Who it’s for
You run, look after or secure your customers’ IT. This makes you regulated yourself: as a managed service provider under NIS2, as an ICT service provider to your financial customers under DORA and as a processor under the GDPR. Complass brings your own obligations and the evidence your customers ask for together in one account.
Through remote maintenance and admin access, an attacker who reaches a service provider reaches many customers at once. This is why NIS2 names managed service providers explicitly.
Banks require DORA contract clauses, industrial customers NIS2 evidence, all of them a data processing agreement. The answers repeat themselves, the forms do not.
An incident on your side can trigger a NIS2 notification, a GDPR data breach and a notice to your financial customers at the same time, each with its own deadline.
Managed service providers and managed security service providers belong to digital infrastructure under the German BSI Act. From medium size onwards you are an important entity, from 250 employees or more than EUR 50 million turnover and EUR 43 million balance sheet total an essential entity.
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Operation, monitoring and maintenance of your customers’ IT, often with remote access to many networks.
SOC, vulnerability scans and incident response as a service, with particularly high expectations of your own security.
Procurement, set-up and support of IT for SMEs. Whether you count as an MSP depends on whether you install, manage, operate or maintain your customers’ systems.
Your customers have to include you in their register of information under DORA and align your contracts with it.
Phases, templates and Statement of Applicability for your company. You document a measure once and use it for both frameworks.
More about this featureA phase of its own in the DORA framework with a requirements matrix of your financial customers, details for their register of information and a template for incident notices.
Record an incident, check reporting obligations under NIS2 and the GDPR and track the deadlines with a countdown.
More about this featureWith the partner portal you look after your customers’ accounts from one overview, with approval and logging on the customer’s side.
We are preparing an industry template of its own for service providers to the financial sector. You can already use the included frameworks individually today.
coming soon
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Packages marked “coming soon” or “in preparation” cannot be booked yet. We will state the price and scope once a package can be booked. We are happy to show you the included frameworks and features in a demo already, as far as they are available.
That depends on your services. Managed service providers deliver services related to the installation, management, operation or maintenance of their customers’ ICT products, networks, infrastructure or applications, through assistance or active administration on site or remotely (Art. 6(39) NIS2 Directive). The mere sale of hardware or licences is not included. The applicability check helps you classify your company.
Usually not. DORA applies to financial entities. They have to structure their contracts with ICT service providers under Art. 30 DORA and pass the requirements on to you this way. Only providers designated as critical by the European supervisory authorities are supervised directly (Art. 31 DORA).
Yes. With the partner portal you switch between your customers with one click; alternatively your customers invite you into their own account as a user with suitable rights.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
