A recurring service, with or without an existing scanner
An IT provider’s client wants to monitor software vulnerabilities. Inventories or SBOMs exist, but monitoring and tracking still need organising. If a scanner is already used, its results enrich the process. Who checks applicability, consolidates vendor responses and prepares decisions? Without a named owner, these tasks fall back on operations teams.
A specialist partnership can handle monitoring, assessment and case tracking. The IT provider prepares fixes and the client makes decisions. This allocation defines the starting inventories, contacts, alerts and reports each party receives to act.
Separate regulatory status from contractual expectations
NIS2 applicability depends on the company’s activity and circumstances. Implementing Regulation 2024/2690 addresses certain digital-service categories, including managed service and managed security service providers. ENISA’s guide offers implementation advice and example evidence for those categories. Verify requirements against the services actually provided.
The end client can also require tracking evidence by contract, independently of the supplier’s regulatory status. For financial clients, a service relationship and designation as a critical ICT third-party provider under DORA are distinct. Separate the IT provider’s obligations, client requests and work entrusted to CyberLifeCycle in the contract.
Sources: ENISA: NIS2 technical implementation guidance for categories covered by Regulation 2024/2690, Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexes, DORA, Regulation (EU) 2022/2554, Articles 1, 5 and 28
Fictional case: three parties, one decision chain
In this fictional example, Horizon maintains two applications for a business. The IT provider holds inventories and deployment capabilities; the client wants better dependency and support-deadline tracking. CyberLifeCycle organises component monitoring from authorised inventories. A shared library has a shared technical assessment while each application retains its instances and constraints.
CyberLifeCycle recommends an evidence-based priority and prepares actions. Horizon confirms feasibility and supplies implementation details; the client decides maintenance windows and exceptions. Unresolved questions are assigned to their owners. Before closure, the parties check that the expected evidence covers the relevant versions.
| Stage | Allocation in the example |
|---|---|
| Inventories and authorisations | Client and IT provider supply authorised information |
| Monitoring, assessment and recommendation | CyberLifeCycle monitors sources and documents vulnerabilities within the entrusted scope |
| Decisions and exceptions | The client decides within its responsibilities |
| Remediation | The IT provider or authorised teams implement fixes |
| Tracking and evidence | The parties supply agreed evidence and reassess discrepancies |
Prepare a partnership the end client can oversee
Scoping covers products, versions, available inventories, sources and reports. It defines the relationship with the end client: who receives new information, who authorises sharing and who may accept a deferral? Subcontracting or white-label arrangements can then be discussed with the relevant parties.
Plan required access, confidentiality, retention and the urgent-request workflow. Reports should show monitored scope, unknowns, actions and deadlines. Check available interfaces too: a usable export may be enough to start before considering integration with existing tools.
Assess the value for the IT provider and its client
Add recurring vulnerability management to your services with CyberLifeCycle. Client inventories or SBOMs establish the starting point; an existing scanner supplies additional findings. Clear responsibilities define each party’s work. Evaluate effort per actor and the time needed to obtain a decision or retrieve evidence.
An initial scope lets you verify data quality and reporting before extending coverage. Distinguish findings, affected instances and actions when comparing volumes. The proposal defines monitoring, assessment, priorities, alerts and reports handled by CyberLifeCycle, alongside responsibilities and service arrangements, on quotation.
Sources consulted
- Directive (EU) 2022/2555, Articles 2, 4 and 21 and annexesAccessed on 30 October 2026.
- DORA, Regulation (EU) 2022/2554, Articles 1, 5 and 28Accessed on 30 October 2026.
- ENISA: NIS2 technical implementation guidance for categories covered by Regulation 2024/2690Accessed on 30 October 2026.