NIS2 Compliance
- Home
- NIS2
NIS2 compliance for companies in Brașov and across Romania
The NIS2 Directive was transposed into Romanian law by Emergency Ordinance (OUG) 155/2024, approved by Law 124/2025. We help you find out whether your company falls under the law, go through the steps required by DNSC and, above all, implement the technical measures that actually protect you.
Does NIS2 apply to you?
The law does not apply only to banks and energy companies. Many manufacturing and service companies in Brașov are covered, either directly or through their customers.
Medium and large companies in the covered sectors
At least 50 employees, or annual turnover and balance sheet total above EUR 10 million, operating in one of the sectors listed in the annexes of the law.
Some entities, regardless of size
For example providers of electronic communications networks or services, trust service providers, DNS service providers and entities designated as critical.
Suppliers of NIS2 entities
Covered entities must manage supply chain risks. In practice, more and more customers ask their suppliers for proof of security and specific contract clauses.
Sectors of high criticality: energy, transport, banking, financial market infrastructures, health, drinking water and waste water, digital infrastructure, ICT service management (B2B), public administration, space.
Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, electrical equipment, machinery and equipment, motor vehicles, other transport equipment), digital providers, research.
What a NIS2 entity must do
The process defined by DNSC has clear deadlines, counted from the moment a company falls under the law.
Notifying DNSC30 days
Registering the entity using the NIS2@RO form and appointing a person responsible for the security of network and information systems.
Risk level assessment60 days
After DNSC issues its identification decision, the entity assesses its risk level using the DNSC methodology.
Maturity self-assessment60 days
Assessing existing security measures against the catalogue in DNSC Order 1/2026, for both documentation and implementation.
Remediation plan30 days
Mandatory for essential entities and for important entities that do not meet the required thresholds. The self-assessment is repeated every year.
Incident reporting24h / 72h / 30 days
Early warning within 24 hours, notification within 72 hours and a final report within 30 days for significant incidents.
Management is directly accountable: management bodies approve the security measures, oversee their implementation and must attend regular cybersecurity training.
What you risk if you do not comply
or 2% of worldwide annual turnover, the maximum for essential entities
or 1.4% of worldwide annual turnover, the maximum for important entities
for management, plus the risk of losing customers who require proof that their suppliers comply
From assessment to real protection
We do not just deliver documents. We are the integrator that configures your firewall, backup and monitoring, then documents them so you can present them in your self-assessment or during an inspection.
1. Initial assessment
Together we establish whether and how NIS2 applies to you and where you stand against the requirements.
- scope and sector analysis
- support with the DNSC notification
- technical gap analysis
2. Risk assessment and self-assessment
We help you go through the steps in DNSC Order 1/2026 with concrete technical evidence.
- security risk assessment
- preparing the maturity self-assessment
- prioritized remediation plan
3. Implementing technical measures
The measures that actually reduce risk, implemented by our team.
- multi-factor authentication and access control
- firewall hardening and network segmentation
- patch management and IT asset inventory
- backup with off-site copies in Brașov and restore tests
4. Monitoring and incidents
Detect problems early and meet reporting deadlines.
- security event monitoring (SIEM)
- alerting and incident investigation
- support with reporting to DNSC
5. Policies and documentation
The required documents, tailored to your actual infrastructure.
- security and access policies
- incident response and business continuity plans
- supplier register and assessment
6. Training
For management, which has its own obligations, and for employees, your first line of defence.
- management body training
- phishing awareness and good practices
A technical team close to you
- We are based in Brașov and can work on site at your premises, not only remotely.
- We work with enterprise infrastructure every day: Fortinet, VMware, Microsoft, Proxmox.
- We implement and document the same measures, so the evidence for your self-assessment already exists.
- Off-site backups stay on our own infrastructure in Brașov, not in a public cloud.
- After compliance, we can also take over day-to-day IT management as a monthly subscription.
- We respond within 4 working hours at most.
Questions about NIS2
My company has fewer than 50 employees. Does NIS2 apply to me?
As a rule, small and micro enterprises are not directly covered, with the exceptions set out in the law. However, if you supply products or services to NIS2 entities, you are very likely to be asked for security measures by contract. It pays to be prepared.
We have not registered with DNSC yet. What should we do?
Submit the notification as soon as possible. DNSC has started its checks with unregistered entities, and a late registration is still better than none. We can help you prepare the required information.
How long does compliance take?
It depends on the size of the company and its current security level. The initial assessment takes a few days; implementing the technical measures can take from a few weeks to a few months. After the assessment you receive a plan with priorities and estimates.
Do you also handle the legal side?
We cover the technical side and the security documentation. For legal interpretation, such as borderline classification cases, we recommend also working with a legal advisor. We are happy to work alongside them.
We already have an IT provider. Does it still make sense to talk?
Yes. We can handle only the NIS2 assessment and implementation, working together with your existing IT team or provider.
The information on this page is general in nature, is current as of September 2026 and does not constitute legal advice. The final classification of an entity is decided by DNSC.
Let's talk about your company's NIS2 compliance
Leave us a message and we will get back to you within 4 working hours. You can also call us directly at +40 742 087 732 or email contact@bithub.ro.