Romania’s OUG 155/2024 requires companies in certain sectors, above a certain size, to have real security measures, to prove them, and to report incidents. We get you ready, so that on audit day you have nothing to worry about.
Companies in 18 sectors (energy, transport, health, water, food, chemicals, manufacturing, IT, postal services, waste and others) that are at least medium-sized: 50 employees or more, or, below 50, with turnover and assets above 10 million euros. A few categories are in regardless of size: DNS, domain registries, trust services, electronic communications.
Real security measures across ten areas: from policies and risk analysis to backup, access control, suppliers and multi-factor authentication. You declare them in a yearly self-assessment owned by management, you prove them, and you report serious incidents within 24 hours.
DNSC, Romania’s National Cyber Security Directorate: it registers you by decision, validates your risk level, receives your self-assessment and can inspect you. The audit is done by a DNSC-certified auditor, independent from whoever prepared you.
DNSC Order 1/2026 arrived: the catalogue of controls on three levels (34, 133 or 218), each control with two scores from 1 to 5, for how it is written and for how it works, and a mandatory remediation plan when you miss the targets. Bought solutions are no longer enough: you have to show they work.
Eight stations, in order. Deadlines run from events in your company’s life, not from a calendar date.
Sector, size and the special cases.
Now
The final classification is made by DNSC through a decision, after you notify.
The notification on the NIS2@RO platform, with a qualified signature.
30 days from the day you fall in scope
The original deadline has passed; a late registration beats no registration.
You get your ID, appoint the officer, management takes the course.
The decision: 60 or 150 days from notification. The officer: 30 days from the decision. Their course: 12 months from appointment.
The ENIRE score decides how many controls you have: 34, 133 or 218.
60 days from the day the decision is communicated
Every control, two scores from 1 to 5, with evidence.
60 days from submitting the risk assessment, then yearly
Yearly, with no fixed day: the sensible reference is the anniversary of the first self-assessment.
For every gap: an action, an owner, a deadline, a proof.
Essential entities: 30 days from the self-assessment. Others: together with the self-assessment, no separate deadline.
A yearly self-assessment and an audit by a certified, independent auditor.
The self-assessment: yearly. The audit: per the order that will set the frequency.
24 hours, 72 hours, one month; company data kept current.
Incidents: 24 hours, 72 hours, one month (6 hours for cross-border impact). Data: 2 weeks or 3 months.
Every control gets two scores. One for documentation: there is a written rule, approved, reviewed. One for implementation: the rule is actually applied and you can show it. Three examples from the 34 basic controls.
A firewall, an antivirus or a purchased backup is not compliance. A 3 on implementation needs a formal, applied process with evidence for most activities and fewer than 10% exceptions. Below 3 on a key measure, you miss the target even at the basic level.
The law requires the auditor to be independent from whoever helped you prepare: it cannot be the one advising you or running your systems (OUG 155/2024, art. 58 (3)). Of the two roles, we chose the first.
We stop at the audit’s door. Up to there, your file is complete, the scores are honestly justified and every gap has a plan. So that on audit day you have nothing to worry about.
For our clients only
Alongside our advisory work, we have built a platform dedicated to NIS2 audit preparation. We use it together with our clients, all the way to the audit. If you want to see what preparation would look like for your company, we start with a call.
Access is available only as part of a preparation project with BitUp Technology.
It depends on your assets. You are “medium” if you have 50 employees or more, or, below 50, if both turnover and total assets exceed 10 million euros. If you belong to a group, the figures may be added up. Check with the tool, using real data.
The next steps run from the DNSC decision: 60 days for the risk assessment, then 60 for the self-assessment. If the deadlines have passed, the best thing is to close them now. Delays are sanctioned in the low tier, and DNSC has said it applies the lower limits first.
No. Every control gets two scores: how it is written and how it works. A firewall with no policy, no documented rules and nobody looking at the logs scores low on documentation and, probably, on implementation too.
A DNSC-certified auditor, chosen and paid by you, who has not advised you and does not run your systems. The frequency is not yet set by an order; DNSC can order an audit after an incident or a major change.
No. The law says expressly that information given to DNSC is not public-interest information, and DNSC protects the company’s commercial and security interests (art. 3 (3)–(4), introduced by Law 124/2025).
Thirty minutes, by phone or video: which sector, which size, what you already have and what is missing. You leave with a list, not with a quote.