Cyber incident at an MSP client: where does your duty stop?

The liability of an MSP after a cyber incident is no longer something you settle with a standard SLA and a disclaimer. A fellow MSP told us last week about a client who refused to take the business continuity module. Two weeks later the company stood still for three days. The first question the director asked was not “how do we fix this”, but “who is going to pay for this”.

That is the conversation waiting for you if you never had that waiver signed. And even then, a piece of paper holds up less and less. Judges set contracts aside when they decide that you, as an IT provider, failed your duty of care. That is no longer theory. Enisa, the European cyber agency, explicitly advised national governments last autumn to start holding MSPs to account. And the Dutch regulators are on alert for 1 July, when the Cyber Security Act takes effect.

Meanwhile the chance of a cyber incident is now one in three. A small incident with a day of downtime costs between 2.5 and 5 per cent of turnover. A week down costs 25 per cent. More than three weeks down means bankruptcy for 60 per cent of companies. These are not scare numbers from a sales deck, they are basic statistics from research among European businesses that were hit. And if you are the MSP who has served that client for five years, the client's lawyer will not go looking for the attacker first. They will look at you.

Where MSP responsibility really starts

What works in practice is not another annex in the contract. It is a conversation you hold at board level, not with the IT manager. NIS2 requires that plan to be physically signed by the director, even at a mid-sized company with ten staff. That is not case law, that is the legislation. And it is exactly where 80 per cent of MSPs drop out, because they are afraid of losing the client if they say honestly: one hundred per cent security does not exist, and you are the director in the end.

That honesty is the protection. If you record in the first conversation that it is a shared responsibility, you deliver the tooling and the detection, the client trains their people and decides on risk acceptance, then you are building a file that does hold up. Clients who refuse to sign that are clients you should not want to serve. That sounds harsh. But the MSPs who dare to be that rigid may lose two prospects a year in the short term and win the clients who matter in the long term.

Backup and continuity are two different conversations

A manufacturer in Limburg proudly told an MSP that they “had backups”. Where? In an external data centre. Question: if your entire local infrastructure goes down through ransomware, how fast are you running again? Nobody had an answer. That is exactly where most MSP responsibility goes off the rails: the client thinks backup equals continuity, and the MSP does not correct that explicitly enough.

Backup protects against data loss. Business continuity protects against downtime. That difference decides whether you are a supplier or a strategic partner. And it decides whether you are liable for those three days of standstill or not. Of the MSPs that run automated restore tests on the virtual machines every 24 hours, fewer than a handful also run a physical restore exercise twice a year. That is the exercise you should book a boardroom session for at your client, with the figures on the table and the question: if everything goes down here now, what does that cost.

The chain liability nobody sees coming

Where it really starts to shift is the supply chain. Of the 8,000 to 10,000 Dutch companies that fall directly under NIS2, each has to demonstrably check whether their suppliers pose a risk. One large Dutch company recently mapped 4,000 suppliers, of which 800 were marked as critical. Of 50,000 Dutch transport companies, 5,000 are members of the trade association. Those 500 have it in order, the other 4,500 do not at all. And all of them supply companies that will soon have to prove their chain is clean. If you are that link and your client is dropped by its largest customer because you could not deliver certification, then the liability question is no longer a legal game but a real breach of contract.

The NIS2 Supply Chain Certification was deliberately designed as a lighter alternative to ISO 27001, with half a day to a full day of audit instead of a trajectory of one and a half to four years. Seventeen control measures, among them an incident plan, staff training and demonstrable business continuity. That is not exotic, that is common sense. But it is the instrument that lets you explain to a board why the investment has to happen now and not next year.

The MSPs that grow over the next twelve months are not the ones with the prettiest tech stack. They are the ones who dare to have the uncomfortable conversation about where their responsibility ends and the client's begins, in writing, with a director's signature underneath. Anyone who avoids that conversation will be crushed by their own client, through the lawyer of that client's biggest customer. That is the reality starting on 1 July.