Short answer
A company generally falls under NIS2 if it operates in one of the sectors listed in the directive's annexes (for example energy, transport, health, water, digital infrastructure, manufacturing, food, courier services, waste) and has at least 50 staff or more than €10 million in turnover and balance sheet. Some entities are covered regardless of size. Covered companies must register with DNSC, apply security measures and report incidents within 24 and 72 hours.
What NIS2 is
NIS2 is the EU directive on cybersecurity. Romania transposed it through Emergency Ordinance 155/2024, and the competent authority is the National Cyber Security Directorate (DNSC). Compared with the first NIS directive, it covers far more sectors and companies.
Step 1: the sector
Check whether your activity appears in the directive's annexes:
- Sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water and waste water, digital infrastructure, ICT service management (business to business), public administration, space.
- Other critical sectors: postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles), digital providers (online marketplaces, search engines, social networks), research.
Step 2: the size
The general rule: medium and large companies are covered, meaning 50 staff or more, or annual turnover and balance sheet above €10 million. Partner and linked companies count too, not just the legal entity on its own.
Step 3: the exceptions
Some entities are covered regardless of size, for example providers of public electronic communications networks or services, trust service providers, domain registries and DNS providers, some public administration bodies, and companies that are the only provider of an essential service in an area.
If NIS2 applies to you
- Register with DNSC.
- Risk-management measures: risk analysis, backup and business continuity, two-step sign-in, access control and an asset inventory, patching, supplier security, encryption, staff training.
- Report significant incidents: an early warning within 24 hours, a notification within 72 hours and a final report within about a month.
- Involve management: management approves the measures, takes training and is accountable for them.
If it doesn't apply, but you are a supplier
NIS2 companies must also check their supply chain. If you work for one, expect security questionnaires and new contract clauses: tested backups, two-step sign-in, incident notification. Preparing early helps you keep the customer.
How we can help
We review your readiness, set the priorities, implement the technical measures, write the policies and incident plan, and train your team. This guide is general orientation, not legal advice; for your exact situation check the text of EO 155/2024 and DNSC's guidance.