TOWARDS TRUSTED MANAGED SECURITY SERVICES IN EUROPE

As organisations increasingly outsource critical cybersecurity functions such as threat monitoring, incident detection, and response, the security of managed service providers has become a strategic issue. Recognising this shift, the European Union Agency for Cybersecurity (ENISA) has launched a public consultation on the draft European Cybersecurity Certification Scheme for EU Managed Security Services (EUMSS), inviting industry representatives, public authorities, certification bodies and cybersecurity experts to comment on the proposal until 13 September 2026.

The consultation is the latest step in a process that began in 2025, when the European Commission tasked ENISA with the development of a certification scheme under the Cybersecurity Act. Rather than creating a single certification for every type of managed security service, the draft adopts a layered approach. A horizontal layer establishes baseline requirements that every certified provider will have to meet, covering areas such as secure service design, operational management, business continuity, deployment, and continuous improvement, while additional vertical layers introduce technical requirements tailored to specific services. The first version focuses on incident response services, with profiles for other managed security services expected to follow in future iterations.

The consultation is intended to gather practical feedback on both the overall structure of the scheme and the proposed technical requirements before certification rules are finalised. Beyond harmonising security standards across Member States, the initiative is expected to support the implementation of the EU Cybersecurity Reserve, whose providers will eventually be required to obtain certification under the scheme, helping to establish a common level of trust in managed security services throughout the Union and making it easier for organisations to procure qualified providers across borders.

Author(s): Francesca Foliti, Agency for the Promotion of the European Research