NIS2 maturity self-assessment in Romania: the EVAL_MMS tools, the thresholds and the remediation plan

The annual maturity self-assessment raises the most practical questions of any NIS2 obligation in Romania, because it is the only one where the entity scores itself and sends the result to the authority. The basis is art. 12 para. (4) of GEO no. 155/2024, and the method is set by Order of the DNSC director no. 1/2026, published in the Official Gazette no. 712 of 27 August 2026, with the annexes in issue 712 bis.

Who, what and how often

Essential and important entities carry out and submit to DNSC, and where applicable to the sectoral competent authority, annually, a self-assessment of the maturity of their risk management measures, endorsed by the entity’s management. It is not an IT department exercise, it is a document the leadership owns.

DNSC provides two mechanisms: the NIS2@RO platform and the assessment tools per assurance level, officially named EVAL_MMS_B for Basic, EVAL_MMS_I for Important and EVAL_MMS_E for Essential. The tools are downloaded from the DNSC site and used locally only when the platform is unavailable.

The assurance level is not chosen. It follows from the risk level determined under the methodology approved by Order of the DNSC director no. 2/2025, and the entity implements the controls attached to its level.

How the scores are given

Each control receives two values, from 1 to 5: one for documentation maturity, one for implementation maturity. Both are mandatory. The five stages are:

Stage	Name
1	Initial
2	Repeatable
3	Defined
4	Managed
5	Optimising

The criteria are concrete rather than impressionistic. An example from stage 2, on documentation: formally approved process documentation exists, but it has not been reviewed in the last 2 years. An example from stage 5: documented and approved exceptions represent less than 0.5 per cent of cases on documentation, and process exceptions less than 1 per cent on implementation.

Scores aggregate as arithmetic averages, from subcategory to category and then to the entity’s total score.

The conformity thresholds

Assurance level	Per key measure	Per category	Total score
Basic	at least 2.5	not required	at least 2.5
Important	at least 3	not required	at least 3
Essential	at least 3	at least 3	at least 3.5

Note the asymmetry at Essential level: the per category threshold is the one that catches people out. An entity can post an overall score of 3.6 and still miss, because a single category, usually detection or recovery, sits below 3.

N/A exclusions are capped

A control may be marked not applicable, but under strict limits introduced by Order of the DNSC director no. 2 of 14 September 2026:

• at most 1 control at Basic level;
• at most 3 controls at Important level;
• at most 5 controls at Essential level;
• key measures can never be excluded, nor, at Essential level, the management controls;
• every exclusion is justified in writing, in the statement of applicability;
• in the calculation, an excluded control counts as 2.5 at Basic level and 3 at Important and Essential.

In practice, „it does not apply to us” is not a scoring strategy. The exclusion does not lift the average, and the justification remains a document somebody reads.

What happens if you miss the thresholds

Nothing happens automatically, but a new obligation arises: the entity draws up a plan of measures with actions and committed deadlines. For essential entities, art. 12 para. (5) of the ordinance requires a remediation plan within 30 days of the self-assessment.

From an inspection point of view, a low score with a credible plan and deadlines that are met is a far better position than a high score with no evidence. The self-assessment is not a scoring contest.

Exceptions and special cases

• Financial sector under DORA. Entities in banking and financial market infrastructures to which Regulation (EU) 2022/2554 applies do not carry out the risk level assessment and apply the DORA measures instead. The rule was introduced by art. V of Order no. 1/2026.
• Groups of undertakings. Entities belonging to a group apply the rules in Decision of the DNSC director no. 3 of 14 September 2026, published in the Official Gazette no. 798 of 21 September 2026.
• Sectoral requirements. The measures are supplemented by requirements from special regulations, and requirements implemented that way are also recorded in the statement of applicability.

The deadline, stated honestly

Order no. 1/2026 contains no article setting a deadline or a deferred entry into force. The obligation is annual and comes from art. 12 para. (4) of the ordinance. For entities whose risk level score has been validated, DNSC stated publicly, when the tools were launched in September 2026, that the self-assessment is submitted within the deadline provided by the ordinance. Check the notifications received in the NIS2@RO platform: the concrete deadline applicable to your entity appears there.

Seven mistakes that lower the score for nothing

1. Only the documentation score is filled in, and the implementation score is copied from it.
2. Scores of 4 and 5 are given without evidence, and the audit later contradicts them.
3. The weak category is ignored, although at Essential level the per category threshold is disqualifying.
4. N/A is applied beyond the permitted cap, or to key measures.
5. The statement of applicability is missing, or carries one sentence justifications.
6. The self-assessment is not formally endorsed by management, although the law requires it explicitly.
7. The result is not linked to the remediation plan, which remains a separate document with no deadlines.

Where we can help

Most of the distance between a declared score and a score that holds up lies in evidence. A NIS2 compliance analysis with a remediation plan works through the controls on evidence and produces exactly the plan required by art. 12 para. (5). ProDefence is a cyber security auditor accredited by DNSC.

If nobody internally can lead the exercise, the role can be covered through an outsourced NIS2 officer. And if you are unsure of your assurance level, the CysNis platform starts from the scoping question.

Sources

• Order of the DNSC director no. 1/2026, with the Measures and the maturity self-assessment Methodology, Official Gazette no. 712 and 712 bis of 27 August 2026.
• Order of the DNSC director no. 2/2026, Official Gazette no. 792 of 18 September 2026.
• Decision of the DNSC director no. 3/2026 on entities in a group of undertakings, Official Gazette no. 798 of 21 September 2026.
• Order of the DNSC director no. 2/2025 on risk level assessment, Official Gazette no. 776 of 20 August 2025.
• GEO no. 155/2024, art. 11, 12 and 13.

This material is informative and does not constitute legal advice. Quotations from the Romanian acts are working translations. Deadlines communicated through the NIS2@RO platform prevail over any estimate in this article.

Frequently asked questions