The compliance audit is the stage in which an independent party confirms that your security measures exist, work and have evidence. For this audit to count, it must be performed by a DNSC-attested cyber security auditor. Choosing the right auditor makes the difference between a smooth process, with a favourable opinion, and one full of surprises. Here is how to choose correctly.
What DNSC attestation of an auditor means
Within NIS2, transposed in Romania through OUG 155/2024 and approved by Law 124/2025, the official compliance audit cannot be performed by just anyone. It is performed by cyber security auditors attested by the National Cyber Security Directorate (DNSC). The attestation is the authority's confirmation that the person or entity meets the requirements to conduct such audits.
For you, as a covered organisation, the consequence is simple: the compliance opinion has value only if it comes from an attested auditor. An audit performed by a firm without attestation can be useful as an internal exercise, but it does not replace the official audit.
It is important not to confuse the auditor attestation with other forms of recognition or certification on the market. A firm can have solid experience in cyber security or certifications against standards such as ISO 27001 without, by that fact, being DNSC-attested as an auditor for NIS2. The two things can overlap, but they are not equivalent. For the official compliance audit, strictly the DNSC attestation counts, not the general reputation or other accreditations.
How to check an auditor
Before signing a contract, check three things:
- The DNSC attestation. Ask for proof of the cyber security attestation and verify the information at the official source, on the DNSC website. A serious auditor shows you the attestation without hesitation.
- Relevant experience. Ask in which sectors and at which classification level (essential or important) the auditor has worked. Experience in a context similar to yours reduces the risk of misinterpretations.
- Independence. The auditor who issues the official opinion must be independent of the one who implemented the measures. This separation protects the value of the audit.
If you are not sure which level you fall into before talking to an auditor, first clarify it through classification and registration.
Internal audit vs external audit
The two audits have different roles and complement each other:
| Criterion | Internal audit | External audit (official) |
|---|---|---|
| Purpose | Preparation: you find out where you still have gaps | Independent confirmation of compliance |
| Who performs it | Your own team or a consultant | DNSC-attested auditor, independent |
| When | Before the official audit | After implementation is ready |
| Result | List of gaps to remedy | Compliance opinion |
The internal audit is not meant to show a perfect picture, but to identify the gaps while you can still remedy them. It is the best practice for avoiding an external audit that ends with an unfavourable opinion. We wrote at length about how these stages connect in from self-assessment to audit.
The role of the gap analysis
Even before the internal audit, a gap analysis compares the current state of security with the requirements of your CyFun level and shows exactly what is missing. It is the foundation on which you build everything:
- It tells you where you stand against the maturity target (3 out of 5 in CyFun).
- It turns abstract requirements into a concrete list of actions.
- It prioritises by risk, so that you invest first where it matters.
In the Certudo platform, the CyFun maturity self-assessment and the implementation plan, which constitute a structured gap analysis, are free. With their result in hand, the discussion with the auditor becomes much more precise, because you know in advance where you are vulnerable.
What to ask before the contract
A suitable auditor answers concrete questions clearly. Before signing, ask:
- Attestation: Can you show me the DNSC attestation of cyber security auditor?
- Experience: Have you audited organisations in my sector and classification level?
- Methodology: How is the audit carried out, in what stages and what standards do you apply?
- Evidence: What evidence will you require and in what format? (See NIS2 evidence and registers.)
- Reporting: How do you communicate the findings to me and what happens if non-compliances arise?
- Deadlines and cost: What is the estimated duration and how is the cost structured?
The quality and transparency of the answers say a lot about the seriousness of the auditor. An auditor who avoids questions about attestation or methodology is a warning sign.
It is worth noting the answers in writing and comparing them between several auditors. You are not necessarily after the lowest price, but the best fit: valid attestation, experience in your context, a clear methodology and communication in which the findings are explained, not just ticked off. A well-conducted audit leaves you not just an opinion, but also a better understanding of your own security, useful for maintaining compliance in the years to come.
Warning signs when choosing the auditor
Beyond the positive criteria, it is worth recognising the signs that should make you cautious. An auditor who:
- avoids or delays proof of the DNSC attestation should not reach the contract stage;
- promises a guaranteed favourable opinion before seeing the real state of your measures confuses the audit with a formality, which puts at risk the very value of the opinion;
- does not require concrete evidence and is content with declarations does not perform a real audit, but a superficial one;
- does not explain the methodology or describes it vaguely risks delivering a result you cannot defend.
An audit has value precisely because it is rigorous and independent. An auditor who promises you the easy road is in fact selling you a hidden risk: a fragile opinion that does not hold up to a later check.
Why preparation matters more than the auditor
However good the auditor is, they do not create your compliance; they only confirm it. The result of the audit depends above all on how well you have implemented the measures and how clear the evidence is. That is why most of your effort and budget should go into preparation, not into the audit.
Solid preparation means: correct classification, an honest maturity self-assessment, an implementation plan prioritised by risk, controls implemented effectively and evidence collected as you work. When you arrive before the auditor with all of this up to date, the audit becomes a confirmatory formality, not a source of surprises. This is exactly the logic we detail in from self-assessment to audit and in the sections about the preparation services.
How Certudo helps you
Our role is to bring you prepared before the attested auditor, without surprises. The platform offers you classification, the risk analysis, the CyFun maturity self-assessment and the implementation plan for free, and the consultancy at the self-assessment helps you go through this pre-implementation phase correctly and build the plan. The external audit is performed by DNSC-attested auditors, partners or in-team, so that the opinion has official value.
See the NIS2 audit service and the full range of services, then we discuss your situation concretely.
Start the classification for free
Want to discuss the audit and how we prepare you for it? Contact us and we will explain the steps, from the gap analysis to the official audit.
Frequently asked questions
What is a DNSC-attested NIS2 auditor?
It is a cyber security auditor attested by the National Cyber Security Directorate (DNSC). The attestation confirms that the person or entity meets the requirements to perform compliance audits within the framework set by the authority. The official NIS2 compliance audit is performed by such attested auditors.
Is Certudo a DNSC-attested auditor?
No. Certudo provides the platform and the consultancy for preparing compliance, and the external compliance audit is performed by DNSC-attested cyber security auditors, partners or in-team. Certudo is not authorised or accredited by DNSC as an auditor.
How do I check whether an auditor is attested?
Ask the auditor for proof of the cyber security attestation issued by DNSC and verify the information at the official source, on the DNSC website. A serious auditor shows you the attestation without hesitation, together with relevant experience in your sector.
What is the difference between an internal audit and an external audit?
The internal audit is a check of your own, before the official one, which shows you where you still have gaps while you can still remedy them. The external compliance audit is the official one, performed independently by DNSC-attested auditors, and confirms that the measures exist, work and have evidence.
What is a gap analysis and why does it matter before the audit?
The gap analysis compares the current state of security with the requirements of your CyFun level and shows exactly what is missing. Done before the audit, it avoids surprises and an unfavourable opinion, because you remedy the gaps in good time.
What should I ask an auditor before signing the contract?
Ask about the DNSC attestation, experience in your sector and classification level, the audit methodology, what evidence it will require, how it reports findings and what the deadlines are. The clarity of the answers says a lot about the seriousness of the auditor.