Channel could profit from NIS2 services boom as just 16 per cent of firms comply - research

Leading causes of non-compliance such as budget constraints and lack of guidance on implementation are practical rather than strategic, opening doors for partners

The channel could be poised for a fresh revenue stream as UK businesses struggle to comply with NIS2, fuelling demand for partner-led compliance services, a new study has found.

According to research from CyberSmart, a provider of cyber risk management solutions for MSPs and SMEs, just 16 per cent of businesses required to comply with the EU-wide cybersecurity legislation consider themselves fully compliant, despite the October 2024 deadline.

The CyberSmart NIS2 Survey heard from 670 business leaders across the UK and EU and found that the compliance shortfall could spark a managed services opportunity.

Data shows the primary barriers cited by organisations are practical rather than strategic: budget constraints (20 per cent), lack of guidance on implementation (16 per cent) and insufficient internal expertise (11 per cent).

The findings suggest MSPs are well positioned to fill the gap, pointing to a growing reliance on external providers to operationalise compliance requirements.

“Our research found that only 16 per cent feel fully compliant, despite growing board-level ownership, real budget allocation and a clear belief that compliance matters. It may look like organisations are ignoring NIS2, but in reality, they’re struggling to implement it,” said Jamie Akhtar, CEO and co-founder of CyberSmart.

“There’s a clear gap between what the regulation requires and the internal resources most businesses have available. That’s where MSPs have a real opportunity to step in and deliver ongoing compliance support.”

Shift from projects to recurring compliance services

The findings also highlight a broader shift toward long-term, managed compliance services.

Businesses are increasingly navigating multiple overlapping frameworks, including NIS2, DORA, the EU Cybersecurity Act and GDPR.

As a result, 42 per cent of respondents say there are too many regulations to manage, 35 per cent cite significant overlap and 27 per cent believe there is too much emphasis on compliance requirements overall.

This growing complexity is accelerating demand for partners who can provide continuous, multi-framework support rather than one-off compliance projects, said CyberSmart.

“NIS2 is part of a wider trend where compliance is becoming continuous, not a one-time exercise,” Akhtar added.

“MSPs that can package compliance into a repeatable, managed service will be best placed to capitalise on this shift.”