Cybersecurity
Risk assessment, NIS2 readiness and security built into your applications.
NIS2 in Romania: technical steps under GEO 155/2024
In short
- Romania transposed NIS2 through Government Emergency Ordinance (GEO) 155/2024, in force since 31 December 2024 and approved with amendments by Law 124/2025.
- DNSC orders of 20 August 2025 set registration: within 30 days for entities already in scope, then a risk-level assessment within 60 days of DNSC's communication.
- A missed deadline does not remove the obligation to register. Technical steps can start now: inventory, risk assessment, MFA, tested backups, incident plan.
This guide covers technical and organizational steps. Whether a company is an essential or important entity must be confirmed legally.
The legal framework in brief
- Directive (EU) 2022/2555 (NIS2) sets measures for a high common level of cybersecurity across the Union.
- GEO 155/2024 transposed the directive in Romania and entered into force on 31 December 2024.
- Law 124/2025, in force since 10 July 2025, approved the ordinance with amendments and widened the scope for the highly critical sectors in Annex 1.
- DNSC orders of 20 August 2025 set the registration notification process and the risk-level assessment methodology. DNSC is Romania's National Cybersecurity Directorate.
Who falls under GEO 155/2024
The first step is checking the activities listed in Annexes 1 and 2 of the ordinance. In general:
- Essential entities: mainly large enterprises in the highly critical sectors of Annex 1.
- Important entities: medium and large enterprises in Annexes 1 and 2 not classified as essential.
- Some entities are in scope regardless of size because of their role in a sector.
Deadlines that apply
| Obligation | Deadline |
|---|---|
| Registration notice to DNSC (entities already in scope) | 30 days from entry into force of the DNSC order of 20 August 2025 |
| Notice for entities that come into scope later | 30 days from the date the provisions apply to them |
| Risk-level assessment | 60 days from DNSC's communication identifying the entity |
| Appointing persons responsible for network and information system security | 30 days from notification of DNSC's decision |
| Maturity self-assessment | Annually |
| Remediation plan (essential entities) | 30 days after the self-assessment |
Missing the registration deadline does not remove the obligation. The ordinance also provides for management liability for non-compliance.
The technical plan for the first 90 days
Days 1–30: clarity and inventory
- Classification confirmed legally; DNSC notification sent if it applies
- Responsible persons appointed by management
- Inventory of systems, critical data and suppliers with access
Days 31–60: risks and quick wins
- Risk assessment of critical systems
- Multi-factor authentication for administrative and remote access
- Backups verified by a real restore test
- Incident response plan with roles and notification deadlines
Days 61–90: maturity and plan
- Maturity self-assessment
- Remediation plan ranked by risk and cost
- Logging and monitoring for critical systems
- Training for management and staff
A useful framework for organizing the measures is the NIST Cybersecurity Framework 2.0, with its govern, identify, protect, detect, respond and recover functions.
Gap analysis and remediation planning are part of our cybersecurity service. For a broader infrastructure review, see IT consulting.
Sources
Related services
Useful guides
What you need for a software project estimate
The ten inputs that turn a vague estimate into one you can rely on.
Integrating with RO e-Factura: a technical guide
Architecture, flow and typical errors when invoices originate in your own system.
Want to know where you stand on NIS2?
We run the technical gap analysis and build a remediation plan ranked by risk.