NIS2 business continuity for the MSP: why you belong at the board table

NIS2, business continuity and the MSP are suddenly in the same conversation, and that conversation no longer belongs in the server room. Last week a colleague sat down with a large transport company. The managing director said: “We do not have to be compliant with NIS2. But we are going to do it anyway, because of the chain.” Deal awarded, without a single word about backups or retention policy. That is the shift you have to understand if you want your MSP practice to grow over the next two years.

Most MSPs we speak to are still stuck in the same reflex. A new law arrives, so you build a service package, you explain what encryption does, you show how you run backups and you hope the client gets it. Meanwhile the director of that same client is in another conversation, with their largest customer, who asks whether they can demonstrate that continuity is secured. And there it falls silent.

Because NIS2 directly affects 400,000 organisations in Europe, and that direct group, between 8,000 and 10,000 in the Netherlands, may only work with suppliers whose risk they have set down contractually. Work it through: hundreds of thousands of suppliers are going to be screened by their largest clients. If your mid-sized client does not pass that screening, they lose that revenue. And if you as an MSP do not start that conversation, you are the one who falls out of that chain. The problem is not technology. The problem is that you are at the wrong level, with the wrong people, on the wrong subject.

What works: business continuity as a sales conversation, not as a product

What we see working in practice is a shift in who you get around the table. Not the IT manager, but the director. Not because that sounds commercially smarter, but because NIS2 literally prescribes it: board members have a personal training obligation and are personally liable. This is not a subject you can haggle over between two IT people. Anyone who leaves it there is by definition not meeting the law.

The conversation that works is not about bells and whistles. It is about one question: what does it cost your company if you are down for three weeks? Enisa researched this among European companies that had been hacked. A day of standstill costs between 2.5 and 5 per cent of revenue. A week and a half down is 25 per cent. More than three weeks down means bankruptcy for 60 per cent of the companies affected. You do that sum in two minutes together with the director. And then you no longer have a security conversation, you have a continuity conversation. That is a fundamentally different position in the buying process.

Why backup and business continuity are two different conversations

The biggest error of thinking in the midmarket is that backup and business continuity are synonyms. They are not. Backup is one part, continuity is the broader question: can this organisation still deliver to its clients after an incident, and if so, within what time. At a manufacturer it is about factory floors standing still. At a hospital it is about patients being taken by ambulance to another building. At a haulier it is about journeys not being driven. That is the language of the director, and the MSP who speaks that language sits in a different chair from the MSP who talks about retention policy.

In concrete terms this means you run an impact analysis before you utter a single technical word. Which processes may stand still for four hours at most? Which for eight? Which for two days? For which processes is there a manual workaround and for which absolutely not? Whoever answers those questions together with the board automatically gets an RTO and RPO that is not a theoretical number but a board decision. And that board decision is the basis of every contract, every SLA and every investment proposal you put down afterwards. Without that basis you are selling loose tools with no story.

The simulation as an opening

The opening that works best is not a proposal. It is a boardroom simulation. You sit down with photos on the table and ask: what if everything here goes down today? Who calls whom? Where are the contracts? Who may call the insurer? Who contacts the largest client? In nine cases out of ten nobody knows the answer. That realisation, in the room, with the board present, is worth more than three quarters of cold outreach. You are not selling security, you are selling the reason their largest client will still be working with them next year.

Build that simulation as a tabletop exercise of ninety minutes at most. Take three scenarios: ransomware in the night, a supplier who is down themselves, and a former employee who takes data with them. Let the board decide themselves who takes which role. Note the silences, not the answers. Your entire proposal sits in those silences. At the end of that session the director lays out their own gaps, and all you have to do is explain how you close them. That is a fundamentally different sales dynamic from a demo of your backup console.

Why the responsibility conversation is so hard for the MSP

The hardest part, and this is where most MSPs come unstuck, is the shared responsibility conversation. Clients want their worries taken away. They want you to sort it. But legally the director is liable, not the MSP. If you do not put that division explicitly on the table, with a signature under it, you are the one in the firing line after an incident. We advise having an explicit refusal signed as well: if a client says “I do not want that extensive continuity solution”, have that set down in black and white. That is not distrust, that is professionalism. It protects the client against themselves, and you against a claim you never saw coming.

And then there is the sales level itself. The average sales level in MSP land is enough to make you weep, and that is not down to bad people. It is because MSP sales grew up selling technology to technology buyers. The translation from technology to business impact, from uptime to revenue, from patch management to chain liability, is rarely made. Those who do make that translation win deals competitors did not even know existed. Those who do not stay stuck in price negotiations over per-endpoint rates with buyers who only look at the bottom line.

What this asks of your organisation

Practically this means you need someone who can hold the board conversation. That is rarely your current account manager and almost never your engineer. It is someone with a business background, someone who can read a set of accounts, someone who understands what keeps a director awake at night. Some MSPs hire a former controller for it, others have their owner run the first ten conversations to find the pattern. Both work. What does not work is hoping your existing sales team picks this up between licence renewals.

The biggest opportunity you have as an MSP this year does not sit in a new vendor or a smarter tool. It sits in the fact that hundreds of thousands of Dutch companies have to hold a conversation they cannot hold themselves, with a clock ticking. Anyone who dares to have that conversation at the board table, with figures on lost revenue and liability, builds a client portfolio over the next two years that cannot be competed away. Anyone who parks it and waits for the client to start will shoot themselves in both feet at once. Start this week: call three existing clients, ask about their largest customer, and put that one question about three weeks of standstill.