.

Who does what in a NIS2 program

The management body must approve the cybersecurity risk-management measures taken under Article 21 and oversee how they are implemented. Under Article 20(1), members can be held liable for the entity's infringements of Article 21, and under Article 20(2) they must complete training that lets them assess risks and the effect of security practices on the entity's services. Approval and oversight cannot be handed to a provider, although a vCISO or consultant can prepare the material the board reviews.

Approval: Board minutes should record approval of the risk-management measures, the risk assessment basis and any risk acceptance decisions.
Oversight: Regular reporting on open risks, incidents, audit findings and supplier issues, with decisions recorded.
Training: Members complete and document governance training that covers the entity's risk profile and services.
Resourcing: Budget and staffing decisions for the measures stay with the board.
Not outsourced: Accountability for approval, oversight and liability.

Confirm with counsel how liability rules apply under your national transposition law, since they vary by Member State.

Which measures to outsource and which to keep in-house

This table compares eight NIS2 measures across who owns the decision, what a provider can run, what the entity must keep, and when outsourcing fits. Read it as a starting split, then confirm each row against your own risk assessment, since testing frequency follows that assessment and the testing policy is reviewed at planned intervals under points 6.5.2(a) and 6.5.3 of Implementing Regulation (EU) 2024/2690.

Measure	Who owns the decision	What can be outsourced	What must stay with the entity	When outsourcing fits
Security monitoring	Entity management and security lead	Log collection, alert triage and 24-hour monitoring by a managed SOC	Alarm thresholds, escalation rules, and the decision to report an incident	When internal staff cannot cover monitoring hours or the entity lacks detection skills
Vulnerability and penetration testing	Entity, based on the risk assessment	Scanning, penetration tests and retesting by an external tester	Testing scope, testing policy, remediation priorities and risk acceptance	When independent testing skills are needed or the entity lacks capacity to test
Backups and recovery testing	Entity operations and business continuity owner	Backup operation, offsite storage and restore exercises run by a provider	Recovery objectives, backup scope, and proof that restores work	When a provider already runs the infrastructure and can show restore test results
Security awareness training	Entity security lead and HR	Course content, delivery platform and phishing simulations	Mandatory training for management body members and staff, and records of completion	When the entity needs content or delivery tools it does not maintain in-house
Incident response support	Entity incident response lead and management	Forensics, containment help and an incident response retainer	Incident classification, the 24-hour, 72-hour and one-month reporting decisions, and authority contact	As a retainer for surge capacity, with the entity keeping the reporting clock
Policy drafting	Management body approves; entity owns content	Drafting support and template libraries from consultants	Approval by the management body under Article 20(1), and ongoing ownership of the policies	For first drafts, provided staff review and adapt each policy to actual practice
Supplier management	Entity procurement and security owners	Supplier security questionnaires, assessments and contract monitoring support	Contract clauses, supplier selection, risk decisions and exit planning	When the entity has many suppliers, with diligence on managed security providers per Recital 86
Independent review	Management body and audit function	External audit competence or an outside assessor	Commissioning the review, acting on findings, and separation from the reviewed area	When internal reviewers sit in the line of authority of the area reviewed, or size prevents separation

What outsourcing adds to your supplier oversight duties

Outsourcing a NIS2 measure moves the work, not the accountability. Under Article 21(2)(d), your entity must address supply chain security, including the security-related aspects of its relationship with each direct supplier or service provider. Whoever runs your monitoring, testing, backups or training, the entity remains responsible for showing that those measures meet Article 21 and are overseen by the management body under Article 20. Before signing, map every outsourced measure to a named internal owner who will review the provider's output and escalate problems.

Implementing Regulation (EU) 2024/2690 sets out the contract points it expects where appropriate, found in the Annex under point 5.1.4. Check that your contracts cover cybersecurity requirements for the service, staff training and background checks for provider personnel, incident notification without undue delay, a right to audit or to receive audit reports, vulnerability handling, rules for subcontracting, and exit obligations that let you move data and services out at the end of the contract. Ask the provider to show how each clause is evidenced in practice, not only that it is written down. Confirm the exact wording against the regulation text with your legal team, since the list is framed as applying where appropriate to your risk.

Recital 86 asks for heightened diligence when selecting managed security service providers, because their close integration in an entity's operations poses a particular risk. A provider with privileged access to your logs, endpoints or networks can become a route into the entity if it is compromised. For managed security services, treat due diligence as a deeper review: verify the provider's own security controls, how it limits and logs its staff access to your environment, how it handles its own subcontractors, and whether its incident notification timing supports your reporting clocks. Record the decision and revisit it when the scope of access changes.

How to split NIS2 work between your team and providers

This sequence turns the outsourcing question into a documented split of duties, so management keeps accountability for Article 21 measures while providers carry only the work they are contracted and overseen to deliver.

Map each Article 21 measure to an internal owner
Start from the ten minimum measures in Article 21(2) and list every activity each one needs, such as policy upkeep, logging, vulnerability scanning, backups, access reviews, training and supplier management. Assign one named internal owner per measure, even where a provider will do the hands-on work. The output is a RACI matrix in which each measure has exactly one accountable internal person and each activity shows who is responsible, consulted and informed. Check the matrix with the people named in it before moving on, so that ownership is accepted and not just assigned on paper.
Decide which activities a provider will run
For each activity marked as delegable, decide whether an internal team, a managed service provider, a testing firm or a specialist will perform it. Record the reason for each choice, including skills, staffing, 24-hour coverage needs and the access the provider would need to your systems. Activities that shape risk decisions, such as approving the risk assessment, accepting residual risk and setting the testing policy, stay internal. The output is a sourcing register that lists each activity, the chosen performer, the internal reviewer and the reason for the choice.
Confirm management approval of the split
Article 20(1) requires the management body to approve the Article 21 measures and oversee their implementation, so the sourcing register and the RACI must go to the management body for approval. Present the risks of each outsourced activity, the residual risks that remain with the entity and the oversight arrangements. Record the decision in the minutes, with the names of the members who approved it. The output is a signed or minuted approval that references the version of the register it covers. Confirm with your legal counsel which national rules on management liability apply in your Member State.
Write contract clauses and access rules
Turn each outsourced activity into contract terms that match the requirements in the Implementing Regulation's supplier provisions. Cover cybersecurity requirements, staff training and background checks where appropriate, incident notification without undue delay, a right to audit or receive audit reports, vulnerability handling, subcontracting rules and exit obligations. For managed security providers, Recital 86 asks for extra diligence because of their close integration into operations, so set access rules that are time-limited, logged and tied to named accounts. The output is a clause list per provider and an access matrix showing which systems each provider can reach, under what conditions and for how long.
Set a supplier oversight cadence and evidence list
Agree with each provider a review schedule and the specific evidence it must hand over each period, such as alert and incident logs, patch and vulnerability reports, backup restore test results, training records, access reviews and change records. Assign the internal reviewer who checks each item and the date by which gaps must be raised and closed. Track open findings in the same register used for risk decisions, so the management body sees them. The output is an oversight calendar and an evidence checklist per provider, with a named reviewer for each.
Schedule independent review of the program
Plan independent reviews of the outsourced and in-house measures by people with audit competence who sit outside the line of authority of the area they review. Where size does not allow full separation, document the alternative impartiality measures you use. The Implementing Regulation sets no fixed testing frequency, so tie the review and testing schedule to your risk assessment and review the testing policy at planned intervals. The output is an approved review plan with scope, reviewer and reporting line for each area, and a record that the results go to the management body. Ask any external reviewer or auditor to confirm independence in writing before engagement.

How independent review fits into a NIS2 program

Independent review under NIS2 means that the people checking a control are not the people who run it. The Implementing Regulation (EU) 2024/2690 expects reviews to be carried out by people with audit competence who sit outside the line of authority of the area being reviewed. Where the entity is too small to separate those roles, the regulation allows alternative impartiality measures instead. For most buyers the practical question is who in the organization can review a control without reporting to the person who owns it, and what they will do differently when the reviewer finds a gap. Confirm the reviewer's reporting line in writing before the review starts, and record how the impartiality measure works if separation is not possible.

An implementation partner that designed, configured or documented your controls should not be the only party that reviews that work. Its engineers know the system well, which is useful, but they also have a stake in the outcome. Use the partner for technical testing and evidence preparation, then bring in a separate reviewer for the independent check. The organization owns the conclusion, so management should receive the review findings directly. Only an independent auditor, assessor or certification body issues a formal report. NIS2 itself creates no certificate of compliance, so any document claiming NIS2 certification should be treated with caution and checked against what the reviewer actually signed.

Your national competent authority can verify compliance through inspections, security audits, security scans and information requests, as set out in Articles 32 to 34 of the Directive. Those powers mean your review evidence should be ready to show a supervisor without reconstruction: dated test results, the reviewer's scope and competence, the findings log, and the management decisions taken on each finding. Ask any partner to hand over that evidence package at the end of each engagement, and agree with the reviewer how long they retain their working papers.

Checks before you hire a provider for NIS2 work

Hiring a provider does not transfer responsibility for NIS2 measures. Each check below tests whether the provider's scope, access and evidence can be controlled and verified by your management body and your supervisor. Use them before signing, and repeat the access and evidence checks at each stage.

Scope of work in writing

Ask for a written statement of which systems, sites, supplier-managed tools and Article 21 measures the provider covers, which ones stay with your team, and who signs off each deliverable. A weak answer describes the service in general terms such as "full NIS2 support" with no list of assets or named owners. Ambiguity here becomes a gap your supervisor will find, and it is the first thing to fix in the statement of work.

Access model and time limits

Ask how the provider gets access, which accounts and roles it uses, how privileged sessions are logged, and how each grant is removed when the task ends. Recital 86 notes that managed security providers pose a particular risk because of how closely they are integrated into operations, so this check matters most for them. A weak answer is a shared administrator account or access that is open-ended, with no record of who used it.

Contract clauses from point 5.1.4

Confirm the contract covers the items listed in point 5.1.4 of Implementing Regulation (EU) 2024/2690 where appropriate: security requirements, staff training and background checks, incident notice without undue delay, your right to audit or receive audit reports, vulnerability handling, subcontracting rules and exit obligations. A weak answer offers a general confidentiality clause and a link to the provider's standard terms, with no audit right or notice period.

Evidence handed over at each stage

Agree in advance which records the provider gives you at kickoff, during delivery and at closure, such as configuration baselines, test reports with findings and retest results, change records, backup restore tests and training attendance. Ask for samples now, not later. A weak answer is a promise to provide reports on request, or dashboards that the provider can edit and you cannot export.

Sector experience and references

Ask for references from clients in your Annex I or Annex II sector and for examples of how the provider handled a regulator inquiry, an incident report or a supplier audit. Check whether the people named in the proposal are the people who will do the work. A weak answer offers only generic references without a sector match, or refuses to name the people who will be on the engagement.

Exit plan and data return

Require a written exit plan that covers how the provider returns configurations, logs, documentation and credentials, how it removes its access, and how long data stays with it after termination. Include a test of the exit before you rely on the provider for critical monitoring. A weak answer says the provider will "cooperate" at exit without a timeline, a format for returned data, or proof that access has been revoked.

Common mistakes that leave gaps when work is outsourced

Outsourcing NIS2 work moves effort, not accountability. The pitfalls below share one root cause: the entity hands off a task but keeps no owner, evidence or exit path for it. Each card names the gap and the check that closes it.

Treating outsourcing as transferring liability

Article 20 places approval and oversight of the Article 21 measures on the management body, and that duty stays with the entity when a provider runs the work. A signed contract with a service provider does not move accountability for the outcome. Check that the management body still approves the measures, reviews provider reports, and records decisions about residual risk.

Standing administrator access with no time limit

Providers often keep privileged accounts open for months because it is convenient for them. Standing access that nobody reviews turns a supplier into an unmonitored entry point to your systems. Require time-limited, logged access tied to a ticket, and confirm that each grant is revoked when the task ends.

The builder also tests the control

When the team or provider that configured a control also certifies that it works, no one independent has checked it. Independent reviews must be carried out by people with audit competence outside the line of authority of the area reviewed, or under alternative impartiality measures where size does not allow this. Separate build and test roles, or document the impartiality measures you use.

Missing exit and data return clauses

Without exit terms, switching providers or ending a contract can leave your logs, configurations and backups in a supplier's hands. Contracts should address exit obligations, subcontracting rules and the return or deletion of data. Ask counsel and the provider to confirm, in writing, how data is returned, in what format, and within what period.

No evidence handover to the entity

If a provider keeps the logs, test reports and configuration records, the entity cannot show a supervisor that its measures work. Supervisors can request information and run audits, so the evidence must be available to your own team. Agree in the contract which records you receive, how often, and in what format, and test that you can retrieve them.

No owner checking supplier reports

Monthly reports from a provider are only useful if someone inside the entity reads them, compares them with agreed targets and acts on exceptions. Without a named owner, reports accumulate unread and problems surface first during an incident or inspection. Assign one accountable person per provider, set a review cadence, and record the follow-up actions.

Questions buyers ask about outsourcing NIS2 work

Can management delegate NIS2 duties to a provider?

No. Management can delegate tasks, but not responsibility. Under Article 20(1), the management body must approve the Article 21 cybersecurity risk-management measures and oversee their implementation, and it can be held liable for the entity's infringements of Article 21. A provider can prepare the policies, run the controls and report back, but the board still has to approve the measures, review the reports and decide on risk acceptance. Members of the management body must also complete training under Article 20(2). Confirm with your national competent authority how it expects that approval and oversight to be documented, since the form of records can vary by Member State.

Which NIS2 measures can a service provider run for us?

Most operational measures can be run by a provider, while the entity keeps ownership of the outcome. Measures commonly outsourced include:

Security monitoring and log analysis, including a managed SOC
Vulnerability scanning and penetration testing
Backup operation and restore testing
Security awareness training delivered to staff
Managed firewall, endpoint or identity administration

The risk assessment, the policies, the decision on which risks to accept and the incident decisions normally stay with the entity. Test frequency is not fixed by the regulation. It follows your risk assessment and the testing policy is reviewed at planned intervals, so the provider's schedule should be set from your own risk findings.

What does the internal team need to do when work is outsourced?

The internal team must own the outcome and manage the provider. Someone inside the organization needs to define the scope, approve changes to the measures, receive and review provider reports, track findings to closure and keep the evidence file that a supervisor may request. Under Article 21(2)(d), supply chain security covers the security-related aspects of the relationship with direct suppliers, so the team must also run supplier reviews and contract checks. Expect this governance work to recur for as long as the contract runs. Ask any provider which named internal roles they expect to interact with and what time commitment that implies.

Does a managed SOC take over the NIS2 incident reporting duty?

No. A managed SOC can detect, triage and escalate incidents, but the entity remains responsible for meeting the Article 23 reporting obligations. Those include the early warning, the incident notification and the final report, with timing set by the Directive and the national rules that apply to the entity. The contract should require the provider to escalate to your named contacts quickly enough for you to meet those clocks, and your own decision-makers must be able to make the reporting call. Confirm the exact deadlines, the reporting channel and the national CSIRT or authority with your national competent authority, because implementation details differ by Member State.

Can we do the NIS2 work ourselves instead?

Yes, the Directive does not require outside help. An entity can run its NIS2 program with internal staff, provided it has the skills, capacity and independence the measures require. The main trade-off is capacity and expertise. Monitoring around the clock, testing by people independent of the area under review and maintaining evidence for supervisors all take sustained effort. Under Implementing Regulation 2024/2690, independent reviews must be carried out by people with audit competence outside the line of authority of the area reviewed, or under alternative impartiality measures where size does not allow this. Smaller entities often combine internal ownership with selective outside testing or review to meet that requirement.

How do we evidence oversight of a security supplier?

Keep a dated, reviewable record showing that you checked the supplier, set requirements in the contract and monitored performance. The Implementing Regulation's contract guidance points to cybersecurity requirements, staff training and background checks where appropriate, incident notification without undue delay, a right to audit or receive audit reports, vulnerability handling, subcontracting rules and exit obligations. Practical evidence includes the signed contract, supplier risk assessments, security questionnaires, received audit reports, incident notifications, service reviews and records of exit planning. Recital 86 asks for increased diligence when selecting managed security service providers because of their close integration into operations, so document that selection process carefully.

Who issues an independent report on our NIS2 controls?

Only an independent auditor, assessor or certification body issues an audit report or attestation. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. A consultant or implementation partner can prepare systems, controls and evidence, and can run security testing, but it cannot sign off on your compliance. Where your national authority or a customer requires an independent review, confirm with them which reviewer is acceptable and whether your provider can be that reviewer, since the independence rules in the Implementing Regulation restrict who may review work they helped build.

How DeployOpen scopes and prepares the split

DeployOpen helps organizations decide which NIS2 work runs on self-hosted open-source platforms inside their own infrastructure and which duties stay with management and internal staff. We prepare the systems, controls and evidence that support that split, while the organization keeps ownership of its controls and decisions. Independent assessment remains with the auditor or assessor the organization appoints.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope lists which measures are delegated to us, which stay with internal teams, and which need management approval.
We confirm the supplier and service provider boundaries that the split creates, including who holds administrative access to each system.

How we build

We plan, implement, integrate and harden the self-hosted platforms that carry monitoring, backups, testing and training records inside your environment.
We document the responsibility matrix so each Article 21 measure shows an owner, a reviewer and a schedule.
We test backups and monitoring coverage against the scope so the evidence reflects how the systems actually behave.

How we hand over

We deliver runbooks, configuration records and evidence collections that internal staff can operate after handover.
We provide the supplier and contract checklist items that the organization needs to review with its providers.
We document the review points where management approval and independent review must happen, so the organization can assign them.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, scoped in writing.
Retainers can cover periodic reviews of the responsibility matrix as the risk assessment and the services change.
Confirm with your auditor or competent authority which evidence they expect, since DeployOpen prepares evidence but does not issue reports or certificates.