NIS2 and CyFun, in brief
Articles that explain the basic concepts of NIS2, CyFun and compliance in plain language. They do not replace the legal text or an analysis applied to your organization, but they help you get oriented. For your company's specific needs, use the free Certudo tools or get in touch.
DNSC registration for NIS2: steps, documents and the NIS2@RO platform
Who must register with DNSC, what data and documents to prepare and how to file the notification exclusively through the NIS2@RO platform.
NIS2 fines in Romania: amounts, who is liable and how to avoid them
How large NIS2 fines can be, the essential/important difference, management liability and the first sanction applied by DNSC.
OUG 155/2024 and Law 124/2025: Romania's NIS2 law, in brief
The NIS2 legal framework in Romania, in brief: what OUG 155/2024 regulates, what Law 124/2025 changed and which DNSC orders complete its application.
How much NIS2 compliance costs: pre-implementation, implementation and audit
NIS2 compliance has two phases with different costs: pre-implementation (mostly free) and the implementation of controls (tools, technical consultancy, audit). Here is what makes up the budget.
Find out where you fall: Essential or Important entity?
Classification depends on sector and size. We explain the criteria, in terms everyone can understand.
The DNSC Excel templates or a NIS2 platform: what to choose
The official DNSC Excel templates or a dedicated platform? A balanced comparison on effort, errors, updating, collaboration, evidence, reporting and cost.
NIS2 in the public sector: which cyber security measures become mandatory for city halls?
Public administration is covered by NIS2. What obligations city halls and institutions have, why the first sanctions targeted the public sector and what to do now.
Basic, Important or Essential? How to choose the right security level for your organisation
CyFun has three assurance levels in Romania. The level determines how many and which controls you implement.
Managing DNSC notifications (the 24h / 72h / 1 month rule)
NIS2 requires significant incidents to be notified within strict deadlines. Here is what the process looks like.
NIS2 for the leadership: what the new directive means for administrators and directors
NIS2 brings security into management. The management approves, oversees and is accountable.
How to choose a DNSC-attested NIS2 auditor
What a DNSC-attested cyber security auditor means, how to check them, the difference between internal and external audit and the questions to ask before the contract.
From self-assessment to audit: the path to compliance
NIS2 compliance is a path with clear stages. Here is how you walk it.
What CyFun is and why it is used by DNSC
CyFun, or CyberFundamentals, is the technical framework that DNSC adopts for NIS2 in Romania.
What NIS2 is and what changes for companies in Romania
The European cybersecurity directive, transposed in Romania through OUG 155/2024, extends the obligations for ensuring the cybersecurity framework to thousands of new organizations.
What evidence must be maintained for NIS2
Assets, risks, incidents, suppliers, vulnerabilities and more. NIS2 requires evidence of compliance, not just documents.
The six CyFun functions, in terms everyone can understand
Govern, Identify, Protect, Detect, Respond and Recover. What each one means.
The first NIS2 fine applied by DNSC: what happened and what you learn from it
DNSC applied the first fine under OUG 155/2024: 50,000 lei for failing to register on time. What happened, what it signals and what you do if you have not registered.
The NIS2 timeline, from registration to audit
Registration, risk assessment, self-assessment, implementation and audit. Here is the order of the steps.