Interactive guide · NIS2 · Consulting and audit
NIS2 consulting, from scoping to audit
How a NIS2 consulting project runs in Romania: scoping, gap analysis, risk, documentation, measures, audit and handover. For each stage you see what is done, what you receive and which legal deadline applies.
The stages at a glance
- Stage 1
Scoping assessment
Notification through NIS2@RO within 30 days of the Emergency Ordinance becoming applicable to the entityScoping report and the list of obligations that apply to the organisation.
- Stage 2
Gap analysis
The current situation compared with the applicable requirements, on the technical and organisational sideGap analysis report and a prioritised action plan.
- Stage 3
Risk analysis
The ENIRE@RO risk level assessment is submitted within 60 days of the DNSC decisionRisk register and risk treatment plan.
- Stage 4
Compliance documentation
Documents are formally approved by management before they become binding internallyPolicies and procedures, incident response plan, reporting mechanisms.
- Stage 5
Technical and organisational measures
Measures are implemented according to the assurance level validated by DNSCMeasures in operation, with owners and evidence.
- Stage 6
Compliance audit
Results of any security audit go to DNSC within 5 days of completionAudit report with the non-conformities found and a remediation plan.
- Stage 7
Inspection readiness and handover
Action plan after an inspection within 15 working days of the inspection noteCompliance system handed over and ready for inspection.
Frequently asked questions
How do I know if my organisation falls under NIS2?
In most cases three criteria decide: the sector in the annexes of Emergency Ordinance 155/2024, size (at least 50 employees or turnover above EUR 10 million) and position in the supply chain of an essential or important entity. The NACE (CAEN) code alone is not enough.
Can we contract only the audit?
Yes. Consulting and the compliance audit can be contracted together or separately. The audit starts at EUR 5,000 per engagement.
What does a consulting project cost?
Consulting and implementation start at EUR 10,000 per project. The final offer depends on the scoping assessment, the size of the organisation, its infrastructure and existing documentation.
Is documentation enough for compliance?
No. Audits and inspections check whether measures actually work. Documentation must describe what is really applied.
What happens after the project ends?
The system has to be maintained. The officer role can be taken over internally or outsourced to ProDefence.
Talk to ProDefence
The same teams that write the compliance documentation also run the technical testing, incident analysis and training. The preliminary scoping discussion is free, and if your organisation is not in scope for NIS2, we will tell you directly.
Legal obligations follow Emergency Ordinance 155/2024 in its consolidated form, approved by Law 124/2025, and DNSC Order 1/2026, checked on 26 October 2026. Prices are starting points; the final offer follows the scoping assessment.
For information only. Check the consolidated legal texts and the current version of the DNSC tools before any submission. The Romanian version prevails.