Who is in scope, how your assurance level is decided, what the 218 DNSC controls and the maturity self-assessment require, and which deadlines apply — in plain English, with links to the official texts.
Romania transposed the NIS2 Directive (EU) 2022/2555 through Emergency Ordinance (OUG) no. 155/2024, published in the Official Gazette no. 1278 of 30 December 2024 and amended by Law no. 124/2025. The National Cyber Security Directorate (DNSC) is the competent authority.
Annex 1 (high criticality): energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space.
Annex 2 (other critical sectors): postal and courier services, waste management, chemicals, food, manufacturing (e.g. medical devices, electronics, electrical equipment, machinery, vehicles), digital providers (online marketplaces, search engines, social networks), research.
Size follows the SME definitions of Law no. 346/2004 (OUG 155/2024, Art. 8): a medium enterprise has 50–249 employees and a turnover of up to €50 million or total assets of up to €43 million; above that it is a large enterprise. Micro and small companies are generally outside NIS2 unless they fall into one of the size-independent categories.
Not directly in scope? If your clients are NIS2 entities, expect their supplier-security requirements (contracts, questionnaires, audits) to reach you anyway.
From the date the obligations apply to you (OUG 155/2024, Art. 18(2)). DNSC then issues a decision identifying you as an essential or important entity.
Using the methodology of DNSC Order 2/2025 (Art. 18(6)). This sets your assurance level — see section 3.
Under the methodology of DNSC Order 1/2026, done exclusively on DNSC's NIS2@RO platform (Art. 18(7) and Art. 12(4)).
A plan of measures for the deficiencies found, endorsed by management (Art. 12(5)).
Essential and important entities are audited by DNSC-certified auditors, with a frequency set by DNSC order according to the risk level (Art. 11(5)).
Management bodies must also follow accredited cybersecurity training (Art. 14(2), as amended by Law 124/2025).
Being an essential or important entity (section 1) is your legal category. Which controls you must implement is a separate question: it depends on your assurance level, which comes from the risk-level evaluation in DNSC Order 2/2025, Annex 2. DNSC Order 1/2026 then requires you to implement the controls for that level (Order 1/2026, Art. IV).
Your entity score is the sum of 25 risk values — 5 types of threat actor × 5 categories of attack. Each risk value is:
| Entity score | Assurance level | Controls to implement |
|---|---|---|
| 0 – 99 | Basic | 34 |
| 100 – 199 | Important | 133 |
| 200 and above | Essential | 218 |
The evaluation is done with DNSC's tool or the NIS2@RO platform and validated by DNSC; it must be recalculated periodically and when your situation changes. Banking and financial-market-infrastructure entities subject to DORA (Regulation (EU) 2022/2554) do not perform it (Order 2/2025, Annex 2, Art. 6, as amended by Order 1/2026, Art. V).
Tip: because size multiplies every risk value, the same sector can land on different levels — a small company may be Basic while a large one in the same sector is Essential. Getting the evaluation right matters: it decides whether you face 34 or 218 controls.
DNSC Order no. 1/2026 (Official Gazette no. 712 and 712 bis, 27 August 2026) approves a catalogue of cybersecurity risk-management measures and the methodology for self-assessing their maturity. The controls follow the six functions of the NIST Cybersecurity Framework 2.0 — Govern, Identify, Protect, Detect, Respond, Recover — and the three levels are cumulative.
| Level | Controls | Target total maturity | Additional condition |
|---|---|---|---|
| Basic | 34 | ≥ 2.5 | Each key measure ≥ 2.5 |
| Important | 133 | ≥ 3.0 | Each key measure ≥ 3 |
| Essential | 218 | ≥ 3.5 | Each key measure ≥ 3 and every category ≥ 3 |
Every applicable control gets two scores from 1 (Initial) to 5 (Optimizing) — one for documentation maturity and one for implementation maturity — and each score must be justified in writing. Scores roll up from controls to subcategories, categories and a total score, which is compared with the target for your level. Falling short of the targets means a remediation plan.
The practical catch: “we do it” is not enough. A control scores well only when it is both formally documented and consistently implemented, with evidence — which is exactly where most self-assessments lose points.
The NIS2 Directive requires maximum fines of at least €10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and €7 million or 1.4% for important entities (Directive (EU) 2022/2555, Art. 34). Romania's ordinance sets the national penalties. Management bodies approve the cybersecurity measures, oversee their implementation and must be trained.
ArxIT Fortis is not a certification body and does not perform the official DNSC audit. We help you get ready for it — with practical solutions, not just a report.
Confirm whether and how NIS2 applies, and prepare your risk-level evaluation.
Every applicable DNSC control scored for documentation and implementation in our client portal.
Prioritised, practical solutions for every gap — MFA, backups, logging, segmentation, policies — with implementation support where you want it.
Justifications and evidence ready for your NIS2@RO self-assessment and the audit.
Usually important: essential status for Annex 1 sectors applies to large enterprises (OUG 155/2024, Art. 5(2)), unless you fall into a size-independent category. DNSC's decision confirms it.
No. Your legal category and your assurance level are different. The level comes from your risk-level evaluation score (Order 2/2025): 0–99 Basic, 100–199 Important, 200+ Essential.
The official self-assessment is done exclusively on DNSC's NIS2@RO platform; DNSC provides a downloadable tool only as a fallback if the platform is unavailable. Spreadsheets are fine for preparing — not for submitting.
No. Official audits are performed by DNSC-certified auditors. We prepare you: scope and level check, gap assessment, practical remediation guidance and an evidence pack ready for the self-assessment and audit.
This page is general information, last checked against the texts above on 14 October 2026. It is not legal advice; for decisions about your obligations, rely on the official texts and DNSC.