# How to choose a DNSC-attested NIS2 auditor

> NIS2 audit guide for Romania: what DNSC attestation of the auditor means, how to check an auditor, internal vs external audit and what to ask before the contract.

The compliance audit is the stage in which an independent party confirms that your security measures exist, work and have evidence. For this audit to count, it must be performed by a DNSC-attested cyber security auditor. Choosing the right auditor makes the difference between a smooth process, with a favourable opinion, and one full of surprises. Here is how to choose correctly.

## What DNSC attestation of an auditor means

Within NIS2, transposed in Romania through OUG 155/2024 and approved by Law 124/2025, the official compliance audit cannot be performed by just anyone. It is performed by cyber security auditors attested by the National Cyber Security Directorate (DNSC). The attestation is the authority's confirmation that the person or entity meets the requirements to conduct such audits.

For you, as a covered organisation, the consequence is simple: the compliance opinion has value only if it comes from an attested auditor. An audit performed by a firm without attestation can be useful as an internal exercise, but it does not replace the official audit.

It is important not to confuse the auditor attestation with other forms of recognition or certification on the market. A firm can have solid experience in cyber security or certifications against standards such as ISO 27001 without, by that fact, being DNSC-attested as an auditor for NIS2. The two things can overlap, but they are not equivalent. For the official compliance audit, strictly the DNSC attestation counts, not the general reputation or other accreditations.

Certudo provides the platform and the consultancy for preparation, and the external audit is performed by DNSC-attested auditors, partners or in-team. Certudo is not authorised or accredited by DNSC as an auditor; our role is to bring you prepared before the attested auditor.

## How to check an auditor

Before signing a contract, check three things:

- **The DNSC attestation.** Ask for proof of the cyber security attestation and verify the information at the official source, on the DNSC website. A serious auditor shows you the attestation without hesitation.
- **Relevant experience.** Ask in which sectors and at which classification level (essential or important) the auditor has worked. Experience in a context similar to yours reduces the risk of misinterpretations.
- **Independence.** The auditor who issues the official opinion must be independent of the one who implemented the measures. This separation protects the value of the audit.

If you are not sure which level you fall into before talking to an auditor, first clarify it through [classification and registration](/incadrare-inregistrare.html).

## Internal audit vs external audit

The two audits have different roles and complement each other:

  
    CriterionInternal auditExternal audit (official)
  
  
    PurposePreparation: you find out where you still have gapsIndependent confirmation of compliance
    Who performs itYour own team or a consultantDNSC-attested auditor, independent
    WhenBefore the official auditAfter implementation is ready
    ResultList of gaps to remedyCompliance opinion
  

The internal audit is not meant to show a perfect picture, but to identify the gaps while you can still remedy them. It is the best practice for avoiding an external audit that ends with an unfavourable opinion. We wrote at length about how these stages connect in from self-assessment to audit.

## The role of the gap analysis

Even before the internal audit, a gap analysis compares the current state of security with the requirements of your CyFun level and shows exactly what is missing. It is the foundation on which you build everything:

- It tells you where you stand against the maturity target (3 out of 5 in CyFun).
- It turns abstract requirements into a concrete list of actions.
- It prioritises by risk, so that you invest first where it matters.

In the Certudo platform, the CyFun maturity self-assessment and the implementation plan, which constitute a structured gap analysis, are free. With their result in hand, the discussion with the auditor becomes much more precise, because you know in advance where you are vulnerable.

## What to ask before the contract

A suitable auditor answers concrete questions clearly. Before signing, ask:

- **Attestation:** Can you show me the DNSC attestation of cyber security auditor?
- **Experience:** Have you audited organisations in my sector and classification level?
- **Methodology:** How is the audit carried out, in what stages and what standards do you apply?
- **Evidence:** What evidence will you require and in what format? (See [NIS2 evidence and registers](/en/blog/dovezi-registre-nis2).)
- **Reporting:** How do you communicate the findings to me and what happens if non-compliances arise?
- **Deadlines and cost:** What is the estimated duration and how is the cost structured?

The quality and transparency of the answers say a lot about the seriousness of the auditor. An auditor who avoids questions about attestation or methodology is a warning sign.

It is worth noting the answers in writing and comparing them between several auditors. You are not necessarily after the lowest price, but the best fit: valid attestation, experience in your context, a clear methodology and communication in which the findings are explained, not just ticked off. A well-conducted audit leaves you not just an opinion, but also a better understanding of your own security, useful for maintaining compliance in the years to come.

## Warning signs when choosing the auditor

Beyond the positive criteria, it is worth recognising the signs that should make you cautious. An auditor who:

- **avoids or delays proof of the DNSC attestation** should not reach the contract stage;
- **promises a guaranteed favourable opinion** before seeing the real state of your measures confuses the audit with a formality, which puts at risk the very value of the opinion;
- **does not require concrete evidence** and is content with declarations does not perform a real audit, but a superficial one;
- **does not explain the methodology** or describes it vaguely risks delivering a result you cannot defend.

An audit has value precisely because it is rigorous and independent. An auditor who promises you the easy road is in fact selling you a hidden risk: a fragile opinion that does not hold up to a later check.

## Why preparation matters more than the auditor

However good the auditor is, they do not create your compliance; they only confirm it. The result of the audit depends above all on how well you have implemented the measures and how clear the evidence is. That is why most of your effort and budget should go into preparation, not into the audit.

Solid preparation means: correct classification, an honest maturity self-assessment, an implementation plan prioritised by risk, controls implemented effectively and evidence collected as you work. When you arrive before the auditor with all of this up to date, the audit becomes a confirmatory formality, not a source of surprises. This is exactly the logic we detail in [from self-assessment to audit](/en/blog/autoevaluare-audit-nis2) and in the sections about the preparation [services](/en/servicii).

## How Certudo helps you

Our role is to bring you prepared before the attested auditor, without surprises. The platform offers you classification, the risk analysis, the CyFun maturity self-assessment and the implementation plan for free, and the consultancy at the self-assessment helps you go through this pre-implementation phase correctly and build the plan. The external audit is performed by DNSC-attested auditors, partners or in-team, so that the opinion has official value.

See the [NIS2 audit service](/en/servicii/audit-nis2) and the full range of [services](/en/servicii), then we discuss your situation concretely.

Start the classification for free

Want to discuss the audit and how we prepare you for it? Contact us and we will explain the steps, from the gap analysis to the official audit.