gociux
RO← all tools

Free tool · NIS2

NIS2 pre-assessment

Two questions every company in scope asks: does NIS2 apply to us, and how far are we from what an auditor will expect? Answer for your sector, your size and the ten areas of article 21(2), and get a per-area picture plus the evidence to prepare.

Short answer: NIS2 generally applies to medium and large companies (50+ employees, or more than €10M turnover and balance sheet) in the sectors listed in its Annexes I and II. Large companies in Annex I sectors are usually essential entities; the rest are important. All must implement the ten risk management measures in article 21(2) and report significant incidents.

Free, runs in your browser. Nothing you enter is sent or stored. Updated: .

Your organisation

Maturity by article 21(2) area

For each area: how well is it documented, and how well is it actually implemented? The official assessment scores both separately.

Scope

Maturity by area

0%

Average across the ten areas, documentation and implementation weighted equally.

Gaps and evidence to prepare

Indicative only. In Romania the official self-assessment uses DNSC's EVAL_MMS tools under DNSC Order 1/2026, scoring documentation and implementation on a 1 to 5 scale per control, with a different control set for each risk level. Scope also depends on rules this tool doesn't model (group structure, sector-specific exceptions, designation by the authority).

Questions

How do I know if my company is essential or important?

Look at your sector and size. Large enterprises (250+ employees, or more than €50M turnover and €43M balance sheet) in Annex I sectors are generally essential; medium enterprises in Annex I and medium or large ones in Annex II are important. Some entities are in scope regardless of size, such as DNS providers and qualified trust service providers.

What are the article 21(2) measures?

Ten areas: risk analysis and security policies, incident handling, business continuity and crisis management, supply chain security, secure acquisition and vulnerability handling, measuring effectiveness, cyber hygiene and training, cryptography, HR security with access control and asset management, and MFA with secure communications.

What are the fines?

Up to €10 million or 2% of worldwide annual turnover for essential entities, and up to €7 million or 1.4% for important entities, whichever is higher. Management bodies can also be held personally responsible for failing to oversee the measures.

Sources

Want an assessment an auditor will accept?

We run the full assessment against the control set that applies to your risk level, collect the evidence with you, and turn the gaps into a plan with owners and dates.

Get in touch →

Related: NIS2 in Romania · Incident reporting clock · NIS2 training