# NIS2 in the public sector: which cyber security measures become mandatory for city halls? > NIS2 for public administration: city halls and public institutions have obligations of registration, risk analysis, CyFun self-assessment, measures and incident reporting. NIS2 does not target only private companies. Public administration, from ministries and agencies to city halls, is explicitly included in the scope. Moreover, the first DNSC sanctions targeted precisely the public sector, which makes preparation urgent for institutions. ## Why public administration falls under NIS2 OUG 155/2024, which transposes Directive (EU) 2022/2555 into Romania, lists the covered sectors in its annexes. Among them is the public administration sector (sector 10), which brings public institutions, central and local, within the NIS2 perimeter. The logic is simple: public institutions provide essential services for citizens and manage large volumes of data and information systems. An interruption or an attack on these systems directly affects the functioning of the state and public trust. That is why cyber resilience requirements apply to them just as they do to private operators in critical sectors. The concrete classification, including as an essential or important entity, depends on the criteria in the law. For a quick check, use the [free classification tool](/incadrare-inregistrare.html) or read [essential or important entity](/en/blog/entitate-esentiala-sau-importanta-nis2). ## Central administration and local administration The public administration sector covers both the central level (ministries, agencies, national authorities) and, under the conditions of the law, the local level (county councils, city halls). The differences in capacity are large: a central authority usually has IT and security structures, whereas a city hall in a small locality may operate with very limited resources. NIS2 does not erase these differences, but requires that the measures be proportionate to the risk, not identical for everyone. In other words, a small institution does not have to implement measures at the level of a national authority, but measures appropriate to its own risk profile, documented and owned by management. Important to keep in mind: the fact that an institution is small does not automatically take it out of the scope of obligations. The concrete classification results from the legal criteria, and checking it is the first responsible step, not an assumption. ## What obligations a public institution has The obligations are, in essence, the same as for any entity covered by NIS2, adapted to the institutional specifics: - Registration and notification with DNSC, exclusively through the NIS2@RO platform, with a qualified electronic signature. See the [DNSC registration](/en/blog/inregistrare-dnsc-nis2) guide. - Risk analysis of the networks and information systems used to provide the services. - Maturity self-assessment on the [CyFun framework](/en/cyfun), the methodology adopted by DNSC, to measure where the institution stands against the required level. - Implementation of security measures proportionate to the risk: policies, access control, backups, business continuity, cyber hygiene and training. - Reporting of significant incidents to DNSC, within the legal deadlines. See [incident reporting](/en/blog/raportare-incidente-dnsc-nis2). - Designation of a NIS officer and training of management and staff. One thing to keep in mind: the institution's management approves and oversees the measures and can be held liable for failure to meet the obligations. Cyber security is not just the responsibility of the IT department. More in the article on [management liability](/en/blog/raspunderea-conducerii-nis2). ## Why it matters: the first sanctions targeted the public sector For public institutions, the clearest signal comes from enforcement practice. The first NIS2 fine applied by DNSC, of 50,000 lei, targeted an institution in central public administration, for failing to meet the notification deadline. The message is unequivocal: the public sector does not benefit from an informal grace period. The first controls focused on the basic administrative obligations, in particular notification and registration, and an institution does not need a security incident to be sanctioned. For context, see the analysis of the first DNSC fine and NIS2 fines. ## Challenges specific to the public sector Public institutions have particularities that call for a careful approach: - Regulated budgets and procurement, which can slow down the implementation of measures if they are not planned in advance. - Legacy information systems, sometimes old, hard to secure without dedicated projects. - The lack of dedicated cyber security staff, especially in small institutions, such as city halls in small localities. - Dependence on external suppliers for IT services, which brings supply chain security to the fore. None of these challenges is a reason to postpone. On the contrary, they show why the basic steps, largely free, must be taken as early as possible. ## Security of suppliers and outsourced services Many public institutions depend on external suppliers for hosting, applications, maintenance or IT support. NIS2 brings supply chain security to the fore, which means that an institution remains responsible for the services it uses, even if a third party operates them. In practice, this requires clear contractual clauses on security, the allocation of responsibilities in case of an incident and verification that suppliers meet appropriate requirements. For a city hall that has no IT team of its own, the relationship with the supplier becomes, in fact, a central element of compliance, not an administrative detail. ## Concrete measures for an institution with limited resources Even with a reduced budget and staff, an institution can take useful steps immediately, without complex projects: - An inventory of systems and services: which applications, servers and data are essential for the activity. - Access control and authentication, including strong passwords and, where possible, multi-factor authentication. - Backups tested periodically, not just configured and forgotten. - Updates and basic cyber hygiene for workstations and servers. - Training of staff on frequent risks, for example phishing and e-mail fraud. - An incident response plan: a written, simplified procedure for handling security incidents, setting out the steps for internal alerting and the authorities that must be notified. These measures do not, in many cases, require large investments, but organisation and discipline. They reduce both the real risk and the exposure to sanctions at the same time. ## What a city hall or an institution should do now A reasonable action plan, in order of priority: - Check the classification and, if you have not done so, file the notification with DNSC. It is the top priority, especially since the initial deadline has passed, but the obligation remains. Start with the [classification and registration tool](/incadrare-inregistrare.html). - Designate the NIS officer and make sure they have a mandate and contact details communicated to DNSC. - Carry out the risk analysis. You can start from the [free risk analysis tool](/analiza-risc.html). - Perform the CyFun maturity self-assessment and identify the gaps against the required level. The self-assessment and the plan of measures are free. - Plan the measures and document the evidence (policies, registers, procedures). See [NIS2 evidence and registers](/en/blog/dovezi-registre-nis2). - Train management and staff, an obligation reinforced by the legal framework. For institutions that need specialised support, Certudo offers [NIS2 consultancy](/en/servicii/consultanta-nis2) and [NIS2 audit](/en/servicii/audit-nis2) performed by DNSC-attested cyber security auditors. The CyFun self-assessment and the plan of measures remain free in the platform. A useful aspect for the public sector: because public procurement takes time, it is worth planning any costs (qualified electronic signature, external services, tools) in the budget well in advance. Administrative procurement delays are not an excuse against the legal obligations, so anticipating them makes the difference between orderly compliance and one done in a rush, under pressure. ## Conclusion Public administration is on the front line of NIS2 enforcement in Romania, both in terms of obligations and sanction risk. The good news is that the initial steps are clear and, for the most part, free. A city hall or an institution that registers on time and goes through the risk analysis and the CyFun self-assessment significantly reduces both its exposure to fines and the real cyber risk. Check your classification and prepare the notification (free) Do you need support for your institution? Contact the Certudo team.