Digital evidence is useful in a criminal case only if you can show where it came from, that it was not altered and who handled it from collection to filing. That requires fast preservation, full copies with cryptographic hashes, a register of every operation and a technical analysis that anyone can verify.

Key points

• Computer data disappears quickly: logs are overwritten, accounts are closed, messages are deleted. The first days matter more than the first months.
• The integrity of digital evidence is demonstrated through cryptographic hashes calculated at collection and through the chain of custody.
• The Romanian Code of Criminal Procedure provides for the preservation of computer data (art. 154), the search of computer systems carried out by a specialist (art. 168) and the handover of computer data (art. 170).
• Offences under articles 360-366 and 325 of the Criminal Code fall under DIICOT, the specialised prosecution directorate, whether or not an organised group is involved; computer fraud (art. 249) reaches DIICOT only when linked to an organised criminal group.
• The injured party can file a complaint and propose evidence. Solid technical documentation makes that proposal easier to assess.

What is digital evidence and why is it fragile?

In cybercrime, almost everything that matters exists as data: server logs, e-mail headers, sign-in history of a cloud account, an executable file, a messaging conversation, document metadata. Unlike a physical object, this data can be changed without visible traces, can vanish automatically after a retention period, or can be altered unintentionally by the very people trying to save it.

The classic example: after an incident, the system administrator opens the affected computer, browses through files, runs an antivirus scan and then reinstalls it. Each step changed file access times, erased traces from memory and finally removed any chance of reconstruction. The intention was good; the result is lost evidence.

The DNSC annual report for 2025 shows why this is no longer a niche topic: ransomware grew by 153%, account compromise reached 1,125 incidents (more than four times the 2024 figure), and fraud and attempted fraud reached 3,937. Many of these cases end up, sooner or later, in front of a prosecutor.

Chain of custody: “who touched the evidence?”

The chain of custody is the documentation that follows evidence from collection to filing. For every transfer or operation it records:

• what was collected (device, account, file, log export);
• from where, when and by whom;
• with which tool and method;
• the cryptographic hash calculated at collection;
• where it was stored and who had access;
• every later operation, with time and responsible person.

Why does the hash matter?

A hash function such as SHA-256 produces a unique value for any file or disk image. Change a single bit and the value changes completely. Calculated at collection and recalculated during analysis or in court, the hash shows that the examined data is identical to what was collected. Without it, any objection about integrity becomes hard to answer.

What does the Code of Criminal Procedure provide?

Without entering legal interpretation, which belongs to lawyers and prosecutors, several procedural tools are central for digital evidence:

Tool	CCP article	In short
Preservation of computer data	art. 154	The holder keeps data (including traffic data) when there is reasonable suspicion; the prosecutor can extend the measure once
Search of a computer system	art. 168	Examination of a system or storage medium, carried out by a specialist
Handover of objects, documents or computer data	art. 170	The holder is required to hand over the requested data

For the victim, the practical conclusion is simple: authorities can order these measures, but they work only if the data still exists. A company that exported logs in time, kept full copies and documented the incident gives the prosecutor material those measures can build on.

Where the case goes: DIICOT’s competence

Law 508/2004, article 12, sets DIICOT’s competence. Two situations stand out:

• Offences against the security of computer systems and data (articles 360-366 of the Criminal Code: illegal access, illegal interception, altering data integrity, disrupting system operation, unauthorised data transfer, illegal operations with devices or programs) and computer forgery (art. 325) fall under DIICOT regardless of whether an organised criminal group was involved.
• Computer fraud (art. 249, 2 to 7 years) and the other acts in articles 249-252 go to DIICOT when committed for the purposes of an organised criminal group. Otherwise, they remain with the ordinary prosecutor’s offices.

A public example: after the ransomware attack on Apele Române in December 2025, the criminal case was registered with DIICOT’s central structure on 22 December 2025, following the authority’s complaint.

Practical steps for a victim company

1. Stop unplanned interventions. Nobody reinstalls, formats or “cleans” affected systems before preservation.
2. Isolate, do not shut down. Disconnect systems from the network but keep them running if possible.
3. Export volatile logs. Cloud services, firewalls, VPNs and mail servers sometimes keep logs for only a few days.
4. Make full copies and calculate hashes. Disk and memory images, not just copies of a few files.
5. Open the custody register in the first hour.
6. Keep attacker communications in original format (with headers, not just screenshots).
7. Request a technical analysis that reconstructs the incident and separates facts from hypotheses.
8. Involve your lawyer before filing, so they decide what is submitted and how.

When the file becomes too large: the role of document analysis

In complex cases the problem is no longer missing evidence but its volume. A fraud or cyberattack case can include thousands of pages, hundreds of e-mails, bank account exports, system logs and audio-video recordings. The lawyer needs to find contradictions, gaps and links between documents quickly.

Independent technical analysis plays two roles here: it checks technical facts (what a log actually shows, whether an e-mail comes from where it claims, what metadata proves) and it organises the material into a verifiable chronology, with each statement traced to its source. The difference between an assertion and a data-backed finding is often the difference between an argument that is dismissed and one that is heard.

More on this stage in our article on large case file analysis, chronology and digital evidence.

How ProDefence can help

For companies and individuals affected by an incident, our cybercrime investigation service follows five stages: intake, preservation, analysis, documentation, remediation. Our role is technical: to establish what happened and document the evidence. We deliver a technical report, evidence documented in a form usable in criminal proceedings, indicators of compromise and technical support during the proceedings, at the client’s or the authorities’ request. The decision to refer the case is yours.

For lawyers, legal departments and compliance teams, ProCIS (procis.ro) turns large case files into verifiable information on three levels:

• Case file foundation: inventory, identification of each document, reconciliation with the index, factual summary;
• In-depth analysis: factual chronology, index of persons and entities, links between documents, version comparison, discrepancies and gaps;
• Investigation and technical analysis: electronic messages, files, metadata, system logs, including ransomware and other cybercrime cases.

Every file receives a cryptographic hash on receipt, every operation is logged, and AI tools only work on pseudonymised material, with analyst review. ProCIS does not provide legal advice and does not assess admissibility: the lawyer decides what is filed. ProCIS is currently contracted in Romanian; requests go through procis.ro.

Frequently asked questions

Sources

• Law no. 508/2004 on DIICOT, art. 12, legislatie.just.ro
• Romanian Criminal Code, articles 249, 325, 360-366
• Romanian Code of Criminal Procedure, articles 154, 168, 170
• DNSC, Annual Activity Report 2025 (August 2026)
• Public statements on the attack against Administrația Națională “Apele Române” (December 2025)

Alexandru Angheluș, ProDefence. Cybersecurity specialist who leads technical investigations of cyber incidents and case file analysis through ProCIS.

The cost of NIS2 compliance in Romania depends on the risk level set by DNSC, the size of the organisation and how mature its security already is. There is no single price. The budget is made up of internal time, consulting, audit, the NIS officer, documentation, technology and training, and each can be estimated separately.

Key points

• A NIS2 budget has seven components; internal time and technical remediation are the most underestimated.
• The assurance level (Basic, Important or Essential) decides how many controls apply: 34, 133 or all 218 in DNSC Order 1/2026.
• Some costs are one-off (the initial project, documentation), others recur (annual self-assessment, the NIS officer, training).
• Liability stays with the management body, which approves the measures and must allocate resources (Art. 14 of GEO 155/2024).
• Non-compliance has its own price: fines of up to EUR 10 million or 2% of turnover for essential entities.

Why is there no fixed price for NIS2?

GEO 155/2024, Romania’s NIS2 transposition, requires measures that are “proportionate and appropriate” to the entity’s risk level (Art. 11(1) and (2)). Proportionality is judged by exposure to risk, entity size, the likelihood and severity of incidents and their social and economic impact (Art. 11(10)).

Two companies in the same sector can therefore end up with very different budgets. DNSC Order 1/2026 splits the controls into three assurance levels:

Assurance level	Applicable controls	Maturity threshold
Basic	34	2.5
Important	133	3
Essential	218	3.5

The organisation does not choose its level. It follows from the risk-level assessment under the methodology in DNSC Order 2/2025 (Art. IV of Order 1/2026). Any serious estimate starts there. The control catalogue is explained in our article on CyFun and the 218 controls.

What goes into a NIS2 budget?

1. Internal time

Almost every estimate leaves this out. Management must approve the measures and oversee them. IT inventories assets, applies controls and collects evidence. Legal reviews supplier contracts. HR runs training. Even if you outsource much of the work, people inside the organisation still provide information and make decisions.

2. Implementation consulting

A consultant runs the gap analysis against the applicable controls, the risk analysis, the implementation plan and the documentation, then supports roll-out. ProDefence NIS2 consulting starts at EUR 10,000 per project. The price rises with the number of sites, critical systems and entities in a group.

3. The NIS officer

Each entity must appoint the persons responsible for network and information system security within 30 days of DNSC’s registration decision (Art. 14(3)). You can hire or outsource. ProDefence’s outsourced NIS2 officer starts at EUR 800 per month on a 12-month contract. For essential entities (with the statutory exceptions), the person must meet five cumulative conditions, including reporting directly to management and completing a DNSC-recognised accredited course within 12 months (Art. 14(4)).

4. Documentation

Policies, procedures, registers, continuity and incident response plans. You can write them in-house, get them through consulting, or buy a ready-to-adapt package. ProDefence NIS2 documentation packages cost EUR 1,500 for an important entity and EUR 2,000 for an essential entity, one-off, licensed to a single organisation.

5. Technical remediation

This is where budgets diverge. Multi-factor authentication, logging and traceability of activity (Art. 11(4)), backups and disaster recovery, vulnerability management, network segmentation. An organisation that already has these practices pays little; one starting from scratch can spend more on technology than on everything else combined.

6. Audit

Entities must undergo a security audit at intervals to be set by DNSC order (Art. 11(5)). The interval is not yet regulated, but the audit belongs in the budget. ProDefence’s NIS2 audit starts at EUR 5,000 per engagement. An auditor cannot audit its own implementation work, so consulting and audit need to be contracted with incompatibilities in mind.

7. Training

Members of management bodies must attend accredited training, and all staff must be trained regularly (Art. 14(2)). It is a small per-person cost that scales with headcount.

Which costs are one-off and which recur?

Component	Cost type	Note
Gap analysis and plan	One-off, updated	Redone when the risk level changes
Documentation	One-off, with reviews	Policies are reviewed periodically (Art. 13(a))
Technical remediation	Mostly one-off	Licences and maintenance recur
NIS officer	Recurring	Monthly, in-house or outsourced
Maturity self-assessment	Recurring, annual	Sent to DNSC, signed off by management (Art. 12(4))
Remediation plan	Recurring	Within 30 days of the self-assessment, essential entities (Art. 12(5))
Training	Recurring	Management and staff
Audit	Periodic	Interval not yet regulated

The split matters when the budget goes for approval: the compliance project can be funded as an investment, but the officer, self-assessment and training belong in operating costs.

What pushes the cost up or down?

Cost drivers:

1. Essential assurance level, with all 218 controls;
2. several entities in a group, each with its own obligations (see NIS2 in groups of companies);
3. legacy systems without logging or MFA support;
4. operational technology (OT) in energy, water or transport;
5. no asset inventory or prior risk analysis;
6. critical suppliers with no security clauses.

Cost reducers:

1. an information security management system already in place;
2. existing documentation that can be adapted rather than rewritten;
3. an IT team that already documents changes and incidents;
4. an honest initial self-assessment that avoids work on controls already met.

What does non-compliance cost?

GEO 155/2024 has two fine tiers. For the offences in Art. 60(1)(n)-(t), fines range from RON 1,000 to 300,000 for important entities and RON 1,500 to 500,000 for essential entities. The upper tier reaches EUR 7 million or 1.4% of turnover for important entities and EUR 10 million or 2% for essential entities.

This is not theoretical. On 29 September 2026 DNSC issued its first fine under GEO 155/2024: RON 50,000 for failure to submit the registration notification. A major incident adds its own costs: downtime, rebuilding systems, notifications, lost customers.

How to plan a 12-month budget

1. Month 1: confirm scope and your risk level. An indicative first filter is the CysNIS scope check.
2. Months 1-2: appoint the NIS officer and run the gap analysis on your level’s controls.
3. Months 2-3: prioritise key measures and high-risk controls. Estimate remediation from the list, not by guesswork.
4. Months 3-9: implement, document, collect evidence.
5. Months 9-10: maturity self-assessment with the DNSC tool (see EVAL_MMS and the thresholds).
6. Months 10-12: remediation plan and audit preparation.

For a comparison of in-house, consultant-led and outsourced-officer implementation, read the three NIS2 implementation routes.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors, and ProDefence covers every component of the budget, with published starting prices. ProDefence is not VAT-registered, so the price shown is final.

• NIS2 consulting: from EUR 10,000 per project.
• NIS2 audit: from EUR 5,000 per engagement.
• Outsourced NIS2 officer: from EUR 800 per month, 12-month contract.
• NIS2 documentation packages: EUR 1,500 (important entity) and EUR 2,000 (essential entity), sold only to organisations in NIS2 scope for their own compliance programme.

For planning and tracking, CysNIS brings together the scope check, control assessment, risks and documentation of your NIS2 journey. For an estimate based on your situation, use the form on the consulting page.

Part of the training budget can be reduced by using existing material: the courses on CysEdu (in Romanian) cover tiered staff training, and CysGame (in Romanian) offers free interactive awareness games. Specific training for management bodies remains a separate budget line.

Frequently asked questions

Sources

• GEO 155/2024, consolidated text, Romanian Legislative Portal
• DNSC Director’s Order 1/2026, Official Gazette no. 712 of 27.08.2026
• Romania’s NIS2 law: the official text

Alexandru Angheluș, ProDefence. Cybersecurity and NIS2 compliance specialist at ProDefence, whose team includes DNSC-attested NIS auditors.

After a ransomware attack, the first step is to isolate the affected systems from the network without shutting them down, reinstalling or “cleaning” them. Then you preserve evidence, inform management and assess your notification duties (DNSC, the data protection authority), and decide on a criminal complaint based on technical analysis, not under the attacker’s deadline.

Key points

• Ransomware in Romania grew by 153% in 2025 compared with 2024, according to the DNSC annual report, with 256 victims among public institutions, companies and individuals.
• The first hours are for isolation and evidence preservation, not reinstallation. A formatted system can no longer tell you what happened.
• Romania’s National Cyber Security Directorate (DNSC) firmly advises victims not to contact or negotiate with attackers.
• Illegal access, data alteration and system disruption (articles 360-366 of the Romanian Criminal Code) fall under the competence of DIICOT, the specialised prosecution directorate, whether or not the perpetrators form an organised group.
• Entities covered by NIS2 face strict deadlines: early warning within 24 hours, notification within 72 hours, final report within one month.

Why do the first 72 hours matter so much?

A ransomware attack does not start when the ransom note appears. Attackers usually enter the network days or weeks earlier, obtain privileged accounts, copy data and only then encrypt files. The message on screen is the last stage, not the first.

Three things are decided in the first 72 hours: how far the damage spreads, whether traces of the intrusion survive, and whether the organisation meets its legal deadlines. A rushed decision such as rebuilding servers “to get back to business” can erase exactly the information needed to close the breach and support a criminal complaint.

The attack on Apele Române, Romania’s national water authority, shows how large such an incident can become. DNSC was notified on 20 December 2025, and about 1,000 IT systems were compromised across the national administration and 10 of its 11 river basin branches: GIS servers, databases, workstations, e-mail, web and DNS servers. The attackers did not need exotic malware. They abused BitLocker, a legitimate Windows encryption feature. Operational technology was not affected, and the authority filed a criminal complaint, with a case opened at DIICOT.

The first hours: what to do and what not to do

Do this immediately

1. Isolate affected systems from the network. Unplug the cable or disable the connection, but keep the machine powered on if possible. Memory holds processes, connections and sometimes encryption keys that disappear at shutdown.
2. Stop the spread. Block suspicious accounts, reset administrator passwords from a clean device and suspend remote access (VPN, RDP) until things are clear.
3. Keep everything the attacker left behind. The ransom note, instruction files, contact addresses, suspicious e-mails, system, firewall and VPN logs.
4. Inform management and appoint one coordinator who liaises with the technical team, lawyers and authorities.
5. Write down the timeline. When the incident was noticed, who did what, which systems were disconnected. You will reuse it in notifications and in the case file.

Do not do this

• Do not reinstall, format or run “cleaning” tools on affected systems before evidence is preserved.
• Do not delete or answer the attacker’s messages.
• Do not restore from backups until you know they are clean. Attackers deliberately target backups.
• Do not share technical details publicly before you understand the incident.

Should we pay the ransom?

DNSC’s position is firm: victims should not contact or negotiate with the attackers. The reasons are practical. Paying does not guarantee a working decryption key, does not stop stolen data from being published or sold, and funds the next attack. IBM’s Cost of a Data Breach Report 2025 shows that 63% of organisations refused to pay, and extortion incidents disclosed by attackers cost an average of USD 5.08 million.

The real answer comes from other questions: do clean backups exist, how long will restoration take, what data was copied? Technical analysis answers them. Without it, any decision is a guess.

Evidence preservation: the difference between “we were attacked” and a criminal case

A complaint that only says “we were attacked” rarely moves forward. A complaint supported by documented technical evidence, with a timeline, entry vector, compromised accounts and indicators of compromise, gives the prosecutor a concrete starting point.

Preservation means:

• full copies of the disks and memory of relevant systems, taken before any intervention;
• cryptographic hashes calculated at collection, proving later that the data was not altered;
• logs from systems, network devices and cloud services, exported before they are overwritten (many services keep logs for only a few days);
• an operations register: who collected what, when and with which tool.

The Romanian Code of Criminal Procedure provides for measures such as the preservation of computer data (art. 154) and the search of computer systems (art. 168), ordered by the authorities. The better a company preserved the traces from day one, the more these measures have to build on.

Which notification duties apply?

Duty	Who	Deadline	Legal basis
Early warning of a significant incident	Essential and important entities (NIS2)	24 hours	GEO 155/2024
Incident notification	Essential and important entities	72 hours	GEO 155/2024
Final report	Essential and important entities	one month	GEO 155/2024
Personal data breach notification	Any controller, where applicable	72 hours after becoming aware	GDPR art. 33
Criminal complaint	The victim (management decides)	no fixed deadline, as soon as possible	Criminal Code, Code of Criminal Procedure

Organisations outside NIS2 can still report the incident to DNSC and ask for support. The NIS2 deadlines are explained in our article on incident notification within 24 and 72 hours.

The criminal complaint: where and with what?

The typical acts in a ransomware attack fall under the Criminal Code chapter on the security of computer systems: illegal access to a computer system (art. 360, up to 7 years for systems with restricted access), altering data integrity (art. 362, 1 to 5 years) and disrupting system operation (art. 363, 2 to 7 years). Under Law 508/2004, these offences fall under DIICOT’s competence regardless of whether an organised criminal group was involved.

A complaint is more useful when it includes:

• the incident timeline;
• a description of affected systems and impact;
• the ransom note and any attacker communication;
• the preliminary technical report and indicators of compromise;
• confirmation that evidence has been preserved and can be handed over.

The decision to refer the case to the authorities belongs to the company. Independent technical analysis gives that decision a solid basis.

Days 2 and 3: from isolation to controlled recovery

Once evidence is preserved, technical analysis answers three questions: how the attackers got in, what they did inside the network and which data they touched. The answers shape recovery:

1. Close the entry vector. A VPN without multi-factor authentication, an exposed server, an account compromised through phishing. If the vector stays open, restoration simply prepares the next attack.
2. Verify backups in an isolated environment before restoring.
3. Restore by priority, starting with services critical to operations and customers.
4. Monitor using indicators of compromise to detect a returning attacker.
5. Communicate in a controlled way with customers, partners and staff, coordinated with legal counsel.

How ProDefence can help

ProDefence works on ransomware incidents with a simple principle: our role is technical, to establish what happened and document the evidence. We work in five stages: intake, preservation, analysis, documentation, remediation.

You receive:

• a technical report reconstructing the incident: intrusion vector, attacker actions, affected systems and data;
• documented evidence in a form usable in criminal proceedings;
• indicators of compromise to check the rest of your infrastructure;
• a prioritised remediation plan;
• technical support during the proceedings, at your request or the authorities’.

See Cybercrime investigation, and, if the incident began with a suspicious file or e-mail, malware and fraud analysis.

For lawyers taking over the case, ProCIS turns technical and documentary material into a verifiable chronology (ProCIS is currently contracted in Romanian). For NIS2 entities that need someone to handle notifications and measures on an ongoing basis, there is the outsourced NIS2 officer service.

For NIS2 entities, a ransomware attack also triggers the obligation to notify DNSC, and the related measures and documentation can be structured on CysNIS. For prevention, CysGame (in Romanian) offers free interactive missions on ransomware and phishing, useful for staff training.

Frequently asked questions

Sources

• GEO no. 155/2024, consolidated text, legislatie.just.ro
• Law no. 508/2004 on DIICOT, art. 12, legislatie.just.ro
• Romanian Criminal Code, articles 360-366; Code of Criminal Procedure, articles 154 and 168
• Regulation (EU) 2016/679 (GDPR), article 33
• DNSC, Annual Activity Report 2025 (August 2026), dnsc.ro
• Administrația Națională “Apele Române”, press release of 21.12.2025
• IBM, Cost of a Data Breach Report 2025

Alexandru Angheluș, ProDefence. Cybersecurity specialist working on cyber incident investigation, malware analysis and NIS2 compliance.

„Does NIS2 apply to us” has a simple answer for a standalone company and a complicated one for a company inside a group. The complication does not come from the law, it comes from an assumption: that if the group has security policies, the subsidiary is covered. It is not. And conversely, that a small subsidiary is out of scope because somebody looks at consolidated figures. That is not true either.

Scope is determined per entity, not per group

Art. 8 of GEO no. 155/2024 defines large and medium undertakings by reference to art. 4 para. (1) letter c) of Law no. 346/2004, without applying art. 4^5 of that law. That article is precisely the one which, in ordinary law, requires aggregating the figures of linked and partner undertakings.

Excluding it has two practical consequences, pulling in opposite directions:

• a medium sized subsidiary of a very large group stays medium sized, it does not automatically become a large undertaking because the group is large;
• but equally, an entity cannot invoke the modest size of its group to escape: its own figures count.

On top of that sit the other criteria: the sector in Annexes no. 1 and 2, qualification as essential or important under art. 5 and 6, and the situations in art. 9 where an entity is in scope regardless of size.

Where it applies: art. 7

The rule is that the ordinance applies to entities established and registered in Romania. There are two departures that matter for groups:

• providers of public electronic communications networks and of publicly available electronic communications services are in scope when they provide services on Romanian territory, wherever they are established;
• for digital providers, DNS services, TLD name registries, domain registration services, cloud, data centres, content delivery networks, managed services and managed security services, online marketplaces, search engines and social networking platforms, the criterion is the main establishment.

Concretely: a Romanian subsidiary of a European group, registered here, reports to DNSC in its own name. A branch without legal personality, or a cross border service, raises different questions, resolved under art. 7 rather than on the group organisation chart.

The act that governs groups

Many people look for the group rules in Order of the DNSC director no. 1/2026. They are not there. Order no. 2 of 14 September 2026 inserted a new paragraph into Order no. 1/2026 which refers to a separate act: Decision of the DNSC director no. 3 of 14 September 2026 approving the Rules on the applicability of cyber security requirements for entities belonging to a group of undertakings, published in the Official Gazette no. 798 of 21 September 2026 and in force from that date.

That is the document to read if you manage compliance across several entities of the same group.

What cannot be centralised

However integrated the group, the following remain obligations of the local entity:

Obligation	Basis	Why it does not move to the group
Registration notification	art. 18 para. (2)	the register is of entities, not of groups
Appointment of the responsible officer	art. 14 para. (3)	the decision belongs to the entity’s management bodies
Management accountability	art. 14 para. (1)	the law holds the entity’s directors responsible
Annual maturity self-assessment	art. 12 para. (4)	it is submitted endorsed by the entity’s management
Incident reporting	art. 15	the deadlines run for the affected entity
Cyber security audit	art. 11 para. (5) and art. 58	performed by a DNSC attested auditor, free of local incompatibilities

A group can do the work. It cannot take over the signature.

The matrix that settles the argument

The method that works in practice is a control matrix kept by the local entity, not by the group:

Control	Who operates it	Local evidence	Who answers for it
log management	group SOC	platform extract for the entity’s systems, intragroup contract	local responsible officer
password policy	group, applied locally	locally signed policy, directory compliance report	local responsible officer
backups	shared	restore test on an entity system, with a signed record	local IT and group
incident handling	local	own procedure and incident register	the entity’s management

The third column is the key one. In the self-assessment, the implementation score is given on evidence concerning the entity’s own systems. An excellent group policy with no evidence of local application produces a good documentation score and a weak implementation score, exactly the gap that blocks the per category threshold at Essential level.

Controls implemented through special sectoral requirements or through group arrangements are recorded in the statement of applicability, which thereby becomes the central compliance document in a group.

Five frequent traps in groups

1. The group security service is not documented contractually. Without a written intragroup agreement, the local entity can demonstrate neither responsibility nor service level.
2. The local entity has no access to evidence. If logs, reports and test results sit exclusively with the group, the local self-assessment rests on trust and cannot be proven in an audit.
3. The group appointed auditor is locally incompatible. Art. 58 para. (3) prohibits an audit by anyone currently providing security services to that entity. A group provider may be in exactly that position.
4. The incident is reported to the group, not to DNSC. The internal procedure must trigger both flows, and the 24 hour deadline runs regardless of the head office time zone.
5. The local officer is in fact a group employee without a written mandate. The appointment must be a decision of the Romanian entity’s management bodies, with real duties and real access.

What to do, in this order

1. Establish, for every group entity registered in Romania, whether it is in scope and in what capacity.
2. Check that each has filed and had acknowledged its own notification, separately.
3. Build the central, local and shared control matrix, with local evidence.
4. Conclude the intragroup agreements documenting shared services.
5. Run the self-assessment per entity, endorsed by local management.
6. Check the incompatibilities before choosing the auditor.

Where we can help

For the scoping of each group entity, the CysNis platform walks through the criteria step by step and separates legal obligations from technical recommendations. For the control matrix and the local evidence, a NIS2 compliance analysis with a remediation plan is carried out per entity, not per group. Members of the ProDefence team are DNSC-attested NIS auditors.

Where the responsible officer role cannot be filled locally, it can be covered through an outsourced NIS2 officer.

Sources

• Decision of the DNSC director no. 3/2026 and the Rules on applicability for entities in a group of undertakings, Official Gazette no. 798 of 21 September 2026.
• Order of the DNSC director no. 2/2026, Official Gazette no. 792 of 18 September 2026.
• GEO no. 155/2024, consolidated form. Art. 5, 6, 7, 8, 9, 11, 12, 14, 15, 18 and 58.
• Order of the DNSC director no. 1/2026, Official Gazette no. 712 of 27 August 2026.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. Group structures differ widely; the concrete analysis is done on the entities’ actual documents.

Frequently asked questions

„CyFun excel” is a very concrete search: people want the file. It is worth clarifying up front what you are downloading, from where, and above all how the Belgian file relates to the obligation in Romania. Because they are not the same thing, even though they look strikingly alike.

What CyFun is

The CyberFundamentals Framework, CyFun for short, was developed by the Centre for Cybersecurity Belgium, which is also the primary scheme owner. Its requirements and guidance are built on the NIST Cybersecurity Framework, ISO/IEC 27001 and 27002, IEC 62443 and the CIS Critical Security Controls. The CyFun 2025 version was explicitly aligned to NIST CSF 2.0 and to European legislation, adding governance measures, supply chain and operational technology.

It has three assurance levels, Basic, Important and Essential, plus a separate questionnaire for the „small” level aimed at micro organisations. The accurate phrasing is not „CyFun has four levels”, but three assurance levels and one additional questionnaire.

The spreadsheet, and what it contains

The self-assessment tools are downloaded from the official scheme site, cyfun.eu. There are three separate files, one per level, each with a filter that shows only the requirements of the chosen level, so scores never have to be transferred between files.

The scoring logic is what matters most:

• each control is scored on two dimensions, policy maturity and implementation maturity;
• the scale runs from 1 to 5;
• scores aggregate as averages, from subcategory to category and then to the total;
• a summary tab shows the total level, the category overview, the list of key measures and a radar chart;
• conformity is established by comparison with the thresholds of the conformity assessment scheme, marked visually.

The same page carries the framework booklets, the key measures overview and, useful if you work across frameworks, a mapping file from CyFun 2025 to NIS2 and to other standards.

Why it looks familiar if you have read DNSC Order no. 1/2026

The national catalogue of measures approved by Order of the DNSC director no. 1/2026 has the same architecture:

Element	CyFun 2025	DNSC Order no. 1/2026
Functions	Govern, Identify, Protect, Detect, Respond, Recover	the same six, in Romanian
Hierarchy	Function, Category, Subcategory, Control	identical
Coding	of the form GV.OC-01.1	identical
Scoring	documentation and implementation, 1 to 5	documentation and implementation, 1 to 5
Levels	Basic, Important, Essential	Bază, Important, Esențial

The figures in the Romanian catalogue, counted from the applicability table of the order: 218 controls in total, of which 34 at Basic level, 133 at Important level and all 218 at Essential level, with 29 key measures and 15 controls flagged as management aspects. The levels are inclusive: Important contains everything in Basic, Essential contains everything.

The lineage is no coincidence. Romania formally adopted the CyFun framework and appears, on the official scheme site, in its scheme owner group alongside Belgium, Ireland, Malta and Cyprus. The implementation guidance in the order cites CyFun explicitly among the reference frameworks.

Careful: the Belgian file does not replace the DNSC tool

This is the part the „cyfun excel” search misses. The Romanian obligation, set out in art. 12 para. (4) of GEO no. 155/2024, is to submit annually to DNSC a maturity self-assessment endorsed by management. The mechanisms DNSC provides are the NIS2@RO platform and its own tools, officially named EVAL_MMS_B for Basic, EVAL_MMS_I for Important and EVAL_MMS_E for Essential, downloadable from the DNSC site when the platform is unavailable.

A self-assessment completed in the Belgian file is not a self-assessment submitted to DNSC. The thresholds differ too: the Romanian methodology requires a minimum of 2.5 on each key measure and 2.5 overall at Basic level, 3 and 3 at Important, and at Essential a minimum of 3 on each key measure, 3 on each category and an overall score of at least 3.5.

What the CyFun file is still good for

• Preparation. If you want to understand the scoring logic before entering the platform, the Belgian file explains it thoroughly, with guidance on every control.
• Mapping. The CyFun to NIS2 and ISO 27001 mapping file helps if you already run a management system and want to see what it covers and what it does not.
• International groups. A Belgian subsidiary and a Romanian one can speak the same technical language, even while reporting to different authorities.
• Internal training. It is a good instrument for teaching a team the difference between „we have a policy” and „the policy is applied and reviewed”.

A calendar detail if you work with Belgian partners: CyFun 2023 and 2025 coexist until 18 April 2027, and attestations issued on the 2023 version remain valid until 18 April 2028 at the latest.

The most expensive scoring mistake

Both models ask for two scores, not one. Organisations with good documentation and weak implementation often score the documentation and assume it covers implementation too. The result shows up directly in the category average and, at Essential level, can block the threshold of 3 per category even when the overall score looks acceptable.

The practical rule: the implementation score is given on evidence, not intent. If you cannot show a record, a log, an artefact or a report, the score does not go above 2.

Where we can help

A sound self-assessment starts from the correct assurance level. If you do not yet know where you sit, the CysNis platform walks through the criteria step by step. If you have the level and want scores that survive scrutiny, a NIS2 compliance analysis with a remediation plan is done on evidence, control by control. Members of the ProDefence team are DNSC-attested NIS auditors.

If the role of responsible officer is unstaffed, it can be covered through an outsourced NIS2 officer.

Sources

• CyberFundamentals Framework 2025, the self-assessment tools and materials, Centre for Cybersecurity Belgium.
• About CyFun and the FAQ, including the status of the framework in other states.
• Order of the DNSC director no. 1/2026, with the Measures and the self-assessment Methodology, Official Gazette no. 712 of 27 August 2026.
• GEO no. 155/2024, art. 12 para. (4).

This material is informative and does not constitute legal advice. The control counts were tallied from the applicability table of Order no. 1/2026. Tools and addresses may change.

Frequently asked questions