The cyber security audit is the one obligation in GEO no. 155/2024 that an entity cannot discharge on its own. The text requires an auditor holding a valid attestation issued by DNSC, and the list of attested auditors is public. A market has formed around that list, with offers that blur the line between the national attestation and commercial certifications. Below, what the law says and what to verify before signing.

The audit obligation

„Essential entities and important entities are required to undergo a cyber security audit under the conditions and with the periodicity established by the order of the DNSC director provided for in art. 12 para. (1), depending on the risk level referred to in para. (3).”

That is art. 11 para. (5). Para. (6) adds that where a sectoral competent authority exists, the conditions and periodicity are set by joint order.

Here there is a real problem worth stating plainly: the periodicity has not yet been set. Order of the DNSC director no. 1/2026, which is the very order issued under art. 12 para. (1), contains no provision on audit, periodicity or attestation. Neither the Measures in Annex no. 1 nor the self-assessment Methodology in Annex no. 2.

The useful conclusion: the audit obligation exists in the law, but the concrete interval has not been regulated through the order the law defers to. If a provider tells you „the audit is mandatory every year” or „every two years”, ask for the published legal basis. As at the date of this article, there is none.

Separately from the periodic audit, DNSC may order ad hoc audits as part of supervision, also carried out by an attested auditor.

Who may audit

Art. 58 para. (1): the audit is carried out by cyber security auditors holding a valid attestation issued by DNSC, except for audits at institutions in defence, public order and national security.

The attestation is personal, non transferable and valid for 3 years. This appears both in art. 58 para. (6) of the ordinance and in the Regulation approved by Order of the Secretariat General of the Government no. 559/2021, which remains applicable through art. 66 para. (2) of the ordinance even though it was issued under the now repealed Law no. 362/2018.

A new regulation, expressly required by art. 58 para. (2) letter b) and art. 65 para. (1) letter l), had not been published as at the date of this article. Until then, the attestation procedure remains the 2021 one.

The incompatibilities, the most ignored point

Art. 58 para. (3) prohibits the audit in three situations:

• an attested auditor who currently provides cyber security services or CSIRT services to that entity, or is an employee of it;
• an auditor holding a services contract for the audited network or system, ongoing or concluded within the last year;
• an auditor who has already carried out 3 consecutive audits at the same entity.

The first eliminates a common practice: the firm that runs your security cannot audit your security. The second adds a one year cooling off period. The third forces rotation after three cycles.

If you receive a single offer covering both implementation and audit, ask who performs the audit and check whether that entity holds a current contract with you. An audit performed in breach of these rules is a contestable audit.

The list of auditors and how to check it

DNSC maintains the record of auditors under art. 58 para. (2) letter a) and publishes the list of validly attested cyber security auditors, known by its Romanian acronym LASC, on its own site, in dated versions. The list is already used as a qualification requirement in public procurement, where the bidder must appear in it.

What to ask a provider, in writing:

1. the attestation number and issue date, so you can check the 3 year validity;
2. the type of attestation and the audit types it covers;
3. the version of the list in which they appear, with its date;
4. a declaration on the incompatibilities in art. 58 para. (3), including contracts from the past year;
5. the name of the individual who will sign the report, not only the company name.

What „accredited” really means

Under the 2021 Regulation, the attestation file requires, among other things, a valid criminal record certificate, evidence of experience, the auditor specialisation certificate issued by an authorised training provider, and professional certifications from an exhaustive list, Annex no. 5, which contains 37 certifications split between common and special audit activities.

One detail the market often gets wrong: ISO 27001 Lead Auditor does not appear in Annex no. 5. CISA does, under common audit activities. An ISO lead auditor certificate is professionally valuable, but it is not, by itself, a route to the DNSC attestation.

The experience requirement is alternative: at least 2 years administering or implementing networks and information systems, or 2 years in their security, or 1 year in investigations, testing or security audit. For an applicant, art. 27 of the ordinance allows DNSC to request security verifications, including from a national security perspective, and to interrupt the procedure depending on the outcome.

Auditors also carry ethical obligations under art. 58 para. (8): professional integrity, compliance with the applicable codes of ethics, absence of conflicts of interest, confidentiality.

What is penalised

Failure to undergo the audit under art. 11 para. (5) or (6) is the offence in art. 60 para. (1) letter b), which sits in the upper fine range: up to 7,000,000 euro or 1.4 per cent of total worldwide annual turnover for important entities, up to 10,000,000 euro or 2 per cent for essential ones, whichever is higher.

While the periodicity remains unset, arguing about „delay” is difficult. That does not mean the subject can be ignored: the risk level validated by DNSC and a possible ad hoc audit remain in play, and an audit done early is the cheapest way to find out what is missing.

Audit, self-assessment and gap analysis are three different things

Confusion between the first two is common. The self-assessment does not replace the audit, and the audit does not replace the annual self-assessment.

Where we can help

Members of the ProDefence team are DNSC-attested NIS auditors. If you want to know where you stand before a formal audit, the starting point is a NIS2 compliance analysis with a remediation plan, built on evidence. If you have nobody to appoint internally, the role can be covered through an outsourced NIS2 officer.

Mind the incompatibility rule: the same team cannot both run your security and audit the result. That separation is settled in the contract, not afterwards.

The auditor works on documents: policies, registers, evidence of implementation. Keeping them structured against the legal requirements is what CysNIS is for, helping prepare the documentation to be presented at audit and inspection.

Sources

• GEO no. 155/2024, consolidated form. Art. 11, 27, 57, 58, 60, 65 and 66.
• Order SGG no. 559/2021 and the Regulation on the attestation and verification of cyber security auditors, Official Gazette no. 387 of 14 April 2021.
• Order of the DNSC director no. 1/2026, Official Gazette no. 712 of 27 August 2026.
• DNSC, list of validly attested cyber security auditors.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. The auditor list and the certification list are updated; check the version published on dnsc.ro at the time of contracting.

Frequently asked questions

„NIS officer” is not a legal title in Romania. In GEO no. 155/2024 the role is called the officer responsible for the security of networks and information systems, and DNSC orders also use „the person responsible for cyber security”. The short name caught on through the training market. Around it, three false claims circulate: that a dedicated occupational code exists, that the officer is licensed by the authority, and that the role is solved by attending a course.

What the law actually says

The basis is art. 14 para. (3), as amended by Law no. 124/2025. The management bodies of essential and important entities establish permanent means of contact, allocate the necessary resources and appoint, within 30 days of the communication of the DNSC director’s decision on identification and entry in the register, the officers responsible for the security of networks and information systems.

Two things to keep in mind. The deadline does not run from a fixed calendar date, it runs from the communication of the DNSC decision. And the obligation covers both categories of entity, not only essential ones, a point we covered separately in the article on the appointment obligation for important entities.

The conditions in para. (4), and who they apply to

Art. 14 para. (4) adds five cumulative conditions, but only for the person appointed in essential entities, excluding public administration entities, micro enterprises and small enterprises:

• holds managerial authority;
• reports directly to the management bodies of the entity;
• operates independently of the IT and operational technology functions;
• has access to the resources needed to supervise and implement the measures effectively;
• has completed an accredited specialist course in cyber security, recognised by DNSC, within 12 months of appointment.

Independence from IT is the condition most often breached in practice. Appointing the head of IT as the responsible officer, in an essential entity that does not fall within the exceptions, does not satisfy para. (4) letter c). Not because the person is unsuitable, but because nobody supervises themselves.

Occupational code: there is no dedicated one

The Romanian Classification of Occupations contains no occupation called „NIS officer” or „officer responsible for the security of networks and information systems”. What is used in practice are occupations in base group 2529, specialists in databases and networks:

Job descriptions circulating online give „code 252913, cyber security specialist”. The title is wrong: 252913 is „specialist in information systems security procedures and tools”. If the wrong title reaches the personnel file, correcting it later costs more.

The practical conclusion: pick the code by the real content of the position, not by the „NIS” label. The law requires no particular code.

There is no „DNSC licensed NIS officer”

This is the most frequent and most misunderstood question. DNSC does not license, attest or register the responsible person. The arguments are in the text of the ordinance:

• Art. 25 lists the tasks of DNSC. Letter j) covers issuing, revoking and renewing attestations for cyber security auditors. Letter k) covers authorising training service providers for auditors and CSIRT teams. The officer responsible for network security does not appear.
• Art. 58 regulates the attestation of auditors only.
• Art. 65 para. (1) lists the orders the DNSC director must issue. None concerns attestation of the responsible officer.

The closest reference is art. 26 para. (2), under which DNSC ensures the evaluation of the training and specialisation process for auditors, CSIRT team members, cyber security officers and training providers. That is a task about the training process, not an attestation of the person.

What did exist is something else: a Responsabil NIS training programme, delivered by providers authorised under DNSC Order no. 106/2022, with a certificate recognised by DNSC. That programme has been discontinued. According to the DNSC announcement, from 1 March 2026 no completion certificates are issued for programmes organised after that date.

The regulatory gap, stated plainly

Art. 14 para. (4) letter e) requires an „accredited specialist course, recognised by DNSC”. Order no. 106/2022 was issued under Law no. 362/2018, repealed by GEO no. 155/2024, and under the new law the authorisation of training providers covers only auditors and CSIRT teams. The programme dedicated to the responsible officer has been discontinued, and no act defining which course is „recognised by DNSC” for this role had been published as at the date of this article.

The result: the obligation exists, the mechanism to satisfy it does not. For an entity inside the 12 month window, the reasonable course is to document what training the appointed person completed, from whom, with what content and with what certificate, and to keep the evidence. In an inspection, serious documented training is a better position than none, and the impossibility of obtaining a certificate that does not exist is not attributable to the entity.

Be careful with offers that still use the „DNSC authorised” label for NIS officer courses. Ask the provider, in writing, for the authorisation number, the programme it covers and its validity date.

Can the role be outsourced?

The law says nothing about outsourcing, neither permitting nor prohibiting it. Art. 14 para. (3) uses the verb „appoints”, without requiring employee status. The real constraints come from the five conditions in para. (4): managerial authority, direct reporting to management, independence from IT and OT, access to resources, training.

An external provider can meet those conditions only through a formal mandate, with access and authority written into the appointment decision, not through an ordinary consultancy contract. And whatever the arrangement, accountability stays with the management bodies: art. 14 para. (1) makes them responsible for breaches. There is no transfer of liability to the appointed person or to the provider.

What is penalised

All four sit in the upper fine range of art. 60 para. (2) letters a) and b): from 5,000 lei up to 7,000,000 euro or 1.4 per cent of total worldwide annual turnover for important entities, and from 10,000 lei up to 10,000,000 euro or 2 per cent for essential ones, whichever is higher. By comparison, failure to register with DNSC, for which the first fine was issued, sits on the lower tier.

The checklist

1. Is there a written appointment decision, dated and signed by the management body?
2. Does it fall within 30 days of the communication of the DNSC registration decision?
3. For essential entities outside the exceptions, are all five conditions in para. (4) met, including independence from IT?
4. Have the person’s details been communicated to DNSC, through the registration form or an update within two weeks of a change?
5. Is there a job description with real duties, not just a line on an organisation chart?
6. Is there evidence of training and a plan for the 12 month deadline?
7. Does the person have unfiltered access to management, and a budget?

Where we can help

For organisations with nobody to appoint internally without breaching the independence condition, the role can be covered through an outsourced NIS2 officer, with a formal mandate, access to management and documented reporting.

If you are not yet sure whether you are in scope, the CysNis platform walks through the scoping criteria step by step. If you are, a NIS2 compliance analysis with a remediation plan shows exactly what is missing. Members of the ProDefence team are DNSC-attested NIS auditors.

For the ongoing development of the NIS officer and the team, the cybersecurity courses on CysEdu (in Romanian) are tiered from fundamentals to professional topics. They are not a DNSC attestation, but they cover the working knowledge the role needs day to day.

Sources

• GEO no. 155/2024, consolidated form. Art. 14, 25, 26, 58, 60 and 65.
• Law no. 124/2025, Official Gazette no. 638 of 7 July 2025, point 4 of the single article.
• Requirements approved by Order of the DNSC director no. 1/2025, art. 5 para. (2) letter c), the details of the responsible person.
• Rules on the authorisation of cyber security training providers, approved by DNSC Order no. 106/2022, Official Gazette no. 1076 of 8 November 2022.
• Romanian Classification of Occupations, base group 2529 and group 1330.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. The status of training programmes may change through later normative acts; check dnsc.ro before contracting a course.

Frequently asked questions

Romania transposed NIS2 through Government Emergency Ordinance no. 155/2024. Anyone trying to read the actual law runs into three problems: the official PDF of the Official Gazette is not free, most copies circulating online are the initial version without the 2025 and 2026 amendments, and there is no official English translation.

Below are the exact acts, where the consolidated text can be read for free, what changed, and how to cite it correctly.

The acts, precisely identified

The ordinance entered into force on 31 December 2024, with one exception set out in art. 64 para. (4): art. 60 and 61, the offences and their establishment, entered into force 30 days after publication, on 30 January 2025. The amendments brought by Law no. 124/2025 take effect from 10 July 2025.

The correct citation today is „GEO no. 155/2024, approved with amendments and additions by Law no. 124/2025, as subsequently supplemented”. A document that cites only the ordinance was written before July 2025, or written in a hurry.

Where to read the text, free and up to date

The free official source is the Legislative Portal of the Romanian Ministry of Justice, which publishes the consolidated form, meaning the text with amendments incorporated and marked:

• GEO no. 155/2024: legislatie.just.ro, document 293121
• Law no. 124/2025: legislatie.just.ro, document 299675
• Law no. 123/2026: legislatie.just.ro, document 312027

Each page carries a „Forma printabilă” button, the printable form, which renders the whole act on a single page that a browser can save as PDF. It is the closest thing to the free PDF people are looking for, with the advantage of being the version in force rather than the original one.

There is no official English translation of the ordinance. For cross-border work, the practical approach is to read the Romanian consolidated text against the English text of Directive (EU) 2022/2555, keeping in mind that the national text adds obligations the directive does not contain.

A map of the ordinance

The ordinance has 11 chapters and 68 articles.

The articles people reach for most often: art. 5 and 6 for classification as essential or important, art. 8 for thresholds, art. 9 for entering scope regardless of size, art. 11 to 14 for measures, audit and management obligations, art. 15 for incident reporting, art. 18 for registration, art. 58 for auditors, art. 60 for fines.

What Law no. 124/2025 changed

The law has a single article with 23 amending points. The ones with direct practical effect:

• Art. 14 para. (2) and (3). Members of management bodies attend accredited professional training. Entities provide regular training for all staff. Management establishes permanent contact points, allocates resources, and appoints the officers responsible for the security of networks and information systems within 30 days of DNSC communicating the registration decision.
• Art. 15 para. (6). The introductory definition of a significant incident was rewritten.
• Art. 18 para. (3) letter g) and para. (10). Information on the member states where the entity provides services, and its transmission to ENISA.
• Art. 50 para. (2) and (4). Serious breaches redefined.
• Art. 60. Letters n), bb) and cc) amended, letters pp) and qq) added, the fine regime in para. (2) rewritten, and a new para. (2^1): serious breaches under art. 50 para. (2) are penalised with fines from 3,000 to 600,000 lei.
• Art. 60 para. (3) and (4). The turnover of reference for percentage based fines is that of the last financial year.
• Art. 61 para. (2). Competences to establish offences are split between DNSC and the sectoral competent authorities. For letters o) to dd), DNSC establishes the offence and the penalty is applied by decision of its director.
• The annexes. Sector 5, health, and sector 8, digital infrastructure, were rewritten in Annex no. 1. In Annex no. 2, sector 4 became „Production, processing and/or distribution of food”, which widens scope: a company no longer has to do all three.

That last point is the most underestimated. A company that only distributes food, without producing or processing it, came into the conversation through that „and/or”.

Law no. 123/2026, the amendment nobody talks about

In July 2026 the ordinance was supplemented again. Law no. 123/2026 inserts art. 36 para. (1^1) into GEO no. 155/2024 and, more importantly, art. 365^1 into the Criminal Code, a ground removing the criminal character of the act. In practice, vulnerability research conducted in cumulative compliance with the reporting conditions in art. 36 para. (5) and (6) no longer constitutes an offence under art. 360 para. (1) and (3), art. 361 and art. 364 of the Criminal Code.

This is the first safe harbour for security researchers in Romanian law. For entities it means that a coordinated vulnerability disclosure policy is no longer merely good practice, it now has a counterpart in statute.

What the ordinance does not contain

• The size threshold figures. Art. 8 contains no numbers. It refers to art. 4 para. (1) letter c) of Law no. 346/2004, without applying art. 4^5. That detail matters: classification is done per entity, without aggregating figures from linked or partner undertakings.
• The concrete technical measures. Art. 13 gives the minimum list. The actual control catalogue is in Order of the DNSC director no. 1/2026.
• The audit interval. Art. 11 para. (5) defers it to the order under art. 12 para. (1). Order no. 1/2026 sets no interval, so as at the date of this article the periodicity is not regulated.
• The notification form. It is annexed to the Requirements approved by Order of the DNSC director no. 1/2025.

The DNSC orders, in brief

Where we can help

If the real question behind the search is „does this apply to us”, the answer is not in the PDF, it is in the scoping exercise. The CysNis platform walks through the criteria step by step.

If you are already in scope, the distance between the text and practice is measured through a NIS2 compliance analysis with a remediation plan. Members of the ProDefence team are DNSC-attested NIS auditors, and the role of the responsible officer can be covered through an outsourced NIS2 officer.

Sources

• GEO no. 155/2024, consolidated form, Official Gazette no. 1332 of 31 December 2024.
• Law no. 124/2025, Official Gazette no. 638 of 7 July 2025.
• Law no. 123/2026, Official Gazette no. 550 of 3 July 2026.
• Order of the DNSC director no. 1/2025 and no. 2/2025, Official Gazette no. 776 of 20 August 2025.
• Order of the DNSC director no. 3/2025, Official Gazette no. 1149 of 11 December 2025.
• Order of the DNSC director no. 1/2026, Official Gazette no. 712 of 27 August 2026.
• Decision of the DNSC director no. 3/2026, Official Gazette no. 798 of 21 September 2026.

This material is informative and does not constitute legal advice. Article titles and quotations are working translations of the Romanian text. Consolidated forms change; check the last update date on each act’s page.

Frequently asked questions

On 29 September 2026, Romania’s National Cyber Security Directorate (DNSC) issued the first ever penalty under GEO no. 155/2024, the national transposition of NIS2. The fine is 50,000 lei, roughly 10,000 euro, and it went to a legal person described as a specialised body of the central public administration, covered by sector 10, Public administration, in Annex no. 1 to the ordinance. The legal basis cited by DNSC is art. 60 para. (1) letter o).

The press release, published on 30 September and carried by the national news agency, says the entity „failed to observe the notification obligation within the legal deadline”. Part of the press rendered that as a failure to report incidents. The text of the law says something else, and the difference matters for every entity in scope.

What letter o) actually says

„failure by entities in the sectors listed in Annexes no. 1 and 2 to comply with the notification obligation under art. 18 para. (2) within the indicated deadline”

The cross-reference is to art. 18 para. (2), which sits in Chapter IV, titled „Registration”. That article requires entities in the Annex 1 and Annex 2 sectors to notify DNSC for the purpose of registration in the register of entities, within 30 days of the ordinance entering into force, or of the date on which its provisions become applicable to them.

Incident reporting lives in a different chapter and a different article: art. 15, with 24 hours for the early warning, 72 hours for the incident notification and one month for the final report. Failing those obligations is penalised under other letters of art. 60 para. (1), not under letter o).

Romania’s first NIS2 fine is therefore not a fine for an undeclared incident. It is a fine because an entity did not register with the authority in time.

The two notifications people confuse

Why 50,000 lei

The amount is neither arbitrary nor maximal. Art. 60 para. (2) sets different ranges depending on the letter breached and on the status of the entity. For letter o), the ranges are:

• important entities: from 1,000 to 300,000 lei;
• essential entities: from 1,500 to 500,000 lei.

The sanctioned entity is a central public administration institution. Under art. 5 para. (1) letter a), central public administration entities listed in Annex no. 1 are essential entities regardless of size. The applicable range is therefore 1,500 to 500,000 lei, and 50,000 lei is about one tenth of the ceiling.

The contrast with the other ranges in the same article is worth keeping in mind. For breaches treated as serious, art. 60 para. (2) letters a) and b) reach up to 7,000,000 euro or 1.4 per cent of total worldwide annual turnover for important entities, and 10,000,000 euro or 2 per cent for essential ones, whichever is higher. Failure to register sits on the lower tier. That is not where the real financial exposure is.

Who establishes the offence

Art. 61 para. (2), as amended by Law no. 124/2025, splits the competences. For offences under letters o) to dd), the offence is established by DNSC and the penalty is applied by decision of the DNSC director. For other letters, control staff of the sectoral competent authorities may also establish the offence.

That explains the wording in the press release, a „decision establishing the offence and applying the penalty”. It is not an inspection report drawn up by a sectoral inspector, it is an act of the head of the authority.

What this means for everyone else

The ordinance entered into force on 31 December 2024. For entities already in scope at that date, the 30 day deadline expired on 30 January 2025. For an entity entering scope later, because it crosses a size threshold, changes its activity or is identified under art. 9, the deadline runs from the date on which the provisions become applicable to it.

Two practical consequences, frequently ignored:

• The obligation does not lapse when the deadline passes. An entity that failed to notify in January 2025 has not escaped the obligation. It still has it, and the delay remains punishable.
• The authority does not come looking for you first. Scope is self-assessed. The law provides for no list that the authority sends out to companies, and until the registration decision arrives, the entity is the one that has to know its own status.

The first fine went to a public institution. That is not a sign that the private sector is less exposed. It is, most likely, a sign of where the authority has immediate visibility.

What to check this week

1. Whether your organisation operates in one of the sectors in Annex no. 1 or no. 2 to GEO no. 155/2024.
2. Whether the registration notification was actually sent, and whether you hold the acknowledgement from DNSC. Do not assume: ask for the document.
3. Whether the data submitted is still current. Changes to identification information must be communicated within two weeks of the change.
4. Whether the entity has enrolled on the NIS2@RO platform, if the initial notification was made by e-mail or on paper.
5. Whether the officer responsible for the security of networks and information systems has been appointed, within 30 days of DNSC communicating the registration decision.
6. Whether an internal incident reporting procedure exists, and whether someone can trigger it within 24 hours, including at night and at weekends.

Where we can help

If you are not certain whether you fall within the scope of the ordinance, the CysNis platform walks through the scoping criteria step by step and separates legal obligations from technical recommendations.

If you are in scope and want to know how far you are from the requirements, the starting point is a NIS2 compliance analysis with a remediation plan, built on evidence rather than statements. Members of the ProDefence team are DNSC-attested NIS auditors. For organisations with no one to appoint internally, the role can be covered through an outsourced NIS2 officer.

Sources

• GEO no. 155/2024, published in the Official Gazette no. 1332 of 31 December 2024, consolidated text on the Romanian Legislative Portal. Art. 5, 15, 18, 60 and 61.
• Law no. 124/2025 approving GEO no. 155/2024, published in the Official Gazette no. 638 of 7 July 2025, text on the Legislative Portal.
• DNSC, press release of 30 September 2026 on the first penalty for failure to comply with the notification obligation, dnsc.ro.
• Agerpres, carried by G4Media, 30 September 2026.
• Order of the DNSC director no. 1/2025 on the requirements for the registration notification, Official Gazette no. 776 of 20 August 2025, the requirements.

This material is informative and does not constitute legal advice. The amount of the fine and the status of the sanctioned entity come from the DNSC press release as carried by the national news agency. DNSC did not publish the name of the entity. Quotations from the ordinance are working translations of the Romanian text.

Frequently asked questions

Romania’s public administration scored 2.07 out of 5 on CyFun® control ID.IM-03.7, which requires independent teams to evaluate the organisation’s processes, best practices and technology solutions for protecting critical systems and assets. DNSC’s conclusion is unusually blunt: in general, public administration entities do not carry out independent evaluations of their own processes and IT infrastructure, exposing themselves unnecessarily to cyber risk.

The wording leaves no room for interpretation. This is not a level that could be improved; it is a type of verification that largely does not take place.

What was measured

The data comes from the PNRR 184 project “Creating new cybersecurity competencies for society and the economy”. A total of 1,599 beneficiaries from the public and private sectors assessed their own maturity on the SecureRO platform, using the CyberFundamentals (CyFun®) framework of the Centre for Cybersecurity Belgium.

The methodological irony is worth noting: the lowest score on independent evaluation comes from a self-assessment. Organisations that are not checked from outside acknowledged, by themselves, that they are not checked from outside.

What “independent” means

The control’s objective is to strengthen protection of critical systems and assets through objective evaluation of the organisation’s processes, practices and technologies. DNSC adds a note for operational technology environments: independent evaluations help identify vulnerabilities, reduce bias and support continuous improvement of resilience and safety.

“Reducing bias” is the heart of the control. The team that designed a system cannot evaluate it objectively, however competent it may be, not out of bad faith, but because it tests exactly the assumptions it used when building it. Independence can be achieved three ways: an internal structure separate from the one operating the system, a team from another institution, or an external evaluator. In local administration, the first two are rarely realistic.

An independent evaluation is also not an automated vulnerability scan. That covers technology. The control asks for evaluation of processes and practices: how access rights are granted and revoked, how changes are managed, how suppliers are verified, how continuity plans are tested.

Why it matters more in the public sector

A public institution has several traits that magnify the effect of missing external verification. Systems are old and interconnected, because they were added in successive layers through projects with different funding. Knowledge of them often sits with a single person. The suppliers who built them retain remote access, sometimes under contracts signed years ago. And the data administered belongs to citizens, who have no alternative to the service.

In those conditions, the absence of objective evaluation means nobody has ever verified whether the things assumed to work actually do. Backup restoration, revocation of former employees’ access, isolation of the operational network, all remain assumptions until first tested.

What the law says

Public authorities and institutions fall within the scope of GEO no. 155/2024, approved with amendments by Law no. 124/2025, under the conditions the ordinance sets. The core obligations are the same: notification for registration within 30 days under art. 18 para. (2), risk level assessment using the ENIRE@RO tool, the maturity self-assessment submitted annually to DNSC under art. 12 para. (4), and reporting of significant incidents within the deadlines of art. 15 para. (7): 24 hours, 72 hours, one month.

Art. 14 is the most uncomfortable for institutional leadership: management bodies approve the risk management measures, oversee their implementation and are liable for breaches, without prejudice to the rules on the liability of public institutions and civil servants. Para. (2) requires members of management to complete accredited professional training.

Through Order no. 3 of 27 November 2025, the DNSC director approved the rules on supervising, verifying and enforcing compliance with the ordinance, together with the risk-based prioritisation methodology. Institutions with a high risk level and no documentation reach the authority’s attention first.

What can be done on an institutional budget

The first independent evaluation does not have to cover everything. Choose the public service with the greatest impact on citizens and evaluate the chain supporting it: systems, data, access, suppliers, procedures and the recovery plan. The result is a report with findings, priorities and estimates, a document that serves simultaneously as evidence for DNSC, as justification for budget and as input for future procurement specifications.

The second step, cheaper than it looks, is writing the right of independent evaluation into contracts with system suppliers. Without that clause, verification of the most exposed component depends on the goodwill of the party being evaluated.

A third step, equally inexpensive, is setting a fixed interval for repeating the evaluation. A check carried out once, under deadline pressure, produces a report that ages within months as new systems appear and suppliers change. A check repeated at a known interval becomes a process, and processes are what an inspection looks for, not isolated documents.

Next steps

Scope is established first, because it determines the level of obligations. The CysNis platform walks through the criteria step by step, with references to the legal text.

The independent evaluation itself means a NIS2 compliance analysis with a remediation plan, built on evidence by DNSC-attested NIS auditors on the ProDefence team, exactly the type of verification control ID.IM-03.7 calls for. Institutions without an internal owner for the process can cover the role through an outsourced NIS2 officer, including annual deadlines and the relationship with the authority. The full range of services is in the cybersecurity services register.

A 2.07 out of 5 on independent evaluation describes a situation repaired by a single administrative decision, not by an investment. The first evaluation is also the one that shows what the rest will cost.

Data source: DNSC, “Cyber maturity score for Romania’s public administration, CyFun® control ID.IM-03.7”, 17 August 2026.