NIS2 is the European Directive (EU) 2022/2555 on a high common level of cybersecurity across the Union. In Romania it was transposed through Emergency Ordinance 155/2024, approved by Law 124/2025, and the implementation details come through orders and methodologies of the National Cyber Security Directorate (DNSC). In short, it is the framework that states what essential and important organizations holding critical infrastructure must do to protect themselves against cyberattacks and to remain resilient.
What changed compared to NIS1
The first NIS directive covered a few hundred operators in a few sectors. NIS2 greatly extends the perimeter: thousands of organizations are covered, from several new sectors, and the identification rules are clearer. In addition, the framework becomes more demanding on three levels: management responsibility, supply chain risk management and incident reporting within strict deadlines.
Who falls under it
The general rule combines sector with size. If you operate in a covered sector and you are at least a medium-sized enterprise (approximately 50 employees or over 10 million euro in turnover), you most likely fall under it. There are also entities that are covered regardless of size, by the nature of the service (for example electronic communications, domain name registries, qualified trust service providers). Organizations are divided into essential entities and important entities, with different supervision regimes.
What obligations it brings, concretely
NIS2 does not ask you to tick security off once, but to maintain a continuous risk management process. The minimum measures include, among others: risk analysis and information security policies, incident handling, business continuity and backups, supply chain security, security in the acquisition and maintenance of systems, cryptography, access control and multi-factor authentication, cyber hygiene and training. All proportionate to the real risk of the organization.
The management is accountable
An important novelty: security is no longer solely the responsibility of the IT department. The management body approves the measures, oversees the implementation and can be held accountable for failing to meet the obligations. For essential entities, the penalties can be substantial, and in serious cases measures up to the temporary suspension of certain management functions can be imposed.
Incident reporting
Significant incidents are reported to DNSC in stages: an early warning within 24 hours, a more complete notification within 72 hours and a final report within approximately one month. The deadlines are short, which is why it matters to have the procedure and the forms prepared in advance.
How it translates into practice: CyFun
NIS2 shows what must be achieved, but does not go into technical details. For that, DNSC adopted the CyFun framework (CyberFundamentals, from the Belgian authority) as the methodology: a structured collection of controls, with levels and a maturity scale. This way, the general obligations become concrete, measurable steps.
It seems like a lot at first, but once you know which category you fall into and what level is required of you, you have a clear direction to follow. You can get a first reference point in a few minutes with our free entity classification tool.