On 13 September 2026, ENISA's public consultation on the EUMSS scheme closes. This date does not yet appear in the compliance calendars of most security departments. It should. The EUMSS scheme (EU Managed Security Services) is set to redefine how you select, contract with and assess your operational security providers.
Why a certification scheme for MSSPs
Outsourcing detection, incident response or security audits has become the norm for mid-sized organisations. Managed security service providers (MSSPs) number in the hundreds across Europe. Until now, however, no common framework has made it possible to compare their levels of assurance. A provider certified to ISO 27001 and a provider labelled by a local sector body do not speak the same language. Your contracts fill this gap with bespoke clauses, which are hard to audit and even harder to enforce.
This is the problem ENISA is seeking to solve with EUMSS. The scheme sets out a common set of requirements for the services covered by the amendment to the Cybersecurity Act: incident response, penetration testing, security audits and cybersecurity consulting. It applies to any organisation wishing to provide these services in the European internal market.
What the EUMSS scheme covers
The scope of the scheme concerns services, not products. Four categories are explicitly included: incident response, penetration testing, security audits and consulting. A managed SOC will fall within scope. So will a penetration testing provider. An integrator that deploys a SIEM solution without providing daily monitoring does not necessarily fall within it.
This distinction matters for your purchasing. If your SOC provider becomes EUMSS-certified, you have a standardised assurance over its processes, skills and organisation. If not, you will continue to rely on your own contractual due diligence.
The link with the EU Cybersecurity Reserve adds a further consideration. Providers that can be mobilised under this European emergency response reserve will need to be EUMSS-certified within two years of the scheme's entry into force. For entities that wish to access this reserve during a major incident, the scheme becomes an indirect condition of access to a collective resilience mechanism.
What the NIS2 Directive changes in the equation
Essential and important entities subject to the NIS2 Directive are required to manage the risks linked to their ICT service providers. An MSSP is an ICT service provider within the meaning of NIS2. Your third-party risk control obligations therefore extend to your operational security suppliers, including those to whom you delegate detection or incident response.
Today, this obligation takes the form of questionnaires, contractual clauses and document-based audits. Tomorrow, EUMSS certification could serve as direct evidence. A EUMSS-certified provider will demonstrate that it meets European requirements, without you having to conduct an in-depth assessment at each contract renewal. For entities managing many security providers, this is a real time saving and a reduction in inspection risk.
To go further on the contractual management of providers under NIS2, the article Subcontractors and NIS2: what your supplier contracts do not yet cover details the most frequently missing clauses.
A concrete example: a SOC tender in 2027
The IT department of an industrial group renews its SOC contract in 2027. It includes in its specifications a clause making final award conditional on obtaining EUMSS certification within 18 months of signature. The selected provider is not yet certified at the time of responding to the tender, but its certification plan is documented and its incident response process is aligned with the requirements of the scheme.
This type of clause did not exist before EUMSS, for want of a common reference. It will become standard in security tenders once the scheme is adopted.
What happens before adoption
The scheme has not yet been adopted. The public consultation closing on 13 September 2026 is one step in the validation process. Once the contributions have been reviewed, ENISA will finalise the text of the scheme and submit it to the European Commission for formal adoption. This process takes several months.
This means EUMSS certification will not be operational in 2026. It is likely to be operational in 2027 or 2028. However, the requirements of the scheme can already be read in ENISA's public documentation, and serious providers have started preparing for them.
For your teams, the consultation period is precisely the right moment to read the scheme. Not to respond to it (although you could submit comments until 13 September), but to understand the criteria that will soon distinguish a certified MSSP from a non-certified provider. These criteria can already be integrated into your provider evaluation grids, even before a formal certification is available.
What you must do before the end of the year
Three concrete actions are needed before the end of 2026. First action: map your operational security providers (SOC, penetration testing, incident response, audit) and check whether the EUMSS scope covers them. Second action: include in your upcoming tenders a requirement for a EUMSS certification roadmap, even though certification itself will not be mandatory before 2027-2028. Third action: align your current contractual clauses with EUMSS requirements on incident response processes, notification deadlines and documentation obligations.
This early preparation does not generate any immediate additional cost. It spares you from having to renegotiate your contracts urgently once certification becomes a regulatory requirement for access to the EU Cybersecurity Reserve or to satisfy your NIS2 supervisory authority.
Key takeaways
The EUMSS scheme is not a distant project. Its public consultation closes within two weeks. The requirements it sets for managed security service providers can be read now. They will structure the European MSSP market over the next two to three years.
For buyers of security services, the challenge is simple: do not wait for the formal adoption of the scheme before integrating its criteria into your decisions. Providers that prepare now will offer you stronger assurance than those that discover the scheme at the point of certification.