NIS2 in a group of companies: scope is set per entity, and DNSC Decision no. 3/2026

„Does NIS2 apply to us” has a simple answer for a standalone company and a complicated one for a company inside a group. The complication does not come from the law, it comes from an assumption: that if the group has security policies, the subsidiary is covered. It is not. And conversely, that a small subsidiary is out of scope because somebody looks at consolidated figures. That is not true either.

Scope is determined per entity, not per group

Art. 8 of GEO no. 155/2024 defines large and medium undertakings by reference to art. 4 para. (1) letter c) of Law no. 346/2004, without applying art. 4^5 of that law. That article is precisely the one which, in ordinary law, requires aggregating the figures of linked and partner undertakings.

Excluding it has two practical consequences, pulling in opposite directions:

• a medium sized subsidiary of a very large group stays medium sized, it does not automatically become a large undertaking because the group is large;
• but equally, an entity cannot invoke the modest size of its group to escape: its own figures count.

On top of that sit the other criteria: the sector in Annexes no. 1 and 2, qualification as essential or important under art. 5 and 6, and the situations in art. 9 where an entity is in scope regardless of size.

Where it applies: art. 7

The rule is that the ordinance applies to entities established and registered in Romania. There are two departures that matter for groups:

• providers of public electronic communications networks and of publicly available electronic communications services are in scope when they provide services on Romanian territory, wherever they are established;
• for digital providers, DNS services, TLD name registries, domain registration services, cloud, data centres, content delivery networks, managed services and managed security services, online marketplaces, search engines and social networking platforms, the criterion is the main establishment.

Concretely: a Romanian subsidiary of a European group, registered here, reports to DNSC in its own name. A branch without legal personality, or a cross border service, raises different questions, resolved under art. 7 rather than on the group organisation chart.

The act that governs groups

Many people look for the group rules in Order of the DNSC director no. 1/2026. They are not there. Order no. 2 of 14 September 2026 inserted a new paragraph into Order no. 1/2026 which refers to a separate act: Decision of the DNSC director no. 3 of 14 September 2026 approving the Rules on the applicability of cyber security requirements for entities belonging to a group of undertakings, published in the Official Gazette no. 798 of 21 September 2026 and in force from that date.

That is the document to read if you manage compliance across several entities of the same group.

What cannot be centralised

However integrated the group, the following remain obligations of the local entity:

Obligation	Basis	Why it does not move to the group
Registration notification	art. 18 para. (2)	the register is of entities, not of groups
Appointment of the responsible officer	art. 14 para. (3)	the decision belongs to the entity’s management bodies
Management accountability	art. 14 para. (1)	the law holds the entity’s directors responsible
Annual maturity self-assessment	art. 12 para. (4)	it is submitted endorsed by the entity’s management
Incident reporting	art. 15	the deadlines run for the affected entity
Cyber security audit	art. 11 para. (5) and art. 58	performed by a DNSC attested auditor, free of local incompatibilities

A group can do the work. It cannot take over the signature.

The matrix that settles the argument

The method that works in practice is a control matrix kept by the local entity, not by the group:

Control	Who operates it	Local evidence	Who answers for it
log management	group SOC	platform extract for the entity’s systems, intragroup contract	local responsible officer
password policy	group, applied locally	locally signed policy, directory compliance report	local responsible officer
backups	shared	restore test on an entity system, with a signed record	local IT and group
incident handling	local	own procedure and incident register	the entity’s management

The third column is the key one. In the self-assessment, the implementation score is given on evidence concerning the entity’s own systems. An excellent group policy with no evidence of local application produces a good documentation score and a weak implementation score, exactly the gap that blocks the per category threshold at Essential level.

Controls implemented through special sectoral requirements or through group arrangements are recorded in the statement of applicability, which thereby becomes the central compliance document in a group.

Five frequent traps in groups

1. The group security service is not documented contractually. Without a written intragroup agreement, the local entity can demonstrate neither responsibility nor service level.
2. The local entity has no access to evidence. If logs, reports and test results sit exclusively with the group, the local self-assessment rests on trust and cannot be proven in an audit.
3. The group appointed auditor is locally incompatible. Art. 58 para. (3) prohibits an audit by anyone currently providing security services to that entity. A group provider may be in exactly that position.
4. The incident is reported to the group, not to DNSC. The internal procedure must trigger both flows, and the 24 hour deadline runs regardless of the head office time zone.
5. The local officer is in fact a group employee without a written mandate. The appointment must be a decision of the Romanian entity’s management bodies, with real duties and real access.

What to do, in this order

1. Establish, for every group entity registered in Romania, whether it is in scope and in what capacity.
2. Check that each has filed and had acknowledged its own notification, separately.
3. Build the central, local and shared control matrix, with local evidence.
4. Conclude the intragroup agreements documenting shared services.
5. Run the self-assessment per entity, endorsed by local management.
6. Check the incompatibilities before choosing the auditor.

Where we can help

For the scoping of each group entity, the CysNis platform walks through the criteria step by step and separates legal obligations from technical recommendations. For the control matrix and the local evidence, a NIS2 compliance analysis with a remediation plan is carried out per entity, not per group. ProDefence is a cyber security auditor accredited by DNSC.

Where the responsible officer role cannot be filled locally, it can be covered through an outsourced NIS2 officer.

Sources

• Decision of the DNSC director no. 3/2026 and the Rules on applicability for entities in a group of undertakings, Official Gazette no. 798 of 21 September 2026.
• Order of the DNSC director no. 2/2026, Official Gazette no. 792 of 18 September 2026.
• GEO no. 155/2024, consolidated form. Art. 5, 6, 7, 8, 9, 11, 12, 14, 15, 18 and 58.
• Order of the DNSC director no. 1/2026, Official Gazette no. 712 of 27 August 2026.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. Group structures differ widely; the concrete analysis is done on the entities’ actual documents.

Frequently asked questions