How to Choose an NIS2 Consultant: 12 Questions

Choose an NIS2 consultant on three checkable criteria. They work from the text of Government Emergency Ordinance (GEO) 155/2024 and DNSC Order 1/2026, not from general promises. They state exactly what they deliver and what stays with your organisation. And they never sell things that do not exist, such as “NIS2 certification” or a “DNSC-authorised NIS officer”.

Key points

Liability for NIS2 compliance stays with the entity’s management bodies (Art. 14(1) GEO 155/2024), whoever does the work.
There is no NIS2 certification for organisations, no DNSC authorisation of the NIS officer and no dedicated occupational code for that role.
DNSC Order 1/2026 sets 218 controls across three assurance levels: 34 Basic, 133 Important, 218 Essential.
Consulting and NIS auditing for the same organisation must be kept apart, because the law sets incompatibilities for auditors.
A good contract lists deliverables, deadlines, evidence and knowledge transfer to the internal team.

Why the choice matters

Romania’s NIS2 services market grew fast after GEO 155/2024 and especially after DNSC Order 1/2026 (Official Gazette 712 and 712 bis, 27 August 2026). With demand came offers that blur legal obligations with good practice, or promise outcomes no provider can guarantee.

The stakes go beyond budget. Management bodies approve the risk management measures, oversee them and answer for breaches (Art. 14(1)). Entities submit an annual maturity self-assessment endorsed by management (Art. 12(4)), and essential entities send a remediation plan within 30 days (Art. 12(5)). If the consultant’s documents do not hold up when DNSC looks at them, the organisation pays, not the consultant.

What an NIS2 consultant should actually do

A complete NIS2 consulting engagement usually covers:

Scope check: sector, entity type, size, group of companies (DNSC Decision 3/2026), registration notification to DNSC.
Asset inventory and risk analysis: the lists an entity must hand to DNSC on request (Art. 11(7)).
Control assessment against DNSC Order 1/2026 at the assurance level matching the entity’s risk level (Art. IV of the Order).
Policies and procedures required by Art. 13(a)-(j), from cryptography and supply chain to continuity, incident handling and multi-factor authentication.
Statement of applicability for requirements coming from special or sector rules (Art. III(2) of Order 1/2026).
Preparation of the annual self-assessment and, for essential entities, the remediation plan.
Training: management attends accredited courses and staff are trained regularly (Art. 14(2)).

A consultant who cannot show where each item sits in their offer has an intention, not yet a method.

12 questions to ask before signing

Basis and method

1. Which texts do you work from? The right answer names GEO 155/2024 as approved by Law 124/2025, DNSC Order 1/2026, DNSC Order 2/2025 for risk level and, where relevant, DNSC Decision 3/2026 for groups. “The NIS2 Directive” alone is incomplete for Romania.

2. How do you set the applicable assurance level? Controls follow the entity’s risk level, not the consultant’s preference. Ask to see how the risk score leads to Basic, Important or Essential.

3. How do you handle the 218 controls? Ask whether assessment is per control, with evidence, or only per chapter. Ask for a sample assessment sheet.

4. Which standards do you use alongside the Order? ISO/IEC 27001, NIST CSF 2.0 or CyFun can help but do not replace the Order. The consultant should explain the mapping, not sell a standard in place of the legal duty.

Deliverables

5. Which documents do we receive, in which format? Ask for the exact list: asset register, risk register, policies, procedures, statement of applicability, remediation plan. Editable formats, since they are updated yearly.

6. Tailored or generic? A policy set with your company name swapped in will not survive an auditor’s first question. Ask how many interviews and how much analysis sit behind each document.

7. What stays with us afterwards? Your organisation must be able to repeat the annual self-assessment without starting over. Ask for knowledge transfer, not just binders.

Roles and liability

8. Who is the NIS officer and how do you prepare them? Officers are appointed within 30 days of the DNSC decision being communicated (Art. 14(3)). For essential entities, Art. 14(4) sets five cumulative conditions, including independence from IT and an accredited course recognised by DNSC within 12 months.

9. Can you also run the audit? The right answer is no, for the same client and period: NIS auditors are subject to legal incompatibilities. A consultant auditing their own work produces a worthless report.

10. How do you work with management? Management approves and answers for the measures. A serious consultant schedules time with the management bodies, not only with IT.

Money and timing

11. How is the price built? It should follow scope: number of entities, sites and systems, and the assurance level. A flat price “for any company” usually hides templates.

12. What if DNSC changes the requirements? DNSC acts followed each other quickly in 2025 and 2026. The contract should say how mid-project changes are handled.

Red flags

What you are told	Why it is a problem
“We will certify you for NIS2”	There is no NIS2 certification for organisations.
“Our NIS officer is DNSC-authorised”	DNSC does not authorise NIS officers, and there is no dedicated occupational code.
“We guarantee you won’t be fined”	No one can guarantee the authority’s decision; only the quality of the work.
“We’ll do the audit too, it’s simpler”	Consulting and auditing the same organisation are incompatible.
“Full document pack in 48 hours, no interviews”	Generic documents do not reflect the entity’s real risks.
“No need to involve the board”	Management approves the measures and is liable (Art. 14).
“The deadlines don’t apply to you yet”	Deadlines run from precise events. Ask for the article reference.

DNSC’s first fine under GEO 155/2024, RON 50,000 on 29 September 2026, was for failure to submit the registration notification (Art. 60(1)(o)). Simple, easy-to-miss duties get checked first.

What the contract should contain

Scope: entities, sites, systems and assurance level.
Deliverables: named list, editable format, version and date.
Timeline: stages tied to legal duties (officer appointment, self-assessment, remediation plan).
Acceptance criteria: who signs off each deliverable and on what basis.
Confidentiality: asset and risk registers are sensitive; ask for storage and destruction rules.
Knowledge transfer: sessions with the internal team and with management.
Regulatory change: how the project adjusts to a new DNSC act.
Audit separation: a statement that the firm will not audit the same scope.

Engagement models

Not every organisation needs the same model. Our comparison of three NIS2 implementation routes covers doing it in-house, hiring a project consultant and appointing an outsourced NIS2 officer. The common rule: you outsource the work, not the liability.

How ProDefence can help

Members of the ProDefence team are DNSC-attested NIS auditors. For consulting clients this means documents written by people who know what an auditor checks, and the independence rule applies: we do not audit a scope we advised on.

NIS2 consulting, from EUR 10,000 per project.
Outsourced NIS2 officer, from EUR 1,200 per month on a 12-month contract.
NIS2 documentation packs: EUR 1,500 for an important entity, EUR 2,000 for an essential entity, single-organisation licence, sold only to organisations in NIS2 scope.
CysNIS: scope check, control assessment, risk management and documentation, keeping legal duties, technical recommendations and indicative results apart.

ProDefence is not VAT-registered, so displayed prices are final. Recommended first step: the CysNIS scope check.

Frequently asked questions

Do I have to hire a consultant for NIS2?

No. GEO 155/2024 does not require entities to use a consultant. An organisation can implement the measures with its own staff if it has the skills. A consultant brings method and speed, but liability for the measures stays with the management bodies under Art. 14(1).

Can the same firm do both NIS2 consulting and the NIS audit?

Not for the same client and scope. NIS auditors are bound by legal incompatibilities, and an audit by whoever built the system is not independent. The same firm may consult for one organisation and audit another.

Is there an NIS2 certification for companies?

No. There is no NIS2 certification for organisations. There are personal certificates issued by private bodies, and certification schemes for ICT products, services or processes. Compliance is shown through implemented measures, the annual self-assessment sent to DNSC and audits.

How much does an NIS2 consultant cost?

It depends on scope: number of entities, sites and systems, and the assurance level. At ProDefence, consulting starts at EUR 10,000 per project, audits at EUR 5,000 per engagement and the outsourced officer at EUR 1,200 per month, with no VAT added.

Which documents should I receive at the end?

At least the asset register, risk analysis, assessment against DNSC Order 1/2026, the policies required by Art. 13 GEO 155/2024, the statement of applicability and the remediation plan, all editable so they can be updated at each annual self-assessment.

How do I check that an NIS auditor is attested by DNSC?

DNSC issues the auditor attestation, valid for three years. Ask for the attestation number and check it against DNSC’s public records. See our article on NIS auditors and the DNSC list.

Sources

GEO 155/2024, consolidated text, Legislative Portal
DNSC Order 1/2026, Legislative Portal
Law 124/2025 approving GEO 155/2024, Official Gazette 638, 7 July 2025
DNSC Decision 3/2026, Official Gazette 798, 21 September 2026

Alexandru Angheluș, ProDefence. Works on NIS2 implementation and audit for essential and important entities in Romania.