NIS2 in Romania, step by step: DNSC registration, deadlines and documents

Anyone who takes NIS2 seriously in Romania runs into a problem that has nothing to do with technology: it is not obvious in which order the steps come, which deadlines run, and which documents must exist at the end. Romanian law (Government Emergency Ordinance 155/2024, approved by Law 124/2025) answers all of it, but the answers are scattered across a dozen articles and three orders of the national cybersecurity authority, written the way laws are written.

This article puts them in order and translates them. The text is plain English; at the end of every step there is a line called „Where the law says it”, so you can check for yourself or hand it to counsel. This matters especially if you run a group with a Romanian subsidiary, or if you supply Romanian companies: the obligations below land on the Romanian legal entity, and increasingly on its suppliers through contracts.

The road in one sentence: find out whether you are in scope → notify the DNSC → receive the decision → calculate your risk level → grade yourself → plan what is missing → fix, get audited, repeat yearly. And incident reporting has to work from day one.

A short glossary

• Entity = what the law calls your company. Below I say „company”.
• Essential / important entity = the two categories the law can put you in. „Essential” means more obligations and higher fines.
• DNSC = Directoratul Național de Securitate Cibernetică, Romania’s national cybersecurity authority. It keeps the register and issues the fines.
• Notification = the formal notice by which you tell the DNSC „we exist and we are in scope”. It is not an application, it is an obligation.
• Management bodies = the company’s leaders: the administrators and executive directors. The law says expressly that the general meeting of shareholders and the board of directors are not included.
• Contravention = an administrative offence punished with a fine, not a crime.
• PNRISC = the national platform on which incidents are reported.

Step 0. Are you in scope?

Two conditions, both at once: sector and size.

Sector. The law has two lists. List 1 (Annex 1): energy, transport, banking, health, water, digital infrastructure, ICT service management for other businesses, public administration, space. List 2 (Annex 2): postal and courier services, waste, chemicals, food, manufacturing, digital providers, research. The base rule: the law applies to companies established and registered in Romania. For digital service providers (cloud, data centres, managed services, DNS, online marketplaces and others) what matters is where their main establishment in the EU is, meaning where the cybersecurity decisions are predominantly taken.

Size. Calculated under the SME rules (Law 346/2004): headcount and turnover, including linked companies in the group. So a 40-person company owned by a large group can be „large” in the eyes of the law. Then:

• a large company in a List 1 sector → essential entity;
• a medium or large company in List 1 or 2 that is not essential → important entity;
• some categories are in scope regardless of size: DNS providers, TLD registries, qualified trust service providers, critical entities, and companies the DNSC identifies as the sole provider of a service society depends on;
• special case: medium-sized managed security service providers are essential, not important.

The official test is done with the NIS2@RO Tool, an Excel file published on dnsc.ro, which has a „preliminary assessment” section.

Where the law says it: GEO 155/2024, art. 5 (1), (2) and (4), art. 6 (1), art. 7 (1), (3) and (5), art. 8, art. 9; Annexes 1 and 2.

The contract route: how you end up in NIS2 without being in a „classic” sector

This is where most IT companies get caught. You are not in energy, you are not a bank, you are not a hospital. But you have maintenance contracts: you administer a client’s servers, keep their network running, do their updates, hold administrator access to their systems. For the law, that makes you a managed service provider, and „ICT service management (business-to-business)” is a List 1 sector.

The definition, translated: a managed service provider is a company that installs, manages, operates or maintains ICT products, networks, infrastructure, applications or any other network and information systems of someone else, through assistance or active administration, either on the customer’s premises or remotely. If on top of that you do security monitoring, incident response or other activities related to cybersecurity risk management, you are a managed security service provider, a category treated even more strictly.

What that means in practice, in our reading:

• A software project delivered „turnkey”, without you operating the system afterwards, is not a managed service.
• A maintenance or support contract under which you hold permanent administrator access and keep the client’s system running is a managed service, whatever the client’s sector.
• The client’s sector does not decide your scoping. What you do, under the contract, does.

Once in the sector, the size rule applies: large → essential; medium → important; and if you provide managed security services and you are medium-sized → essential. Size, again, at group level.

One more thing companies in this category find out late: on top of Romanian law, an EU regulation applies to them directly, Implementing Regulation (EU) 2024/2690, which spells out what a „significant incident” means for them. More on that in the incident section.

There is also the reverse sense of „transfer by contract”: even if you are not in scope, your clients who are must take into account the security practices of every supplier, and the DNSC can require them to provide data about the companies that manage their IT. That is how NIS2 requirements reach you through questionnaires and clauses even without being registered. The company that already has them done answers in two days; the other one loses the client at the next renewal.

Where the law says it: GEO 155/2024, Annex 1 sector 9 „ICT service management (business-to-business)”, art. 5 (2) and (4), art. 6 (1), art. 7 (3), art. 11 (8) and (9); Directive (EU) 2022/2555, art. 6 points 39 and 40 (definitions of managed service provider and managed security service provider, transposed by GEO 155/2024); Regulation (EU) 2024/2690, art. 1.

Step 1. What to prepare before notifying the DNSC

The form asks for things you cannot improvise. The law lists them:

• company name, registered office address and up-to-date contact details (e-mail, phone);
• other establishments in the EU, if any;
• a permanent contact channel and the person who monitors it (the law requires you to be reachable at all times on the details declared);
• a representative in the EU, if the company is not established in the EU;
• sector, subsector and type of entity, per the law’s lists;
• the EU member states where you have customers;
• public IP address ranges (mandatory for digital service providers, „where applicable” for everyone else);
• proof that you meet the essential or important criteria (in practice: size and sector, with documents).

Three decisions are worth taking before you open the form, because they appear in it or right after: who is the permanent contact person and how you cover weekends; who will be the security officer (the law has conditions for that role, see step 7); and who signs. The form is signed by the company’s legal representative, and if you submit it by e-mail the signature must be a qualified electronic signature (certificate-based, not a picture of a signature). If the administrator does not hold such a certificate, either they obtain one, or you file on paper, hand-signed, at the DNSC’s offices.

Where the law says it: GEO 155/2024, art. 18 (3) and (11); dnsc.ro page „Înregistrare entități” (entity registration).

Step 2. Notifying the DNSC

The filing rules are published on the DNSC page and leave little room for interpretation:

1. The form is generated only from the NIS2@RO Platform or, if the platform is unavailable, from the NIS2@RO Tool (the Excel file, version 2.3), used locally. An English version of the tool exists purely to help you understand what is asked; the form is submitted to the DNSC in Romanian.
2. The completed form is saved as PDF and signed by the legal representative: qualified electronic signature for e-mail, handwritten for paper.
3. It is sent to [email protected] or filed physically at the DNSC’s offices, together with supporting documents where applicable.
4. If you could not create an account on the platform because it was unavailable, you must create one when it becomes available.
5. For questions about scoping, changes or removal from the register there is [email protected], and the law says expressly that you may ask the DNSC for assistance.

About the deadline, plainly: the law gave 30 days from its entry into force (it was published in the Official Gazette no. 1332 of 31 December 2024) or from the date you started meeting the conditions. For almost every company, that deadline is long gone. Failing to register is a separate fine, and the DNSC can start the procedure on its own initiative or following a complaint from anyone.

Where the law says it: GEO 155/2024, art. 18 (2), (12), (15) and (17); art. 50 (1); art. 60 (1) letter o) as amended by Law 124/2025; dnsc.ro page „Înregistrare entități”.

Step 3. The DNSC decision and the clock that starts

After receiving the notification, the DNSC issues a decision entering you in the register: within 60 days for essential entities and 150 days for important ones. From the day you receive the decision, all the deadlines below start running. Think of it as Day 0.

The register also brings a permanent obligation: any change to the data declared is reported to the DNSC within 2 weeks (name, office, contact, sector, proof of category) or 3 months (representative, countries served, IP ranges). And if you no longer meet the conditions, you ask to be removed from the register within 30 days, with evidence.

Where the law says it: GEO 155/2024, art. 18 (4), (5), (8), (13) and (14).

Step 4. The risk level (60 days from Day 0)

This is where how much you have to do gets decided. Within 60 days of the decision you send the DNSC the company’s risk level assessment, done with the ENIRE@RO Tool (another file from dnsc.ro) or directly on the platform. It is not an ISO-style risk assessment; it is a standard calculation with fixed questions: company size, which kinds of attackers might target you, which kinds of attacks, what impact an outage of your service would have and how likely it is. Out comes a score, and the score gives your level:

• 0 – 99 points → basic level
• 100 – 199 → important level
• 200 – 1,500 → essential level

The level tells you how many security controls apply to you out of DNSC Order 1/2026 (the 218 requirements we covered in „The NIS2 measures are now law”). The score is recalculated every 3 years or when the impact of your service grows. Two exceptions written expressly: banks and financial market infrastructures do not run this calculation (they have their own EU regulation, DORA), and neither do digital infrastructure or ICT management companies designated as „critical third-party providers” under DORA.

Something many find out late: your level is not what you ticked in a self-assessment platform, it is what comes out of ENIRE@RO. Until you have the score, you do not know how many controls you owe, and there is no point promising anyone „only 34”.

Where the law says it: GEO 155/2024, art. 11 (3), art. 18 (6); DNSC Order 2/2025, Annex 2, art. 1, art. 3 (6), art. 5 (5); DNSC Order 1/2026, art. IV and art. V.

Step 5. Grading yourself (another 60 days) and the statement of applicability

Within 60 days of sending the risk level, you do the self-assessment: for every control at your level you state, with evidence, how well you are doing. The law requires it to be assumed by management, meaning signed by the leadership, not by IT. From the second year on, the self-assessment is annual and is sent to the DNSC.

The method in Order 1/2026 looks like school: every control gets two marks from 1 to 5, one for how well it is documented (do you have the procedure, is it approved, is it current?) and one for how well it is implemented in reality. There are pass thresholds per level and 29 key measures on which you may not fall below the threshold. The concrete output of this step is an evidence file: for every control, what you have (policy, procedure, configuration, record) and why you gave that mark.

Together with the self-assessment comes the statement of applicability. It sounds complicated, but it is a list: which other special rules apply to your company (for example Regulation 2024/2690 for digital service providers, or GDPR) and what you have done for them.

Where the law says it: GEO 155/2024, art. 12 (4), art. 18 (7); DNSC Order 1/2026, art. III (2) and Annex 2 (the assessment methodology).

Step 6. The plan for what is missing (30 days from the self-assessment)

If you fall below the threshold in the self-assessment, the remediation plan is not optional: the order says the company „is obliged to draw up a plan of measures to remedy all the deficiencies”, with actions and committed deadlines. For essential entities the law also sets a deadline for the plan itself: 30 days from the self-assessment, sent to the DNSC and signed by management.

The deadline by which you fix things is not written in the law. You set it, in the plan, and from that moment it becomes your promise to the DNSC. It is the only place in the whole process where you choose the calendar, so choose it realistically.

Where the law says it: GEO 155/2024, art. 12 (3) and (5), art. 14 (1), art. 50 (2) letter c) as amended by Law 124/2025, art. 60 (4); DNSC Order 1/2026, Annex 2, art. 3.

What has to work from day one: incident reporting

The reporting obligation does not wait for the DNSC decision or for the risk level. From the moment you are an essential or important entity, a significant incident is reported to the national response team, through the PNRISC platform, on a fixed calendar:

• 24 hours from when you became aware: the early warning (you also say whether you suspect malicious action or cross-border effects);
• 72 hours: the incident notification proper, with a first assessment of severity and impact;
• one month from that notification: the final report (what happened, likely cause, what you did, cross-border effects);
• 6 hours from having any information showing cross-border effects: a separate report, for that information only.

The national team may also ask for interim reports. If the incident may affect your customers, you inform them too, without undue delay.

„Significant” means, in short, an incident that caused or may cause a serious disruption of the service, financial losses, or considerable harm to others. For digital service providers (cloud, data centres, managed services, managed security services, online marketplaces and the rest of the list), Regulation (EU) 2024/2690 gives concrete figures: losses above EUR 500,000 or 5% of turnover, a successful unauthorised access that may seriously disrupt the service, recurring incidents with the same cause (at least two in six months), and for companies managing other people’s IT, a service completely unavailable for more than 30 minutes.

Where the law says it: GEO 155/2024, art. 15 (1), (2), (3), (5), (6) and (7); art. 50 (2) letter c) and art. 60 (1) letter n), both as amended by Law 124/2025; Regulation (EU) 2024/2690, art. 1, art. 3, art. 4 and art. 10.

Step 7. Leadership and the security officer: their own deadlines

The law places personal obligations on the company’s management (administrators and executive directors):

• they approve the security measures, oversee their implementation and are liable for breaches;
• they take accredited cybersecurity training and make sure all staff are trained;
• they set up the permanent contact channel, provide the money and people, and appoint the security officer within 30 days of receiving the DNSC decision.

For essential entities (except public administration, micro and small enterprises), the security officer must meet all of these at once: managerial authority, reporting directly to management, independent of IT, access to resources, and an accredited course recognised by the DNSC within 12 months of appointment. In other words, it cannot be „the network admin, in their spare time”.

A lesser-known obligation for companies that make or supply ICT products or services: vulnerabilities they discover in their own products, or that others report to them, are transmitted to the DNSC and fixed within a deadline agreed with the DNSC.

Where the law says it: GEO 155/2024, art. 14 (1) – (4), art. 36 (4) and art. 50 (4), all as amended by Law 124/2025.

Step 8. The external audit and the routine that never stops

Essential and important entities must undergo a cybersecurity audit, at intervals the DNSC sets by order, depending on the risk level. The audit is done only by auditors holding a valid DNSC attestation; an ISO 27001 audit does not count. The DNSC may also require an unscheduled audit, for example after a significant incident or when it has serious indications that something is wrong. After the report, you have 15 working days to send the plan for all findings, with deadlines, then 5 days from each deadline to notify the DNSC, with evidence, that you have fixed them.

The rest is routine: self-assessment every year with a remediation plan, risk level recalculated every 3 years, register kept current, regular staff training and, on request, the list of systems and the list of risks made available to the DNSC.

Where the law says it: GEO 155/2024, art. 11 (5) and (7), art. 12 (4), art. 57 (2), (8), (9) and (10), art. 58 (1); DNSC Order 2/2025, Annex 2, art. 5 (5).

The timeline on one page

Deadlines run from Day 0 = the day you receive the DNSC decision entering you in the register. Rows marked „you” have no deadline in the law.

When	What happens	Where it says so
Before Day 0	Scoping test; internal decisions (permanent contact, security officer, who signs); form from the NIS2@RO Platform / Tool, PDF with qualified signature, to [email protected]; incident reporting working	art. 5 – 9, art. 18 (2) – (3), art. 15
Day 0	DNSC decision, within 60 days of the notification (essential) or 150 (important)	art. 18 (4) – (5)
+ 30 days	Management appoints the security officer; the 12-month clock for their course starts	art. 14 (3) – (4)
+ 60 days	Risk level (ENIRE@RO / platform) sent to the DNSC; basic / important / essential level results	art. 18 (6); Order 2/2025
+ 120 days	Self-assessment on the controls of your level, signed by management; statement of applicability	art. 18 (7), art. 12 (4); Order 1/2026
+ 150 days	Remediation plan for everything below threshold (statutory deadline for essential entities; mandatory as a document for all)	art. 12 (5); Order 1/2026 Annex 2 art. 3
Plan deadlines (you)	Fixing the gaps; notice to the DNSC with evidence at each deadline	Order 1/2026 Annex 2 art. 3
+ 12 months from appointment	Accredited course recognised by the DNSC for the security officer; accredited training for management	art. 14 (2), (4) letter e)
Periodic (DNSC order)	Audit by an attested auditor; plan within 15 working days; evidence within 5 days of each deadline	art. 11 (5), art. 57, art. 58
Always	Register current (2 weeks / 3 months); annual self-assessment + plan; risk level every 3 years; training; incidents 24h / 72h / 1 month / 6h	art. 18 (8), art. 12 (4), art. 15

The document list

At the end of the first cycle, the company’s NIS2 file should contain at least:

1. The registration notification (the PDF from the official tool, signed) and the DNSC decision.
2. Proof of size and sector (the documents required at registration).
3. The risk level (the ENIRE@RO / platform report) and proof of submission.
4. The management resolution approving the measures and allocating resources.
5. The appointments: the security officer (with a job description showing the statutory conditions) and the permanent contact person.
6. The self-assessment with the justification of every mark and the evidence file per control.
7. The statement of applicability for special rules.
8. The remediation plan, signed by management, with deadlines.
9. The incident reporting procedure: criteria, who decides, PNRISC account, templates for 24h / 72h / 1 month / 6h, how customers are informed.
10. Training evidence: certificates of accredited courses for management and the security officer, staff training records.
11. The list of systems and the list of risks, ready to send to the DNSC on request.
12. The audit report and its plan, once you get there.

What it costs to skip steps

The figures, as set by Law 124/2025:

• For the major obligations (measures, self-assessment, plan, management duties): essential entities from RON 10,000 up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher; important entities from RON 5,000 up to EUR 7 million or 1.4%.
• Failure to register on time: RON 1,500 – 500,000 for essential, RON 1,000 – 300,000 for important entities.
• Failure to report or remedy significant incidents: same band, RON 1,500 – 500,000 for essential, RON 1,000 – 300,000 for important entities.
• For serious infringements (repeated breaches, false information, obstructing the audit or inspection, ignoring DNSC orders) the fine can be up to double the limits.

When setting the amount, the DNSC looks at how long the offence lasted, whether there were previous breaches, what damage resulted, what you did to remedy it and how you behaved towards the authorities.

Where the law says it: GEO 155/2024, art. 50 (1) and (2), art. 60 (1) letters n) and o), (2) and (4), as amended by Law 124/2025.

Where to start tomorrow

1. Run the scoping test on the NIS2@RO Tool and write the conclusion on one page: sector, size, essential or important. If you hold maintenance contracts with administrator access, go through them too. If the answer is „yes”, prepare the notification this week.
2. Name the permanent contact person and the future security officer, checking the statutory conditions before, not after.
3. Get incident reporting working: PNRISC account, written criteria, three templates. It is the one obligation that waits for no deadline.
4. Grade yourself before the official self-assessment. The free self-assessment shows you in ten minutes where you stand; for the full file, with every control, the evidence, the plan and the statement of applicability, there is CERTO.

Sources

• Government Emergency Ordinance 155/2024 on a high common level of cybersecurity (Official Gazette no. 1332 of 31 December 2024), approved with amendments by Law 124/2025 (Official Gazette no. 638 of 2025).
• DNSC Order no. 2/2025 approving the criteria and thresholds for the degree of disruption of a service and the methodology for assessing the risk level of entities (Official Gazette no. 776 of 20 August 2025).
• DNSC Order no. 1/2026 on cybersecurity risk management measures (Official Gazette no. 712 and 712 bis of 27 August 2026).
• Directive (EU) 2022/2555 (NIS2), art. 6, definitions.
• Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024.
• dnsc.ro page „Înregistrare entități” (consulted in September 2026).

This article is a plain-language explanation, not legal advice. For your company’s exact situation the reference remains the law, in its current consolidated form, and for borderline scoping cases a written legal opinion is worth having.