DNSC registration for NIS2: steps, documents and the NIS2@RO platform

If your organisation operates in a sector covered by NIS2, one of the first mandatory steps is registration with DNSC. This guide explains who must register, what data and documents to prepare, why you need a qualified electronic signature and how to file the notification through the NIS2@RO platform.

Who must register

The obligation to register falls on the essential entities and important entities identified under the annexes of OUG 155/2024, the act that transposes Directive (EU) 2022/2555 into Romanian law. The general rule combines two criteria: the sector of activity and the size of the organisation.

• You operate in a sector covered by the annexes of OUG 155/2024 (for example energy, transport, health, digital infrastructure, public administration, postal services, manufacturing, waste management and others).
• You exceed the size thresholds for a medium-sized enterprise, namely roughly 50 employees or more than 10 million euro in annual turnover.

There are also cases where an entity qualifies regardless of size, by the nature of the service provided (for example providers of public electronic communications networks, domain name registries or qualified trust service providers). To quickly check whether you fall under the law and in which category, use the free classification tool or read how to tell an essential entity from an important one.

What data and documents to prepare

Before entering the platform, it is worth having the identification and operational information ready. In general, the notification requires:

• The organisation's identification data: name, unique registration code (CUI), trade register number, registered office address and, if different, the correspondence address.
• The data of the legal representative and, where applicable, of the person authorised to file the notification.
• The contact details of the person responsible for the security of networks and information systems (the NIS officer), including the e-mail address and contact phone for communication with DNSC.
• The sector and subsector of activity from the annexes of OUG 155/2024, as well as the relevant CAEN code.
• The elements that justify classification as an essential or important entity (for example the number of employees and the turnover).

If you already have a clear record of the systems and services you operate, completion is much faster. Our classification and registration tool helps you structure this data and prepares the content of the notification, so you do not get stuck at the steps in the platform.

The NIS officer: who they are and what role they have

An element often overlooked at registration is the designation of the NIS officer, the contact person for the relationship with DNSC on the security of networks and information systems. Their role is not merely formal: in practice this person coordinates preparation of the notification, tracking of deadlines, implementation of measures and, when needed, incident reporting.

For registration to be useful, the NIS officer must have a clear mandate from management and working contact details, correctly communicated to DNSC (an e-mail and phone that someone actually answers). A generic, unchecked mailbox can mean that a request from the authority goes unanswered, with all the consequences that follow. In small organisations this role may be combined with others, but responsibility stays at management level, which approves and oversees the measures.

The qualified electronic signature

Filing the notification and signing documents in the platform require a qualified electronic signature, issued by a qualified trust service provider. The signature must belong to the legal representative or to the person expressly authorised. If the organisation does not yet have such a signature, this is one of the first acquisitions to make, because without it the process cannot be completed.

The NIS2@RO platform: where and how you file

Registration and filing of the notification are done exclusively through NIS2@RO, the electronic platform made available by DNSC. There is no alternative paper or e-mail route for this step. Broadly, the flow is as follows:

• You access NIS2@RO from the DNSC website and create the organisation's account.
• You authenticate and complete the notification form with the data prepared in advance.
• You attach the requested documents and sign the notification with the qualified electronic signature.
• You submit the notification and keep proof of filing (registration number, confirmation).

Keeping proof of filing is essential: it attests to the moment you fulfilled your obligation and is the starting point for the subsequent deadlines.

What comes after the notification: the classification decision

After the notification is filed, DNSC reviews the information and issues a classification decision, which confirms the status of essential or important entity and, with it, the applicable set of obligations.

From the moment you receive the classification decision, the deadlines for the next steps begin to run. In practice, you have a short period, on the order of 60 days, to file the initial risk analysis, in line with the DNSC methodology (Order 2 of OUG 155/2024). Next come the CyFun maturity self-assessment and the implementation plan. You can go through the first steps for free with the classification tool and the risk analysis.

For the full calendar of obligations and the associated deadlines, see NIS2 deadlines in brief.

Updating the data after registration

Registration is not a single moment frozen in time. If the declared data changes, for example the legal representative, the NIS officer, the contact details, the registered office or the elements that formed the basis of the classification, these changes must be reflected, as a rule by updating the information in the platform. Likewise, an organisation that grows and crosses new thresholds, or that enters a covered sector following a change of activity, may come within scope even if it did not qualify initially.

That is why it is worth treating the record of compliance data as a living process: a periodic review, at least annual, prevents the situation where the information in the platform no longer matches reality. The same discipline also helps you with the other obligations, from the risk analysis to incident reporting.

From registration to real compliance

Registration is only the beginning. Once you are in the DNSC records, the substantive part follows: the risk analysis, the maturity self-assessment on the CyFun framework, the implementation of measures and the preparation of incident reporting procedures. In short, the typical journey looks like this:

• Risk analysis of networks and information systems. You can start with the free risk analysis tool.
• Maturity self-assessment on the CyFun framework adopted by DNSC, to see where you stand against the required level.
• A plan of measures and implementation proportionate to the organisation's risk.
• Gap analysis and, where necessary, an audit performed by DNSC-attested cyber security auditors.

The CyFun self-assessment and the plan of measures are free in the Certudo platform. If you need specialised support, we also offer NIS2 consultancy and NIS2 audit services, the latter performed by DNSC-attested cyber security auditors.

Common mistakes to avoid

• Postponing registration because the initial deadline has passed. The obligation remains, and delay can be sanctioned.
• Not clearly designating the NIS officer and their contact details, which makes communication with DNSC harder.
• Preparing the notification without a qualified electronic signature and getting stuck at the last step.
• Treating registration as an end point rather than as the start of a continuous risk management process.

Want a clear first indication in a few minutes, at no cost? Check your classification and prepare the notification with our free tool, then we can discuss the next steps.

Check your classification and prepare the notification (free)

For an offer tailored to your organisation, contact the Certudo team.