The NIS2 roadmap
NIS2 deadlines are not fixed calendar dates. Each one runs from an event in your company’s life: the day you fall under the law, the DNSC decision, the risk assessment you submit, the self-assessment. That is why the roadmap is a sequence, not a calendar.
Eight stations, in the order you meet them. For each: what it is, by when, which article it rests on, what you risk, and what to do now.
Station 1
Are you in scope?
By when
Now
The final classification is made by DNSC through a decision, after you notify.
What it is
The law applies to companies in 18 sectors. Eleven are “of high criticality”: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, managed ICT services, central public administration, space. Seven more are “critical”: postal and courier services, waste, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery, vehicles, other transport equipment), digital providers, research.
You are in if you are at least a medium-sized company: 50 employees or more, or, below 50, if both turnover and total assets exceed 10 million euros. If you belong to a group, the figures may be added up.
A few categories are in regardless of size: DNS providers, domain registries, trust service providers, providers of electronic communications networks and services, critical entities, and anyone who is the sole provider of an essential service, by DNSC decision.
What to do now
- Enter your fiscal code; we pull the sector, headcount and turnover from ANAF data.
- Confirm the sectors you actually work in, not just the NACE code.
- Answer a few questions about the special cases: group, DNS, cloud, telecoms, DORA.
Station 2
You register with DNSC
By when
30 days from the day you fall in scope
The original deadline has passed; a late registration beats no registration.
What it is
You submit a notification on the NIS2@RO platform (platformanis2.ro), signed with a qualified electronic signature, with the company’s data: name, offices, contacts, the person who keeps the permanent contact, sector, the member states where you provide services, public IP ranges (for digital companies) and proof that you meet the conditions.
The general deadline was 30 days from 20 August 2025, when the registration order was issued — it expired on 19 September 2025. The obligation did not go away: on 9 September 2026 DNSC announced that the first sanctions are precisely for failing to register. If you fall under the law later (you grew, you changed activity), you have 30 days from the day it applies to you.
What to do now
- Prepare the data and the legal representative’s qualified electronic signature.
- Submit the notification on NIS2@RO; it counts as received within 5 working days.
- Keep the confirmation. Any later change to the data must be reported within 2 weeks.
Station 3
The DNSC decision and your security officer
By when
The decision: 60 or 150 days from notification. The officer: 30 days from the decision. Their course: 12 months from appointment.
What it is
DNSC checks the notification and issues the registration decision: within 60 days for essential entities, 150 for important ones. The decision gives you a unique ID you use in every report.
From the day the decision is communicated you have 30 days to appoint the person responsible for network and information systems security, set up permanent means of contact and allocate resources. Board members take accredited training courses and the company trains all its staff.
In private essential entities of medium or large size, the officer has managerial authority, reports directly to management, is independent of the IT department and completes a DNSC-recognised course within 12 months of appointment.
What to do now
- Choose the officer, in-house or designated, and notify DNSC.
- Enrol the administrator and directors in an accredited course; it is an obligation with a fine, not a formality.
- Budget the people, time and tools for what comes next.
Station 4
Your risk level
By when
60 days from the day the decision is communicated
What it is
Within 60 days of the decision you calculate your risk score with the ENIRE@RO tool, on the platform or in Excel: sector, size and attack types, with standard values you can only change with a justification. DNSC validates within 15 days.
The score gives you your assurance level: Basic (0–99 points), Important (100–199) or Essential (200–1,500). With the standard values, a large company in the high-criticality sectors is Essential, a medium one in the same sectors is Important, and a medium one in the other sectors is usually Basic. If you are in several sectors, the highest level applies.
The score is recalculated every 3 years or when the impact of your services grows. Banks and financial market infrastructures under DORA do not do the risk assessment: they apply the DORA rules.
What to do now
- Estimate your level here, in two minutes, from sector and size.
- Fill in ENIRE@RO with the standard values; if you change any, write the justification and send it with the report.
- Submit the signed PDF report and wait for validation.
Station 5
The maturity self-assessment
By when
60 days from submitting the risk assessment, then yearly
Yearly, with no fixed day: the sensible reference is the anniversary of the first self-assessment.
What it is
Within 60 days of submitting the risk assessment you complete the self-assessment for your level: 34, 133 or 218 controls, organised in six functions: govern, identify, protect, detect, respond and recover. Each control gets two scores from 1 to 5, one for documentation and one for implementation, and every score is justified in writing.
You do it on the NIS2@RO platform or, when the platform is unavailable, with the EVAL_MMS tool from dnsc.ro. Management takes ownership and signs it with a qualified electronic signature.
The targets: at Basic, a total of at least 2.5 and every key measure at least 2.5; at Important, 3 and 3; at Essential, a total of at least 3.5, every category at least 3 and every key measure at least 3. Then it repeats every year; neither the law nor the order sets a calendar date. If sector-specific rules also apply to you, their requirements go into a statement of applicability.
What to do now
- Take stock of what you have: policies, procedures, systems, evidence.
- Score every control honestly; a 3 on implementation means a formal, applied process with evidence for most activities.
- Collect the evidence for every score of 3 or more, in a single file.
Station 6
The remediation plan
By when
Essential entities: 30 days from the self-assessment. Others: together with the self-assessment, no separate deadline.
What it is
If you miss the targets, you draw up a plan of measures for every gap that led to non-conformity, with the actions and the deadlines you commit to. DNSC Order 1/2026 requires it at every level.
For essential entities the law adds: the plan is made within 30 days of the self-assessment, owned by management, and submitted to DNSC and, where one exists, to the sector authority.
The order does not ask for owners, resources and verification evidence, but without them the plan cannot be tracked, and they are exactly what an inspection asks for.
What to do now
- List the gaps from the self-assessment, ordered by their impact on the score.
- Give each one an action, an owner and a deadline you can actually keep.
- Decide up front which proof closes each action.
Station 7
Every year, plus the audit
By when
The self-assessment: yearly. The audit: per the order that will set the frequency.
What it is
The self-assessment repeats every year, with a remediation plan when needed. Separately, the law requires a periodic cybersecurity audit, done only by a DNSC-certified auditor, at your expense. The frequency is yet to be set by a DNSC order: Order 1/2026 does not contain it either.
DNSC can order an audit at any time, after a significant incident, after a major change (for instance moving from important to essential) or when it has grounds. After any audit: the results reach DNSC within 5 days, the plan of measures within 15 working days, and you send the evidence at every deadline you committed to.
The auditor cannot be the one who advised you or who runs your systems. That is why we only do the preparation.
What to do now
- Keep the evidence file current all year; do not rebuild it before the deadline.
- Track the remediation plan and close actions with evidence.
- Pick a certified auditor early, from the list DNSC publishes.
Station 8
Any time: incidents and changes
By when
Incidents: 24 hours, 72 hours, one month (6 hours for cross-border impact). Data: 2 weeks or 3 months.
What it is
An incident is significant if it caused or can cause serious disruption of services or financial loss, or if it affected other people with considerable damage. You report it on the PNRISC platform: an early warning within 24 hours of becoming aware, the incident report within 72 hours, the final report within a month; within 6 hours, any information showing a cross-border impact. Affected customers are informed without delay.
When the company’s data changes you update it with DNSC: name, offices, contacts, sector and the conditions for classification within 2 weeks; the representative, the member states you serve and IP ranges within 3 months.
A DNSC inspection is announced 30 days ahead when planned and 5 days ahead when not. After the findings report you have 15 working days for the remediation plan.
What to do now
- Have a written response plan: who calls whom, and how fast.
- Create the PNRISC account beforehand, not on the night of the incident.
- Keep a calendar of the data you have to update.
You do not have to do all of it alone
We take you from station 1 to station 6 with a file the auditor opens and closes without surprises. The rest stays yours: the decision, the signature, the auditor.