NIS2 compliance, from registration with the Romanian National Cyber Security Directorate (DNSC) to your first audit.
We help you find out whether your company or public body falls under NIS2, register correctly with DNSC and implement the technical and organisational measures the law requires. Not just paperwork: secured networks, tested backups and real monitoring.
WHAT THE LAW REQUIRES, IN BRIEF
Registration with DNSC
within 30 days of meeting the criteria
Risk management measures
technical, operational and organisational (Art. 21)
Incident reporting
early warning within 24h, notification within 72h, final report within 1 month
Management accountability
senior management approves the measures and is accountable for them
The law that makes cybersecurity a duty of management, not just of IT.
The NIS2 Directive was transposed in Romania by Government Emergency Ordinance (OUG) 155/2024, approved by Law 124/2025. It greatly extends the list of organisations required to protect their networks and information systems: from hospitals, town halls and utilities to manufacturers, transport operators, courier companies and IT service providers. The competent authority is DNSC.
Official text of the NIS2 Directive (European Commission) (opens in a new tab)More sectors
18 sectors, split into “sectors of high criticality” (Annex I) and “other critical sectors” (Annex II).
Concrete measures
Risk analysis, backup and business continuity, access control and MFA, vulnerability management, supply chain security, training.
Short deadlines
Significant incidents must be reported to DNSC within hours, not weeks. Without a plan in place, the deadlines cannot be met.
Management is accountable
Management bodies approve the measures, oversee their implementation and must attend security training.
Find out in 30 seconds whether NIS2 applies to your organisation.
The general rule: NIS2 covers entities in the sectors listed in the annexes that are at least medium-sized enterprises, meaning 50 or more employees, or an annual turnover and balance sheet above EUR 10 million.
There are exceptions to the size criterion: some digital and communications service providers, public administration entities, and entities designated directly by DNSC. The result shown here is indicative; the final classification depends on your actual activity.
Annex I
Energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, managed ICT services (B2B), public administration, space.
Annex II
Postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles), digital providers, research.
Choose your sector and size to see the result.
INDICATIVE RESULT
Request an exact assessmentRegistration is not a formality. It is the first thing DNSC checks.
It is a legal obligation
Entities that meet the criteria must register with DNSC within 30 days. Failing to register is itself a sanctionable offence.
It triggers the other obligations
Registration is followed by a self-assessment of your maturity level, a plan of measures and the appointment of the person responsible for network and information system security.
It puts you on the support map
Registered entities receive alerts and can report incidents through the official channel, with support from DNSC’s response teams.
It counts during an inspection
A registered organisation with documented measures being implemented shows due diligence. One that has not registered starts from the weakest position.
Fines are only part of the cost.
ESSENTIAL ENTITIES
up to EUR 10m
or 2% of total worldwide annual turnover, whichever is higher
IMPORTANT ENTITIES
up to EUR 7m
or 1.4% of total worldwide annual turnover, whichever is higher
GDPR, IF PERSONAL DATA IS AFFECTED
up to EUR 20m
or 4% of turnover, imposed separately by ANSPDCP (the Romanian data protection authority)
Measures ordered by DNSC — warnings, binding instructions with deadlines, security audits imposed at the entity’s expense.
Liability of management — for essential entities, the law even provides for a temporary ban on holding management positions.
Contracts and tenders — clients and contracting authorities increasingly ask suppliers for proof of security measures.
Monday morning, the servers are encrypted. What happens next?
A ransomware attack does not just stop your operations. Under NIS2 it also starts a reporting clock. If personal data is affected, a second clock starts, towards ANSPDCP.
- T+0
Detection
Isolate the affected systems, preserve evidence, activate the response plan.
- ≤ 24h
Early warning to DNSC
Including whether the incident appears to be caused by unlawful action or has a cross-border impact.
- ≤ 72h
Notification to DNSC and ANSPDCP
Initial assessment of severity and impact, indicators of compromise. ANSPDCP, if personal data is involved.
- ≤ 1 month
Final report
Root cause, measures applied and impact. An intermediate report, if DNSC requests one.
Unprepared
- The backup was on the same network and was encrypted along with the servers.
- The backups had never been tested by restoring them.
- Nobody knows who notifies DNSC, what information is sent or by when.
- Operations stop for days or weeks, and paying the ransom does not guarantee the data comes back.
With NIS2 measures in place
- Isolated backup, with offline or immutable copies and regularly tested restores.
- Segmented network, MFA and controlled privileged accounts that limit the spread.
- Monitoring and alerting, so the attack is stopped in its early stages.
- An incident response procedure and notification templates prepared in advance.
Consultancy and implementation, from the same team.
We work with town halls, healthcare providers and companies. Beyond the documentation, we actually configure the firewalls, backups and monitoring.
Classification and DNSC registration
We establish whether you are an essential or important entity and prepare your registration file.
Risk analysis and gap analysis
Asset inventory, risk assessment and comparison with the Art. 21 requirements, with a prioritised plan of measures.
Policies and procedures
Security policy, incident management, BCP/DRP, backup, access control, suppliers, training.
Technical implementation
FortiGate and MikroTik hardening, segmentation, VPN, MFA, isolated backup, vulnerability and patch management.
Monitoring and incident response
SOC monitoring with Wazuh, triage and investigation, support with notifications to DNSC and ANSPDCP.
Staff and management training
Cyber hygiene for employees and the mandatory training for management bodies.
// HOW WE WORK TOGETHER
- STEP 1
Initial call
We get to know your activity and infrastructure.
- STEP 2
Assessment
Classification, risk analysis and gap analysis.
- STEP 3
Implementation
Technical measures and documentation.
- STEP 4
Maintenance
Monitoring, restore tests, annual review.
What our clients ask us most often
As a rule, yes, provided your turnover and balance sheet are also below the thresholds. There are exceptions, however: certain digital and communications service providers, public administration, and entities designated by DNSC. And even if you are not directly in scope, your NIS2 clients may require security measures from you by contract.
No. The law requires measures that are applied and effective, and their effectiveness must be assessed regularly. The documents must describe what actually happens in your infrastructure.
An incident that has caused or can cause severe operational disruption or financial loss, or that affects other people by causing considerable material or non-material damage. Ransomware that stops your services almost always falls into this category.
It depends on the size of your organisation and the level you start from. After the initial assessment you receive a prioritised plan of measures and a detailed, phased quote.
They are separate obligations. An incident involving personal data may require both reporting to DNSC and notifying ANSPDCP within 72 hours, and the penalties can be cumulative.
Find out where you stand on NIS2.
Leave us a few details and we will get back to you to discuss your classification and the next steps.
The information on this page is general in nature and does not constitute legal advice. Deadlines and procedures apply in accordance with Government Emergency Ordinance (OUG) 155/2024, approved by Law 124/2025, and the DNSC orders in force.