On 24 July 2026, the European Union Agency for Cybersecurity (ENISA) launched a public consultation on the certification of Managed Security Services (MSS) in the EU. The initiative aims to develop a common EU certification scheme for MSS providers, which would help harmonise security standards across member states and increase trust in outsourced cybersecurity services. The consultation is open to stakeholders including MSS providers, their customers, national cybersecurity authorities, and other interested parties.
Managed Security Services cover a range of outsourced cybersecurity functions such as threat monitoring, incident response, and vulnerability management. Currently, no EU-wide certification exists for these services, leading to fragmentation as national schemes or no schemes at all apply. The proposed certification scheme would be voluntary but could become a market differentiator for providers that achieve certification.
The consultation seeks input on the scope of the scheme, the security requirements to be included, the assurance levels (basic, substantial, or high), and the conformity assessment procedures. ENISA will use the feedback to draft a candidate scheme, which will then be submitted to the European Commission for adoption under the Cybersecurity Act (Regulation (EU) 2019/881). The consultation period runs until 30 September 2026.
Stakeholders likely to be most affected include MSS providers, who may face new compliance costs but also gain a competitive advantage from certification; their customers, particularly small and medium-sized enterprises, who would benefit from clearer quality signals; national cybersecurity authorities, which would need to oversee certification bodies; and EU regulators, who would gain a harmonised framework to strengthen the single market for cybersecurity services.
The consultation represents a concrete step toward implementing the EU's broader cybersecurity strategy, which calls for increased standardisation and mutual recognition of security certifications across member states. ENISA expects to publish the draft scheme in early 2027, with adoption by the Commission potentially later that year.