What NIS2 is and what the compliance obligations are
NIS2 is the European cybersecurity directive, transposed in Romania through OUG 155/2024 and approved by Law 124/2025. It extends security obligations to far more organizations than before, across essential and important sectors, with the aim of increasing cyber resilience across the EU for critical systems and infrastructure.
Who falls under NIS2
Essential and important entities, by sector (the NIS2 annexes in OUG 155/2024) and size, but also by the impact they have on the critical service. As a rule, at least medium-sized enterprises, meaning over 50 employees or more than 10 million euros in turnover, may be classified as important or essential entities (as the case may be).
What the requirements are
Implementation of technical and organizational security measures proportionate to the risk, governance owned by management, supply chain management, continuity and incident reporting to DNSC.
The timeline of actions
Registration with DNSC, risk assessment, maturity self-assessment, implementation of measures, then internal audit and periodic external audit.
What comes next
Compliance is maintained: annual confirmations through maturity self-assessments reported to DNSC, management and monitoring of the implementation, of security indicators and risks, incident reporting, staff training and periodic audits. It is a continuous process, a living system, not a one-off or isolated project.