Europe just put a floor under outsourced security.
The organisations being measured are the ones who sold capability nobody could check.
On 24 July 2026, ENISA opened a public consultation on a draft candidate certification scheme for EU Managed Security Services, known as EUMSS, and the window closed on 13 September 2026.
The European Commission requested the scheme under Article 48(1) of the Cybersecurity Act, and ENISA developed it with an Ad Hoc Working Group on Managed Security Services Certification that started work in October 2025.
The call for experts to join that group went out in June 2025, which makes this consultation the first public output of work that ran quietly until now.
ENISA's stated reason for building it is the one that should interest anyone who buys or sells security services: investment keeps flowing toward technology and outsourcing rather than internal teams, while the requirements placed on the providers receiving that money differ from one Member State to the next.
Nothing about the scheme is settled yet, and the consultation document is the version that will change most before adoption.
The EU is converting trust in managed security from a procurement judgement into a certificate, which shifts the argument from what a provider can do to what a provider can prove.
The draft is deliberate about its layers, and the two layers carry different kinds of work.
The scheme builds on existing European certification practices and assessment methodologies rather than starting from a blank page.
ENISA frames the draft as support for service provision across borders and Union level crisis response, which is the part with teeth for a provider selling into several Member States at once.
1. The horizontal layer is where the real work sits.
Across all three assurance levels, basic, substantial and high, a certified service has to clear one common baseline covering secure service and platform design, deployment and transition management, availability and continuity management, operational service management, and continuous improvement.
That baseline is a mandatory prerequisite for every certified service profile, so it lands on a narrow monitoring service and on a fully outsourced security function in the same way.
The five domains do not change with the assurance level a provider claims, which means claiming the high level buys no exemption from any of them.
Map your service catalogue against those five domains before an assessor does, and start collecting artefacts rather than intentions.
Design, transition and continuity sit with engineering, while service management and continuous improvement sit with operations, and certification evidence has to come from both.
Continuity requirements get uncomfortable as soon as a service depends on firmware and devices that nobody inside the contract owns.
Secure service and platform design is also where the quiet failures accumulate, the same pattern that keeps showing up in keys leaking out of developer environments.
Assessors will ask how each domain is operated, reviewed and updated, which makes this a documentation problem before it becomes a technology problem.
For a provider with one productised service that is a few weeks of work, while a provider selling ten bespoke engagements under one brand faces a rescoping exercise first.
2. The vertical layer shows where Brussels chose to start.
The first version of the scheme covers a single vertical, the Incident Management Lifecycle, and inside that vertical only the Incident Response service profile.
Because the draft calls this the present version, the vertical list reads as a starting point rather than a ceiling.
If incident response is not already a service line you can scope, price, staff and evidence on its own, that gap is what certification will expose first.
Certification is priced per scope, so a provider that cannot draw a clean boundary around a service ends up paying to prove everything adjacent to it.
Incident response is also the profile the EU Cybersecurity Reserve expects to draw capacity from during a crisis.
3. The reserve supplies the deadline, and buyers supply the pressure.
Providers delivering services under the EU Cybersecurity Reserve must be certified under EUMSS within two years of the scheme being in place, which turns certification into a market access condition for that group rather than a differentiator.
That clock starts when the scheme is in force, not when the draft is agreed, so the preparation time available is longer than the announcement suggests and shorter than most providers will use.
Buyers do not have to wait for that mechanism to reach them.
ENISA published a Managed Security Services Market Analysis in June 2025 covering both the demand and the supply side, which gives a buyer something to compare quotes against beyond the price on the page.
Ask every incumbent provider for its EUMSS status, the assurance level it intends to claim, and its timeline, and read a vague answer as a statement about the roadmap.
"Common baselines can guarantee a level of confidence in services offered," said ENISA Executive Director Juhan Lepassaar, adding that the scheme can offer Member States trust in services that reinforce prevention and response capabilities, especially in the context of the EU Cybersecurity Reserve.
A certificate describes the scope it covers and the level at which it was assessed, so the contract still carries the risk the scheme does not measure.
For two decades the buying question was who has done this work before, and what did it cost.
The next question is who can produce a certificate, at which assurance level, and against which service profile.
If your provider's incident response is certified to a published baseline, what would you still demand evidence of that the scheme never asks for?