verantwoordelijkheid MSP bij incident
Who is responsible when it goes wrong at the client?
In a hack or an outage the client always carries final responsibility as the director, but the MSP is jointly responsible for what was promised contractually. Without explicit agreements on backup, restore and business continuity, the bill lands with the party least able to demonstrate what was and was not delivered.
MSP Late Night · 20 August 2026
How do you set down that shared responsibility?
The board of the client stays finally responsible and under NIS2 even has a personal training obligation. The MSP is responsible for what is in the agreement: which backups, which restore times, which tests and which reporting. What the client explicitly refuses has to be in black and white with a signature. Without that record, in an incident the risk nearly always shifts towards the supplier who cannot prove otherwise.
Who carries final responsibility?
The director of the client stays legally liable for continuity and data safety. Under NIS2 that applies to around 400,000 organisations in Europe, including a mandatory board training.
Where does the liability of the MSP begin?
With everything promised contractually and not demonstrably delivered. A booted VM every 24 hours with a screenshot in the ITSM system is evidence towards the client and the insurer, and draws the line between a supplier error and a client choice.
What if the client refuses measures?
Have an explicit refusal signed. A day of standstill costs 2.5 to 5 per cent of revenue, a week up to 25 per cent, more than three weeks down heads towards bankruptcy. Without a signature that risk sits with the MSP.
The responsibility story is a shared responsibility. We are glad to help, but you are the director.
Frequently asked questions
What does NIS2 change about the responsibility of boards?
NIS2 places responsibility for cyber resilience and continuity explicitly with the board. Board members of organisations falling directly under the directive are obliged to follow a training and to discuss the subject at boardroom level. It is no longer an IT subject that can be handled at operational level. In case of non-compliance, directors can be held personally to account.
Why is a backup not the same as business continuity?
A backup is one part of business continuity. Continuity is about how long an organisation can stand still and what is needed to keep processes running, including outside IT. Think of communication, logistics, staff and legal obligations. Restoring a backup is reactive, business continuity is the whole of prevention, fallback and restart.
How do MSP and client set down risks contractually?
Under NIS2, companies falling directly under the law have to check whether their suppliers pose a risk and secure that contractually. That means agreements on the scope of service, restore times, reporting on successful backups and tests, and escalation in incidents. An explicit refusal of measures by the client should also be recorded in writing, including a signature.
What does business downtime from a cyber incident cost on average?
Research among European companies that were hacked shows a clear curve: a day of standstill costs between 2.5 and 5 per cent of annual revenue, one to one and a half weeks down costs around 25 per cent, and more than three weeks of standstill leads to bankruptcy in around 60 per cent of cases. Those figures make the business case for continuity concrete quickly in a boardroom conversation.
How do you get the continuity conversation to board level?
Translate technology into business impact. Work out what a day, a week or three weeks of standstill costs based on the revenue of the client. Use simulations: a table session in which the board lives through what happens when the whole environment goes down. That moves the conversation from backup tooling to board responsibility and makes clear why prevention is not a cost line but client retention.