The European Union is expanding its cybersecurity regulatory framework, with major implications for organizations across sectors. Today, regulators aim to create measurable, demonstrable, and comparable obligations via the NIS2 Directive, the Cyber Resilience Act, the EU Cybersecurity Act, and other initiatives.1
Despite their importance to the global cybersecurity ecosystem, managed security services (MSS) have remained out of scope for a long time. Managed security service providers (MSSPs) may monitor critical systems, investigate and respond to incidents, operate detection tools, manage vulnerabilities, or support governance and management decisions via consultation. These activities directly influence the cybersecurity risk appetite and overall resilience of the organization purchasing these services. If such a service is not well governed or properly controlled, the impact can be serious, including:
- Unclear responsibilities that slow down processes
- Weak service management that may decrease security level through, for example, delayed incident detection and response
- Poor reporting, which may present to management an inaccurate view of risk
- Weak access controls which may increase third-party risk
Given the mercurial nature of the cyberlandscape, customers, regulators, and business partners face an important question: How can the quality, reliability, and competence of MSS, as well as the security level of MSSPs, be assessed consistently? In response, regulators have proposed the EU Managed Security Services (EUMSS) cybersecurity certification scheme, which offers a framework for evaluating and certifying MSS.2
EUMSS is a European cybersecurity certification scheme being developed under the EU Cybersecurity Act (Regulation (EU) 2019/881).3 EUMSS aims to support harmonized recognition of MSS across the European Union and to advance cybersecurity resilience.
EUMSS Requirements
Overall, the EUMSS aims to create value by making MSS more transparent and comparable, while enhancing their trustworthiness through improved quality and security. Its certification approach is based on specific service profiles, meaning that stakeholders should be able to understand which MSS is certified, what service profile applies, and what assurance level has been granted. Currently, the incident response service profile is being developed and finalized, and the framework will be extended with further service profiles in the future.
EUMSS combines 2 layers of requirements. The Horizontal Layer (HoLa) provides a common baseline for quality assurance and cybersecurity, directly measuring reliability and operational resilience. It applies to all certified MSS, but it is not a standalone object of certification (i.e., no EUMSS certificate or separate assurance level is issued for the HoLa by itself).
Certification is granted at the level of the relevant service profile in the Vertical Layer (VeLa). Depending on the service profile and assurance level, the VeLa supplements and, where necessary, extend the requirements defined in the HoLa. It sets out the specific organizational governance, operational, technical, and competency requirements for a given service profile, linked to the requested assurance level: basic, substantial, or high. Figure 1 illustrates the relationship between the HoLa, VeLa, service profiles, and assurance levels.
Figure 1— EUMSS Certification Structure
The incident response profile’s operational phases have been adapted from International Organization for Standardization (ISO) 20700:2017, which helps to align quality- and security-related process requirements.4 In the Setup Phase (D-RES), foundational controls regarding service agreement, scope, expectations, and service delivery arrangements must be established before execution activities commence. The Execution Phase (E-RES) encompasses the operational execution and delivery of the incident response service according to the agreed scope. Last, if the service ends, applying the requirements of the Closure Phase (C-RES) ensures proper completion, documentation of outcomes, knowledge transfer, and systematic improvement of future service delivery.
This structure can help ensure that certification is consistent across MSS, while also addressing the specific governance, operational, technical, competency, and assurance requirements of each service profile.
EUMSS for Providers and Customers
EUMSS may present opportunity, but it can prove challenging for both providers and customers.
For MSSPs, EUMSS offers opportunity because certification can become a market differentiator. Providers that can demonstrate mature governance, reliable operations, clear responsibilities, strong evidence, and competent personnel may be in a more favorable position with customers (enterprises) that face strict cybersecurity and third-party risk expectations. To take advantage of this opportunity, providers must demonstrate that:
- Controls operate effectively
- Services are delivered consistently
- Staff are competent
- Information and communications technology (ICT) is managed
- Subcontractors are managed
- Reporting supports customer understanding and oversight
- For customers, EUMSS may help make the market more transparent, as certified MSS will be comparable in procurement, vendor due diligence, and third-party risk management.
However, one main risk of the EUMSS certification scheme is that compliance can become the goal instead of better security. This is a common drawback of certification schemes. Moreover, the certification may replace customer-side risk assessments, but a certified service will not automatically be suitable for every organization, or sector. Instead, EUMSS should be seen as a decision-support tool through which information gaps can be reduced. It can help decision makers ask better questions and provide stronger evidence for contractual and assurance requirements.
MSS are not static. They are subject to ongoing changes in operational capabilities, the threat environment, technology, subcontractor arrangements, and skills requirements. For this reason, the real value of EUMSS will depend on whether stakeholders will be able to provide and assess continuous, evidence-based, risk-proportionate service delivery.
Last, a service certification scheme such as EUMSS does not, on its own, create the professional capacity needed to implement, operate, use, and assess certified services. Providers need appropriately skilled professionals to design and deliver services in accordance with the organizational, operational, technical, and competency requirements of the relevant EUMSS service profile and assurance level. Customers likewise need professionals who can understand the scope and assurance provided by the certification and use that information appropriately in procurement, risk management, and vendor oversight. Auditors and assessors also require sufficient technical, governance, and assurance expertise to evaluate the relevant evidence effectively. Professional certifications can help demonstrate some of these competencies by providing objective evidence of education, continuing professional development, and practical experience.
ISACA’s Role
In September 2026, ISACA® provided technical input to ENISA’s consultation on the EUMSS Candidate Scheme.5 ISACA is well positioned to contribute to the EUMSS discussion for 2 reasons:
- The first reason is ISACA’s global advocacy and professional network. In the EU, ISACA is a pledger to the Cybersecurity Skills Academy and the Industry-Academia Network and contributes to a range of Horizon Europe and Erasmus+ initiatives focused on strengthening cybersecurity skills, workforce development, and professional capacity.6
- The second reason is ISACA’s connection to the European Cybersecurity Skills Framework (ECSF),7 providing a common framework for cybersecurity roles by determining tasks, skills, and competencies.8 ISACA can help map professional development and training via ISACA certifications with the ECSF. This is important because EUMSS will require not only organizational readiness, but also qualified professionals among providers, customers, auditors, and conformity assessment bodies.
Conclusion
The EUMSS has the potential to become an important player in the EU cybersecurity MSS market. If implemented properly, it can serve as a trust mechanism that supports comparability among providers, facilitates better customer decision making and policy implementation, and promotes stronger cyber resilience across the European Union. Therefore, EUMSS should not be seen as merely another compliance label. Its possible value is broader, as it can help create a common language for the quality, reliability, security, and assurance of MSS. The scheme can provide a certification structure that links together policy, regulations, and market harmonization in the European Union.
For practitioners, this creates both an opportunity and a responsibility. Governance, risk, audit, assurance, cybersecurity, and professional skills are directly relevant to the EUMSS. Professionals can help ensure that the scheme is not seen only as a regulatory requirement, but also as a practical tool for building digital trust.
Author Disclaimer: The views expressed in this article represent the author’s opinions and do not necessarily reflect the official position of ENISA, the ad hoc working group, ISACA, or any other organization.
Endnotes
1 Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (Text with EEA relevance); Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance); Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance)
2 European Union Agency for Cybersecurity (ENISA), European Union Cybersecurity Certification, "EUMSS - EU Cybersecurity Certification for Managed Security Services"
3 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance)
4 International Organization for Standardization (ISO), ISO 20700:2017 Guidelines for management consultancy services, Edition 1, 2017
5 ISACA®, “ISACA’s Additional Commentary on the EUMSS Candidate Scheme,” September 2026
6 ISACA, Advocacy
7 ENISA, European Cybersecurity Skills Framework, European Union, 2022
8 ISACA, “European Cybersecurity Skills Framework: Map Your Career Pathways With ISACA Credentials”
Zsolt Bederna
Zsolt Is a GRC and cybersecurity leader with experience in regulatory transformation, audit and assurance, CISO advisory, and has held senior roles in managed security service providers. He is a cofounder of a cybersecurity GRC startup. Bederna is a member of the ENISA Ad Hoc Working Group on the European Union Managed Security Services cybersecurity certification scheme. He has also served as an ISACA volunteer as a member of the EU Advocacy Task Force and of the IT Audit Framework Task Force and took part in reviewing ISACA Review Manuals. Currently, he is a member of the ISACA Emerging Trends Working Group. His research is related to the EU cybersecurity governance and the related requirements. As part of his scientific research, he is currently working on the financial analysis of cybersecurity incidents. You can find him on LinkedIn.