Interactive guide · NIS2 · Essential entities
NIS2 implementation for essential entities
The seven stages an essential entity goes through in Romania, from scoping to maintenance, with the deadlines set by Emergency Ordinance 155/2024 and the DNSC orders. Select a stage to see what it covers, what it produces and how we can help.
The seven stages at a glance
- Stage 1
Scope and notification
Notification through NIS2@RO within 30 days of the date the Emergency Ordinance becomes applicable to the entityScoping file and confirmation of notification. DNSC issues the identification and registration decision within 60 days for essential entities.
- Stage 2
Governance and NIS2 officer
NIS2 officer appointed within 30 days of the DNSC decision being communicatedGovernance decisions approved and communicated.
- Stage 3
Scope and risk level
Risk level assessment with ENIRE@RO, signed by the legal representative, within 60 days of the DNSC decisionApproved inventory and risk level submitted. Entity category and assurance level are separate: an essential entity may be validated at the Important or Basic level.
- Stage 4
Self-assessment and action plan
First self-assessment within 60 days of submitting ENIRE; action plan to DNSC within 30 daysSelf-assessment owned by management and submitted; action plan approved.
- Stage 5
Design and implementation
Design Z+60 … Z+180; implementation Z+90 … Z+365, prioritised by riskControls in operation, with initial evidence.
- Stage 6
Stabilisation and audit
Results of any security audit go to DNSC within 5 days; action plan within 15 working daysAudit report, action plan and retest.
- Stage 7
Maintenance and annual review
Annual self-assessment, no more than 12 months after the previous one, owned by managementA working annual cycle and continuous improvement.
Frequently asked questions
What is the first deadline for an essential entity?
Notification for registration through the NIS2@RO platform, within 30 days of the date Emergency Ordinance 155/2024 becomes applicable to the entity. DNSC then issues the identification and registration decision within 60 days of notification.
What does Z mean?
Z is the date the DNSC identification and registration decision is communicated. The 30-day deadline for appointing the NIS2 officer and the 60-day deadline for the ENIRE@RO risk assessment run from it.
How many security controls must be implemented?
It depends on the assurance level DNSC validates from the ENIRE@RO score: 34 controls at the Basic level, 133 at the Important level and 218 at the Essential level. Entity category and assurance level are separate concepts.
Must the action plan be submitted to DNSC?
Yes. Essential entities submit the action plan for remediating gaps within 30 days of the self-assessment.
How can ProDefence help?
ProDefence covers every stage: scoping, NIS2 consulting and audit, an outsourced NIS2 officer, penetration testing, incident analysis and courses for management and staff. The preliminary scoping discussion is free of charge.
Work through the stages with ProDefence
The same teams that write the compliance documentation also run the technical testing, incident analysis and training. The preliminary scoping discussion is free, and if your organisation is not in scope for NIS2, we will tell you directly.
Deadlines follow Emergency Ordinance 155/2024 in its consolidated form, approved by Law 124/2025, DNSC Order 1/2026 (supplemented by DNSC Order 2/2026) and the Methodology approved by DNSC Order 2/2025, checked on 26 October 2026.
For information only. Check the consolidated legal texts and the current version of the DNSC tools (NIS2@RO, ENIRE@RO, EVAL-MMS) before any submission. The Romanian version prevails.