← All articles Compliance · NIS2

NIS2 in Romania:
a guide for
essential entities

The NIS2 Directive (EU 2022/2555) is transposed in Romania by Government Emergency Ordinance (GEO) no. 155/2024 (approved by Law 124/2025). The directive's transposition deadline was 17 October 2024; the ordinance was published on 31 December 2024 and targets essential and important entities. Here is what you need to do in practice.

Who falls under NIS2 in Romania

GEO 155/2024 distinguishes essential and important entities, by sector and size. The sectors:

Sectors of high criticality (generally essential entities)

• Energy (electricity, gas, hydrogen, oil)
• Transport (air, rail, maritime, road)
• Banking and financial markets
• Health (hospitals + medicine manufacturers)
• Drinking water + waste water
• Digital infrastructure (DNS, TLD, cloud, data centers)
• Public administration (central + ICT support services)
• Space

Other critical sectors (generally important entities)

• Postal and courier services
• Waste management
• Food production, processing and distribution
• Manufacturing (medical devices, computers, machinery)
• Digital services (search engines, marketplaces, social networks)
• Research

Size threshold: minimum 50 employees OR 10 million EUR turnover / balance sheet total. (In the critical sectors, certain entities fall under it regardless of size.)

The 10 measures of Article 21

Article 21 NIS2 + GEO 155/2024 require ten categories of measures. The table shows the ones Deceneu checks; for business continuity and disaster recovery, and for cyber hygiene and training, we offer no coverage.

Measure	CAI-Deceneu coverage
1. Risk analysis policies	External configuration check (Compliance Check, €5); internal policies remain the entity's job
2. Incident handling	NIS2 incident summary generated from an audit, through the API, and Wazuh/Sigma detection rules
4. Supply chain security	Code Audit + SBOM
5. Acquisition/development security	Code Audit (€15)
6. Effectiveness assessment	Repeated audits and scheduled monitoring
8. Cryptography policies	Site Audit (TLS check)
9. Human resources security	Authentication and access control checks; the human resources part stays with the entity
10. MFA and secured communications	SPF/DKIM/DMARC/MTA-STS checks for e-mail; multi-factor authentication stays with the entity

Incident reporting — the deadlines

NIS2 introduces 3 deadlines with major impact:

• 24h — early warning (DNSC + CSIRT)
• 72h — incident notification (with indicators of compromise)
• 1 month — final report with lessons learned

Penalties for essential entities: max 10 million EUR or 2% of global annual turnover. For important entities: max 7 million EUR or 1.4%.

How an entity prepares

1. NIS2 gap self-assessment — external NIS2 check with Compliance Check (€5)
2. Notification to DNSC as an essential/important entity
3. Appointment of a CSO/CISO, internal or outsourced
4. Incident handling plan, documented + tested
5. Annual audit — Full Audit (€40 per run), repeated every year
6. Supply chain audit — verification of critical ICT suppliers

What to ask for in a pentest contract

Article 21(2)(f) NIS2 requires policies for assessing the effectiveness of measures, but it does not prescribe the content of a contract. If you hire a pentest provider, it is worth asking in writing for:

• Frequency: annual and after major changes
• Scope: Internet-exposed applications + critical infrastructure
• The standards the testing follows (for example OWASP Top 10, ISO 27001)
• Report retention: the term set in the contract; archive the report yourself as well
• Confidentiality: non-disclosure agreement (NDA) and restricted access to results
• Post-remediation re-test: whether it is included and within what interval

Official resources

• Directive (EU) 2022/2555 — NIS2 text
• DNSC — National Cyber Security Directorate
• GEO 155/2024, published in the Official Gazette on 31 December 2024 (approved by Law 124/2025)
• ENISA — EU Agency for Cybersecurity