The short answer
Part of ICT service provision is explicitly named in the NIS2 sector list and can therefore be essential or important in its own right. Think of managed service providers and managed security service providers, cloud service providers, and data centres. But most ICT service providers — the local network manager, the party that maintains servers remotely, the supplier of a business application — do not fall directly under the sector list. They are often affected nonetheless, because their customer is legally required to do so: an essential or important entity must assess how secure its suppliers are, and an ICT service provider with access to systems is an obvious candidate for such an assessment.
Whether you are directly subject to obligations yourself or affected through the supply chain depends on three things taken together: whether your type of service is listed in the sector list, whether your organisation meets the size threshold that applies, and what is your actual role with customers who are themselves subject to obligations. These three factors determine the answer together, and they work independently of each other — you can meet the size threshold without being in the right sector, or be precisely in the sector without meeting the size threshold.
What the sector list says about ICT service provision
The NIS2 Directive distinguishes between sectors of critical importance and other critical sectors. Within digital infrastructure and digital services, managed service providers and managed security service providers are explicitly named, alongside cloud computing services, data centres, and online marketplace and search engine providers. Anyone falling under one of these categories goes through the same assessment as any other sector: does your service fit the description in the Directive, and if so, in which category.
Those providing purely software, building a website, or carrying out occasional IT projects without ongoing management typically fall outside this specific description — although the precise boundaries depend on your own situation rather than a general rule of thumb. If you are uncertain which description applies to your service provision, that is one of the points where a short check provides an initial indication with a reference to the exact location in the Directive.
Size carries equal weight to sector
Sector alone is not enough to be essential or important. NIS2 operates with size criteria that align with the standard classification for medium-sized and large enterprises: the number of employees and turnover or total balance sheet play a role in determining the category. A sole trader offering network management to a handful of local businesses is typically in a different category by size than a national IT service provider with hundreds of employees, even if both provide essentially the same service.
The national laws that transpose the Directive — in the Netherlands the Cybersecurity Act — elaborate these criteria further, and the competent authority publishes practical guidance on them. We maintain those sources with the date we identified them, so you can verify when an indication is based on them.
Remote management and access to customer systems: the supply chain position
In ICT service provision especially, the supply chain position is often the decisive factor, regardless of sector and size. Remote management, access to customer networks, password management, or maintaining an application that is critical to the customer — these are precisely the characteristics that a customer weighs when assessing their own suppliers. An essential or important entity must indeed be able to demonstrate that risks in the supply chain are identified, and a supplier with access to systems ranks high on that list, regardless of whether that supplier itself appears on the sector list.
This explains why many ICT service providers, without being obligated themselves, nonetheless receive a security questionnaire or contractual requirement. It is not a legal obligation that rests directly on them, but a practical requirement that comes through the customer — and one that can indeed affect the contract.
Subcontractors: the chain does not stop with you
Those who themselves work with subcontractors — a freelance systems administrator, a party providing hosting, an external helpdesk — pass that question through in practice. If your customer wants to know how access to systems is managed, chances are high that you will ask the same question of your own subcontractors. This way, supply chain assessment goes multiple levels deep, even if no one in that chain is themselves subject to the sector list.
What this means for your file
Whether you are obligated yourself, reached only through the supply chain, or neither, determines how your preparation looks: a complete care obligation file, targeted answers to customer questionnaires, or for now no action. An overview of the ten measures that the care obligation expects of you, and how they relate to what a customer asks in a questionnaire, can be found in the explanation per topic. For the question of how secria.eu maintains sources and what an indication is based on, the methodology is a good starting point, and frequently asked questions about the scope of the law are collected in the overview of questions and answers.
Start with the NIS2 check to see whether your service provision falls on the sector list, which size matters, and what your position in the chain means for you — free and without an account.