Questions business owners ask us

It depends on your assets. You are “medium” if you have 50 employees or more, or, below 50, if both turnover and total assets exceed 10 million euros (Law 346/2004, art. 4). If you belong to a group, the figures may be added up. Check with the tool, using the real figures from your financial statements.

Size may be calculated together with linked or partner companies in the group (Law 346/2004, art. 4^2–4^4), so a small subsidiary may be treated as medium or large. And if you are a digital company (cloud, data centres, managed IT services, DNS), what matters is where security decisions are taken in the EU: the main establishment decides jurisdiction (art. 7 (3)). In the tool, tick “group” and, if relevant, “decisions are taken in another state”.

If you run other companies’ IT under contract (servers, networks, workstations, backup, monitoring), yes: you are a managed service provider, sector 9 of Annex 1. You are in as an important entity if you are at least medium-sized. If you also provide managed security (SOC, detection and response) and you are medium-sized, you are an essential entity (art. 5 (4)). A small IT company is not in, but its clients under NIS2 may require measures from it by contract, for their supply chain.

Central public administration is essential regardless of size (art. 5 (1) a). Town halls and county councils are not in the annexes, but DNSC may identify them by decision if their service is essential (art. 9). Hospitals and clinics are in the health sector and are in by size, like any healthcare provider. Universities are expressly excluded, both from central administration and from research.

The next steps run from the DNSC decision: 60 days for the risk assessment, then 60 for the self-assessment (art. 18 (6)–(7)). If the deadlines have passed, the best thing is to close them now. Delays are sanctioned in the low tier (1,000–300,000 lei for important entities, 1,500–500,000 lei for essential ones), and DNSC has said it applies the lower limits first.

No. Every control gets two scores: how it is written and how it works. A firewall with no policy, no documented rules and nobody looking at the logs scores low on documentation and, probably, on implementation too. Compliance is the process plus the proof, not the product.

The definition in DNSC Order 1/2026: there is a formal process, which is implemented; evidence is available for most activities; exceptions are below 10%. On documentation, a 3 means an officially approved procedure, with exceptions documented and approved, below 5% of cases. A 4 requires evidence for all activities and reported metrics; a 5, a continuously improved target.

It depends on the level and on what you already have. A Basic level, with an inventory and a few existing policies, closes in a few weeks. An Essential level, with 218 controls, is a months-long project with people from your company involved. We do not publish prices: in the 30-minute call you see what is missing and get a quote to match, not a package.

Someone designated establishes that it is significant (serious disruption, financial loss or damage to others — art. 15 (6)), logs into the PNRISC account and sends the early warning: what happened, whether it looks malicious, whether it may cross borders. Within 72 hours comes the report with the initial assessment and indicators of compromise; within a month, the final report. Affected customers are informed without delay. If there is a cross-border impact, the information goes out within 6 hours.

A DNSC-certified auditor, chosen and paid by you, who has not advised you and does not run your systems. The frequency is not yet set by an order; Order 1/2026 does not contain it either. DNSC can order an audit after an incident or after a major change (art. 57).

No. The auditor cannot be the one currently providing you security services, cannot have a contract on the audited system that is ongoing or ended less than a year ago, and cannot do more than three consecutive audits at the same entity (art. 58 (3)). That is why we only do the preparation and help you pick an auditor from the list DNSC publishes.

No. The law says expressly that information given to DNSC is not public-interest information, and DNSC protects the company’s commercial and security interests (art. 3 (3)–(4), introduced by Law 124/2025).

Two tiers (art. 60). For substantive obligations: for important entities from 5,000 lei up to 7 million euros or 1.4% of net turnover, for essential ones from 10,000 lei up to 10 million or 2%. For deadlines and formalities: 1,000–300,000 lei and 1,500–500,000 lei respectively. Serious or repeated breaches can double the limits; paying within 15 days halves the fine. In September 2026 DNSC announced the first sanctions, for failure to register, at the lower limits.