Which law transposes NIS2 in Romania?

Government Emergency Ordinance (OUG) 155/2024, in force since 31 December 2024, approved with amendments by Law 124/2025, in force since 10 July 2025. The DNSC (Directoratul Național de Securitate Cibernetică) is the competent authority.

What comes after registering with DNSC?

After DNSC's decision: a risk-level evaluation within 60 days, then a maturity self-assessment under DNSC Order 1/2026 within 60 days of that, and for essential entities a remediation plan within 30 days when target scores are not met. The self-assessment repeats annually.

gociux← all services RO

NIS2 · Romania · status October 2026

NIS2 in Romania: what DNSC expects, and when.

Romania's NIS2 rules are no longer just a law on paper. Registration ran in 2025, and since August 2026 DNSC has published the actual control set and the maturity self-assessment every essential and important entity has to file. Here is the sequence, the deadlines, and where engineering, not paperwork, decides the outcome.

24hearly warning after a significant incident

72hincident notification to DNSC

€10M / 2%maximum fine, essential entities

The legal framework, in order

OUG 155/2024 (in force 31 December 2024)Transposes the NIS2 Directive (EU 2022/2555) and names DNSC as the competent authority. Entities in the sectors of Annex 1 and Annex 2 are in scope, mainly medium and large companies, plus smaller ones that are critical in their sector.

Law 124/2025 (in force 10 July 2025)Approves the ordinance with changes: regular cybersecurity training for all staff, a person responsible for network and information security appointed within 30 days of DNSC's registration decision, fines calculated on global turnover, a mandatory 50% increase for repeat violations, and pharmaceutical wholesale and retail (NACE 4646, 4773) plus medicinal product distributors added to Annex 1.

DNSC Orders 1/2025 and 2/2025 (in force 20 August 2025)Order 1 sets the registration notification (30 days, via the NIS2@RO platform or tool). Order 2 sets the methodology for self-assessing service disruption impact and the cybersecurity risk level, which decides whether you implement basic, important or essential measures.

DNSC Order 1/2026 (Monitorul Oficial 712, 27 August 2026)Approves the risk management measures and the maturity self-assessment methodology. Each applicable control is scored 1–5 for documentation and 1–5 for implementation, with a written justification, using the EVAL_MMS tool for your assurance level (basic, important, essential). Order 2/2026 (in force 18 September 2026) caps controls marked not applicable at 1, 3 and 5 respectively, and DNSC Decision 3/2026 lets group companies share controls while each entity still proves them in its own scope.

Your timeline, step by step

within 30 days of falling in scope · art. 18(2) OUG 155/2024Notify DNSC for registrationWith the four self-assessments required by Order 1/2025 (disruption impact, critical-entity status, dependency on national ICT infrastructure, sole-provider status).

DNSC: 60 days (essential) / 150 days (important) · art. 18(4)–(5)DNSC decides your classificationEssential or important, and you are entered in the national register.

within 30 days of the decision · Law 124/2025Appoint your responsible person for NIS security

within 60 days of the decision · art. 18(6)File the risk-level evaluationPer Order 2/2025, Annex 2. The score sets your assurance level and therefore which control set applies.

within 60 days of the risk-level evaluation · Order 1/2026Submit the maturity self-assessmentEvery applicable control scored for documentation and implementation, justified in writing.

within 30 days of the self-assessment · Order 1/2026Remediation plan (essential entities below target)Sent to DNSC and, where applicable, your sector authority. Then the self-assessment repeats every year.

Incident reporting: the 24/72 rule

Article 15 of OUG 155/2024 sets the clock from the moment you become aware of a significant incident: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the notification. Where the incident has a cross-border impact, the relevant information is due within 6 hours. None of that is achievable without detection that actually fires and a runbook someone has rehearsed. That's the part most self-assessments overstate.

Management is on the hook

Under article 14, management bodies approve the risk management measures, oversee their implementation and are responsible for breaches. Members must follow accredited professional training, and the entity must train all staff. Maximum fines are the higher of €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities. Missing the registration or the risk-level self-assessment alone can cost up to RON 500,000 (essential) or RON 300,000 (important).

What we do

Scoping and classification checkAre you in scope, as essential or important, and which assurance level your risk evaluation actually supports. We sanity-check the inputs before they're filed.

Maturity self-assessment with evidence behind every scoreWe work through the EVAL_MMS control set with your team and attach the evidence: configurations, logs, policies that are actually enforced. A score of 4 should survive a DNSC audit, not just look good in the tool.

Remediation as engineeringThe gaps that move scores fastest are usually identity (Entra ID, MFA, privileged access), logging and detection, and backup and recovery. We build them, with the same tooling we run in a PCI DSS Level 1 environment.

A 24/72-hour reporting runbook that worksDetection wired to your SIEM, a decision tree for "is it significant", pre-filled DNSC notification templates, and a tabletop exercise so the first real incident isn't the first rehearsal.

Pe scurt, în română

NIS2 este transpusă prin OUG 155/2024, aprobată prin Legea 124/2025. După înregistrarea la DNSC urmează evaluarea nivelului de risc (60 de zile de la decizie), autoevaluarea maturității conform Ordinului DNSC 1/2026 (60 de zile de la evaluarea riscului) și, pentru entitățile esențiale sub țintă, planul de remediere (30 de zile). Incidentele semnificative se raportează în 24 de ore (avertizare timpurie) și 72 de ore (notificare). Vă ajutăm cu autoevaluarea, dovezile și remedierea tehnică. Scrieți-ne în română la [email protected].

Not legal advice. This is an engineering summary of public texts as of October 2026. DNSC keeps publishing orders and guidance, so confirm your obligations against the current texts on dnsc.ro and with legal counsel. What we bring is the work that makes the self-assessment true.

Sources

Free tools: NIS2 pre-assessment (scope and maturity across article 21(2)) · incident reporting clock (24h / 72h / 1 month deadlines).

Self-assessment due, or not sure you're in scope?

Tell us your sector and size. We'll reply by email with a straight read on your obligations and what it takes to score honestly.

Get in touch →