NIS2 compliance cost in Romania: budget breakdown

The cost of NIS2 compliance in Romania depends on the risk level set by DNSC, the size of the organisation and how mature its security already is. There is no single price. The budget is made up of internal time, consulting, audit, the NIS officer, documentation, technology and training, and each can be estimated separately.

Key points

A NIS2 budget has seven components; internal time and technical remediation are the most underestimated.
The assurance level (Basic, Important or Essential) decides how many controls apply: 34, 133 or all 218 in DNSC Order 1/2026.
Some costs are one-off (the initial project, documentation), others recur (annual self-assessment, the NIS officer, training).
Liability stays with the management body, which approves the measures and must allocate resources (Art. 14 of GEO 155/2024).
Non-compliance has its own price: fines of up to EUR 10 million or 2% of turnover for essential entities.

Why is there no fixed price for NIS2?

GEO 155/2024, Romania’s NIS2 transposition, requires measures that are “proportionate and appropriate” to the entity’s risk level (Art. 11(1) and (2)). Proportionality is judged by exposure to risk, entity size, the likelihood and severity of incidents and their social and economic impact (Art. 11(10)).

Two companies in the same sector can therefore end up with very different budgets. DNSC Order 1/2026 splits the controls into three assurance levels:

Assurance level	Applicable controls	Maturity threshold
Basic	34	2.5
Important	133	3
Essential	218	3.5

The organisation does not choose its level. It follows from the risk-level assessment under the methodology in DNSC Order 2/2025 (Art. IV of Order 1/2026). Any serious estimate starts there. The control catalogue is explained in our article on CyFun and the 218 controls.

What goes into a NIS2 budget?

1. Internal time

Almost every estimate leaves this out. Management must approve the measures and oversee them. IT inventories assets, applies controls and collects evidence. Legal reviews supplier contracts. HR runs training. Even if you outsource much of the work, people inside the organisation still provide information and make decisions.

2. Implementation consulting

A consultant runs the gap analysis against the applicable controls, the risk analysis, the implementation plan and the documentation, then supports roll-out. ProDefence NIS2 consulting starts at EUR 10,000 per project. The price rises with the number of sites, critical systems and entities in a group.

3. The NIS officer

Each entity must appoint the persons responsible for network and information system security within 30 days of DNSC’s registration decision (Art. 14(3)). You can hire or outsource. ProDefence’s outsourced NIS2 officer starts at EUR 1,200 per month on a 12-month contract. For essential entities (with the statutory exceptions), the person must meet five cumulative conditions, including reporting directly to management and completing a DNSC-recognised accredited course within 12 months (Art. 14(4)).

4. Documentation

Policies, procedures, registers, continuity and incident response plans. You can write them in-house, get them through consulting, or buy a ready-to-adapt package. ProDefence NIS2 documentation packages cost EUR 1,500 for an important entity and EUR 2,000 for an essential entity, one-off, licensed to a single organisation.

5. Technical remediation

This is where budgets diverge. Multi-factor authentication, logging and traceability of activity (Art. 11(4)), backups and disaster recovery, vulnerability management, network segmentation. An organisation that already has these practices pays little; one starting from scratch can spend more on technology than on everything else combined.

6. Audit

Entities must undergo a security audit at intervals to be set by DNSC order (Art. 11(5)). The interval is not yet regulated, but the audit belongs in the budget. ProDefence’s NIS2 audit starts at EUR 5,000 per engagement. An auditor cannot audit its own implementation work, so consulting and audit need to be contracted with incompatibilities in mind.

7. Training

Members of management bodies must attend accredited training, and all staff must be trained regularly (Art. 14(2)). It is a small per-person cost that scales with headcount.

Which costs are one-off and which recur?

Component	Cost type	Note
Gap analysis and plan	One-off, updated	Redone when the risk level changes
Documentation	One-off, with reviews	Policies are reviewed periodically (Art. 13(a))
Technical remediation	Mostly one-off	Licences and maintenance recur
NIS officer	Recurring	Monthly, in-house or outsourced
Maturity self-assessment	Recurring, annual	Sent to DNSC, signed off by management (Art. 12(4))
Remediation plan	Recurring	Within 30 days of the self-assessment, essential entities (Art. 12(5))
Training	Recurring	Management and staff
Audit	Periodic	Interval not yet regulated

The split matters when the budget goes for approval: the compliance project can be funded as an investment, but the officer, self-assessment and training belong in operating costs.

What pushes the cost up or down?

Cost drivers:

Essential assurance level, with all 218 controls;
several entities in a group, each with its own obligations (see NIS2 in groups of companies);
legacy systems without logging or MFA support;
operational technology (OT) in energy, water or transport;
no asset inventory or prior risk analysis;
critical suppliers with no security clauses.

Cost reducers:

an information security management system already in place;
existing documentation that can be adapted rather than rewritten;
an IT team that already documents changes and incidents;
an honest initial self-assessment that avoids work on controls already met.

What does non-compliance cost?

GEO 155/2024 has two fine tiers. For the offences in Art. 60(1)(n)-(t), fines range from RON 1,000 to 300,000 for important entities and RON 1,500 to 500,000 for essential entities. The upper tier reaches EUR 7 million or 1.4% of turnover for important entities and EUR 10 million or 2% for essential entities.

This is not theoretical. On 29 September 2026 DNSC issued its first fine under GEO 155/2024: RON 50,000 for failure to submit the registration notification. A major incident adds its own costs: downtime, rebuilding systems, notifications, lost customers.

How to plan a 12-month budget

Month 1: confirm scope and your risk level. An indicative first filter is the CysNIS scope check.
Months 1-2: appoint the NIS officer and run the gap analysis on your level’s controls.
Months 2-3: prioritise key measures and high-risk controls. Estimate remediation from the list, not by guesswork.
Months 3-9: implement, document, collect evidence.
Months 9-10: maturity self-assessment with the DNSC tool (see EVAL_MMS and the thresholds).
Months 10-12: remediation plan and audit preparation.

For a comparison of in-house, consultant-led and outsourced-officer implementation, read the three NIS2 implementation routes.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors, and ProDefence covers every component of the budget, with published starting prices. ProDefence is not VAT-registered, so the price shown is final.

NIS2 consulting: from EUR 10,000 per project.
NIS2 audit: from EUR 5,000 per engagement.
Outsourced NIS2 officer: from EUR 1,200 per month, 12-month contract.
NIS2 documentation packages: EUR 1,500 (important entity) and EUR 2,000 (essential entity), sold only to organisations in NIS2 scope for their own compliance programme.

For planning and tracking, CysNIS brings together the scope check, control assessment, risks and documentation of your NIS2 journey. For an estimate based on your situation, use the form on the consulting page.

Part of the training budget can be reduced by using existing material: the courses on CysEdu (in Romanian) cover tiered staff training, and CysGame (in Romanian) offers free interactive awareness games. Specific training for management bodies remains a separate budget line.

Frequently asked questions

What does NIS2 implementation cost on average?

There is no meaningful average, because the budget depends on the assurance level (Basic, Important or Essential), the number of systems and the starting maturity. A sound estimate comes after a gap analysis against the DNSC Order 1/2026 controls that apply to your risk level.

Do we have to hire a consultant?

No. GEO 155/2024 does not require consulting. You can implement in-house, with a consultant or with an outsourced officer. What is mandatory is the measures, the annual self-assessment, appointing the officer and the audit, and liability stays with management in every option.

What is the most underestimated cost?

Internal time and technical remediation. Management, IT, legal and HR are involved regardless, and controls such as MFA, logging and backups may need technology spending larger than the consulting fee.

Do ProDefence prices include VAT?

ProDefence is not VAT-registered, so the price shown is final. Published prices are starting points: consulting from EUR 10,000, audit from EUR 5,000, outsourced officer from EUR 1,200 per month, documentation EUR 1,500 or 2,000.

Which costs come back every year?

The annual maturity self-assessment sent to DNSC, the remediation plan for essential entities, the NIS officer, management and staff training, technology maintenance, and the audit at the interval DNSC will set.

How large can the fines be?

For some offences, RON 1,000 to 300,000 (important entities) and RON 1,500 to 500,000 (essential entities). The upper tier reaches EUR 7 million or 1.4% of turnover, and EUR 10 million or 2% respectively.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity and NIS2 compliance specialist at ProDefence, whose team includes DNSC-attested NIS auditors.