--- title: "A penetration test is a “managed security service”. Now what?" description: "Regulation (EU) 2025/37 counts penetration testing, security audits and consulting as managed security services. Italy’s side has not arrived yet." url: https://csidia.com/en/notes/servizi-sicurezza-gestiti-definizione-larga-accreditamento-assente/ lang: en date: 2026-08-11 label: "Regulation" publisher: CSIDIA S.r.l. (https://csidia.com/) italiano: https://csidia.com/note-operative/servizi-sicurezza-gestiti-definizione-larga-accreditamento-assente/ --- # A penetration test is a “managed security service”. Now what? This year you bought a penetration test, a security audit, an incident response retainer, or the services of someone who went into your configurations. Two questions. Could you say which European definition that service falls under? And what do you hold today to show **how** you chose the supplier — not that you paid them, but on what basis you decided they were fit for it? If the answer to the second is "the quotation and the invoice", you are in the ordinary condition. And a European definition, in force without much noise, has made that condition uncomfortable. ## The definition, and how wide it is Regulation **(EU) 2025/37** of the European Parliament and of the Council, of 19 December 2024, amends Regulation (EU) 2019/881 — the Cybersecurity Act — "as regards managed security services". Its Article 1(2) inserts a new point **14a** into Article 2 of the 2019 regulation. Verbatim: > "'managed security service' means a service provided to a third party consisting of carrying out, or providing assistance for, activities relating to cybersecurity risk management, such as **incident handling, penetration testing, security audits and consulting**, including expert advice, related to technical support." It is worth reading slowly. It does not only cover the outsourced security operations centre most people picture: it names **four categories**, and they are the ones every organisation buys. If you have handed one of those activities to someone who is not your employee, you have bought a managed security service within the meaning of Union law. ## What actually changes The regulation does not impose an obligation to certify: it **extends the European cybersecurity certification framework** to these services. It rewrites the 2019 definitions, adding managed security services throughout — certification scheme, national scheme, European certificate, technical specification, assurance level, conformity self-assessment — and replaces Article 46, which now attests that these services meet given requirements too. ENISA's tasks are extended accordingly. Two details are worth pulling out, because they change how you read a commercial offer. The first is **conformity self-assessment**, defined as "an action carried out by a manufacturer or provider of ICT products, ICT services, ICT processes or managed security services, which evaluates whether those […] meet the requirements of a specific European cybersecurity certification scheme". It is a first-party statement, and it is legitimate — but it is a different thing from third-party verification, and in a slide deck the two look much alike. The second is the **assurance level**, which the regulation defines as a basis for confidence and then qualifies: it "indicates the level at which an ICT product, ICT service, ICT process or managed security service has been evaluated but **as such does not measure the security** of the […] managed security service concerned". A level tells you how deeply someone looked, not how secure the thing they looked at is. Article 2 closes without slack: the regulation "shall be binding in its entirety and **directly applicable** in all Member States". ## The Italian side, and the calendar National adaptation sits with **Law No. 36 of 17 March 2026**, the European delegation law, in force since 9 April 2026. **Article 16(1)** delegates the Government to adopt, "**within three months** of the entry into force of this law", one or more legislative decrees "to adapt national legislation to Regulation (EU) 2025/37 […] and to coordinate the sectoral rules in force with the European framework". Three months from 9 April gives **9 July 2026**: that is our own calculation on the text, not a date written in the provision. Paragraph 2 says precisely what it should have produced. Point (a): amend the legislation in force "and in particular **Legislative Decree No. 123 of 3 August 2022**". Point (b): amend Decree-Law No. 82 of 14 June 2021 to "specify how the functions assigned to the **National Cybersecurity Agency** are exercised in respect of the **accreditation, authorisation and delegation of bodies**". In other words: who, in Italy, says that a body is fit to assess these services. Article 16 carries no parliamentary opinion clause, so it has no extension of its own. ## Where our checking stops On Normattiva, Legislative Decree No. 123 of 3 August 2022 — the act the delegation names — shows "**text in force since 4-9-2022**": never amended since it entered into force. Had the delegation been exercised on that act, the consolidated text would show it. We have also read the summaries of the Official Gazette, General Series, up to No. 184 of 10 August 2026, published yesterday morning, and the most recent legislative decree remains No. 141 of 5 August. Where we stop, precisely: **we have not run an exhaustive search across every legislative vehicle**. We can state that the act the delegation names has not been amended, and that the three-month term, by our calculation, ran out on 9 July. This is a reading of primary sources, not legal advice. It is not an isolated case. Yesterday we wrote about [the delegation under Article 15 of the same law](https://csidia.com/en/notes/cra-capo-quarto-autorita-di-notifica-delega), the one on the Cyber Resilience Act, whose Chapter IV has applied since 11 June 2026 while the designation of the National Cybersecurity Agency as notifying authority is still to come. Two delegations in the same law, two pieces of the same European framework, neither of them delivered. [See the service](https://csidia.com/en/solutions/document-compliance) · [Talk to an engineer](https://csidia.com/en/contact) ## Why it changes less than you think for the buyer This is the point. What is missing is the thing that would give you **a handle**: a national accreditation to cite in a tender, a list to consult. It is not there, and you cannot point to it. But nothing stops you from writing into the contract what the supplier must demonstrate, and keeping the evidence: which of the four activities they actually provide, which schemes or standards they claim to meet, whether that claim is a **self-assessment** or third-party verification — and in the latter case, who issued it and when. Set this up now and the answer is ready when the scheme arrives. Wait, and the selection gets redone from scratch — while an NIS entity gets the same question anyway on [supply chain security](https://csidia.com/en/notes/nis2-12-ottobre-2026-un-documento-non-una-data), where nobody asks whether the scheme existed yet. ## Sources - [Regulation (EU) 2025/37 — amending Regulation (EU) 2019/881 as regards managed security services](https://eur-lex.europa.eu/eli/reg/2025/37/oj) - [Regulation (EU) 2019/881 — the Cybersecurity Act](https://eur-lex.europa.eu/eli/reg/2019/881/oj) - [Normattiva — Law No. 36 of 17 March 2026, Article 16](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:legge:2026-03-17;36) - [Normattiva — Legislative Decree No. 123 of 3 August 2022](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2022-08-03;123) Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/servizi-sicurezza-gestiti-definizione-larga-accreditamento-assente/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com