Digital Sovereignty

The EU Will Certify the Call You Make After the Breach

ENISA opened consultation on the EUMSS certification scheme on 24 July. It covers one of the five services the law defines, and comments close on 13 September.

Digital SovereigntyBy Servola Tech Desk2026-07-314 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

The EU Will Certify the Call You Make After the Breach

Key takeaways

ENISA's draft EU certification scheme for managed security services covers one of the five activities the amended Cybersecurity Act defines as managed security services, and the one it covers is incident response. The monitoring contract you pay for every month sits outside version one.
The consultation closes on 13 September 2026. If you buy managed detection or a SOC service anywhere in the EU, this is the window in which the scope of the label that will appear in your next tender is still being decided.
The horizontal baseline requirements are identical at all three assurance levels, so basic, substantial and high tell you about the depth of the incident response work, not about the platform your provider runs.
Providers serving the EU Cybersecurity Reserve must hold EUMSS certification within two years of the scheme taking effect. For everyone else it stays voluntary, which is how a label becomes a tender requirement without ever becoming a legal one.

A draft, a September date, and one service profile

On 24 July ENISA put the draft EU Managed Security Services scheme, known as EUMSS, out for public comment. Juhan Lepassaar, the agency's executive director, framed the purpose in a single line: "Common baselines can guarantee a level of confidence in services offered." The consultation runs through an EU Survey portal and closes on 13 September 2026.

The legal basis is Article 48(1) of the Cybersecurity Act as amended by Regulation (EU) 2025/37, which the Commission adopted on 15 January 2025 specifically to allow European certification of services rather than only products. The Commission asked ENISA to build the candidate scheme on 25 April 2025. ENISA opened a call for experts on 25 June 2025, and the dedicated ad hoc working group held its kick-off on 13 October 2025.

What emerged nine months later is narrower than the mandate. The present draft addresses the Incident Management Lifecycle vertical, and within it a single service profile: Incident Response.

The five the law names, the one the draft covers

The amended Act's definition of managed security services reaches five activities: security monitoring and incident detection, incident response, penetration testing, security audits, and cybersecurity consultancy. The draft scheme certifies the second of those. The other four are not excluded in principle, because the structure is explicitly built to take further service profiles, but they are not in version one.

That ordering deserves a moment. Incident response is the service you invoke after something has already gone wrong. Security monitoring and incident detection is the service you pay for every month so that it does not. A provider will shortly be able to say, accurately, that it holds an EU certificate for managed security services while the continuous part of its contract with you has never been assessed under the scheme.

This is less a criticism of the sequencing than a warning about how the mark will be read. Certification marks travel further and faster than their scope statements.

Why basic and high say nothing about the platform

The scheme uses a layered design. A horizontal layer sets baseline requirements that apply to every managed security service certified under it, and a vertical layer carries the requirements specific to each service profile. The horizontal baseline covers secure service and platform design, deployment and transition management, availability and continuity management, operational service management, and continuous improvement and technology maintenance.

Three assurance levels exist: basic, substantial and high. The detail worth extracting from the draft is that those horizontal baseline requirements are a mandatory prerequisite for every certified service profile and are the same at all three levels. The level varies the vertical layer, not the foundation. Read plainly, a provider certified at high has demonstrated more about how it runs an incident response engagement, and exactly as much as a basic provider about how its platform is designed and kept available.

Eighteen months to a draft, and the anchor buyer is Brussels

Count the calendar. From the legal basis on 15 January 2025 to a draft open for comment on 24 July 2026 is eighteen months. Comments close on 13 September. Adoption follows. Providers supplying the EU Cybersecurity Reserve then have two years from implementation in which to hold the certificate.

That last clause is the mechanism, and it is worth naming precisely. For the private market the scheme is voluntary. For providers supplying the EU's own reserve of incident response capacity it is not. The EU has made itself the anchor buyer and left the mark optional for everyone else, which is the standard route by which a voluntary scheme becomes a de facto tender requirement without anyone legislating one. Expect EUMSS to appear as a scoring line in public procurement well before it is comprehensive.

What to ask your provider before 13 September

Three things are worth settling now. First, ask which service profile your provider intends to certify against, and whether the service you actually buy sits inside it. If your contract is monitoring and detection, the honest answer today is that it does not. Second, ask which assurance level they will seek, and make them explain what that changes, given that the baseline does not move between levels.

Third, treat the consultation as a live input rather than a notice. Comments close on 13 September and the scope of version one is exactly what is open. Buyers are consistently underrepresented in scheme consultations compared with providers and conformity assessment bodies. In Britain the NCSC's Cyber Incident Response scheme already assures this same work, so a UK provider selling into the EU will hold one mark at home and need another for European tenders. Under NIS2 the supply chain obligation already sits with you, which makes the scope of this scheme something you cannot delegate to a vendor.

Frequently asked questions

What is the EUMSS scheme and when does the consultation close?

EUMSS is the candidate European cybersecurity certification scheme for managed security services. ENISA opened it for public comment on 24 July 2026 and the consultation closes on 13 September 2026, with submissions through an EU Survey portal. Its legal basis is Article 48(1) of the Cybersecurity Act as amended by Regulation (EU) 2025/37, adopted on 15 January 2025.

Does EUMSS cover security monitoring and detection?

Not in this version. The amended Act defines managed security services across five activities: security monitoring and incident detection, incident response, penetration testing, security audits and cybersecurity consultancy. The present draft addresses the Incident Management Lifecycle vertical and, within it, the Incident Response service profile only. The scheme is designed to add further service profiles later.

Will EUMSS certification be mandatory for my provider?

For the private market it is voluntary. Providers delivering services under the EU Cybersecurity Reserve must be EUMSS-certified within two years of the scheme's implementation. That combination tends to make a voluntary mark a practical requirement in public procurement, so treat it as a tender factor rather than a legal obligation.

A certificate is only as useful as the sentence that says what it covers. EUMSS will be a real improvement on twenty-seven national approaches to assuring the same work, and its first version assures the part of the service you reach for after the damage is done. Buy on the scope statement, not on the mark.

ENISAEUMSSCybersecurity ActManaged security servicesIncident responseNIS2EU Cybersecurity Reserve

Issuing an Agent an Identity Is the Cheap Half

Okta agreed to buy Permiso Security on 30 July, reportedly for just under 200 million dollars. The second agent-identity acquisition in four days.

5 min read

Cybersecurity

The Cisco Bug Under Attack Scored Just 5.3

Cisco scored its Firewall Management Center credential flaw 5.3 and rated it High on the same page. CISA gave it three days. What that gap does to patch triage.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles