- Certification Scheme
- EUMSS
Understanding the context

The definition of ‘managed security services’ included in the amendment of the Cybersecurity Act covers areas such as incident response, penetration testing, security audits and consultancy.
ENISA started working on the topic by launching a feasibility study in June 2024. The European agency for cybersecurity establishes a dedicated working group comprising Member States and assigned experts to assess the current state of play of managed security services. This study examines various aspects of the market, including :
- The definition of 'Managed Security Services' in EU texts and the references to such activities in different legislations.
- The market offering
- International standards addressing the different activities
- Existing EU national schemes and different approaches to the assessment of Managed Security Services
- A proposal for a strategy to develop an EU cybersecurity certification scheme
This preliminary work served as an introduction to the topic for the official AHWG, launched in October 2025, to develop a draft candidate scheme.
Timeline
- Receiving the Request
In line with the amended Cybersecurity Act (EU 2025/37), on 25 April 2025 the European Commission has requested ENISA to develop of a candidate European cybersecurity certification scheme on Managed Security Services.
- Identifying Experts
After answering to the European Commission with a positive answer, ENISA launched an open call for expression of interests for experts to join the ENISA Ad-Hoc Working group on the certification of EUMSS on June 25,2025.
Following an assessment of the applications by ENISA, the members of the Ad Hoc Working Group were appointed by the Executive Director of ENISA.
- Ad Hoc Working Group
The kick-off meeting of the ENISA Ad Hoc Working Group on EUMSS took place on 13 October 2025. The group is expected to convene on a frequent basis, including a minimum of 4 plenaries per year. However, more frequent meetings of the different Thematic Groups established to support dedicated work streams might be taking place. Most meetings take place online.