Contents
In 30 seconds
- In force since 1 January 2025, partially transposing the EU NIS2 Directive 19.
- It applies to service providers identified by the Cybersecurity Agency in the sectors of Decision 860/2024: medium-sized enterprises and above, and public bodies plus a few categories (telecoms, trust services, .md) however small 12.
- A significant incident is notified to the Agency within 24 hours, updated within 72 hours, and the final report follows within a month 1.
- Decision 562/2025 set deadlines: risk analysis within 6 or 9 months, implementation within 12 or 18, the first conformity assessment by certified auditors within 18 or 24 months, then an audit at least every three years 3.
- There are no dedicated fines in the Contravention Code yet, but state control is already operating: unannounced, with binding instructions 5811.
- In force
- 1 January 2025 1
- Authority
- The Agency, national CSIRT 4
- Incident
- 24 h · 72 h · 1 month 1
- Audit
- at least every 3 years 3
What Law 48/2023 is
Law No. 48 of 16 March 2023 on cybersecurity was published in the Official Gazette on 28 April 2023 and entered into force on 1 January 2025 (Art. 23) 1. It sets out who is responsible for the security of the networks and information systems behind critical services, which minimum measures they must take and how incidents are reported.
The preamble states explicitly that the law partially transposes Directive (EU) 2022/2555 (NIS2) 19. The logic is the same but the vocabulary differs: the law speaks of “service providers”; the split into essential and important providers appears only in the implementing decisions 23.
Who it applies to
A service provider is a legal person, public or private, registered in the Republic of Moldova, that provides services in the critical sectors set by the Government and has been identified by the competent authority (Art. 2) 1. The sectors are in Annex 2 to Decision 860/2024: energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, business-to-business managed ICT services, public administration and space, plus “other sectors” — postal and courier, waste, chemicals, food, manufacturing, digital providers and research 2.
The general rule: the law targets medium-sized enterprises and above (Art. 3(1)), i.e. from 50 employees, under Law 179/2016 to which Decision 860/2024 refers 12. Some categories are covered regardless of size, however:
| No size threshold (Art. 3(2)) | What it means |
|---|---|
| Public-law legal persons | All of them: local public authorities as important providers, the rest as essential 2. |
| Electronic communications, trust services | Network and service operators, providers of electronic signatures and seals 1. |
| The .md registry and domain registrars | Regardless of turnover 1. |
| The sole provider of a service | Or one whose disruption would have a significant effect, under the thresholds of Decision 860/2024 (for example 10,000 users, a 5% market share) 2. |
| Critical infrastructure operators | Designated under the specific legislation 1. |
The law does not apply to activities concerning state secrets, national defence and security, special investigative activity and criminal prosecution (Art. 3(3)). A sector-specific law with at least equivalent effects takes precedence (Art. 3(5)–(7)) 1.
Does Law 48 apply to you? Check in 30 seconds
Indicative, based on Art. 3 of the law and Decision 860/2024. Classification is decided by the Agency; this is not legal advice.
Public-law bodies are covered regardless of size
The law applies to every public-law legal person (Art. 3(2)(i)). Decision 860/2024 classifies them directly: local public authorities as important providers, all others as essential providers.
- Incident notifications go through the Government Incident Response Centre (Art. 12(11)).
- Risk analysis with a report, then implementing the requirements of Decision 562/2025 within the deadlines for your category.
- The first conformity assessment is carried out by people certified in information security auditing.
Your activity is on the no-size-threshold list
Electronic communications, trust services, the .md registry and domain registrars, the sole provider of an essential service and critical infrastructure operators are covered however small they are (Art. 3(2)). The specific classification is made by the Agency through an administrative act.
- Prepare the incident procedure for the 24-hour, 72-hour and one-month deadlines.
- Check the reporting thresholds specific to your service type in Decision 562/2025 (DNS, cloud, data centres, trust services).
- Start with an external penetration test: it shows what an attacker sees before the first inspection.
A covered sector and a medium-sized or larger enterprise
This combination is exactly what the law targets (Art. 3(1)): the Agency can identify you as a service provider, and self-identification is possible and advisable. From then on, the deadlines of Decision 562/2025 apply.
- Inventory the systems that support the service and run the risk analysis, with an assessment report.
- Plan the first conformity assessment: 18 months for essential providers, 24 for important ones.
- A penetration test at the start gives the real priority list for the risk treatment plan.
Under 50 employees, in a covered sector
The law’s size threshold is a medium-sized enterprise (from 50 employees, under Law 179/2016). You may still be identified if you are the sole provider of a service or if a disruption on your side would have a significant effect, under the thresholds of Decision 860/2024 (for example, 10,000 users).
- Check the thresholds in Annex 2 to Decision 860/2024 for your sector.
- If you work for identified providers, the requirements reach you through the contract.
A supplier to organisations covered by the law
The identified provider is also responsible for the third party that manages or hosts its systems (Art. 11(3)). Decision 562/2025 requires it to choose you on security criteria and to put incident notification, the right to audit and vulnerability management in the contract.
- Prepare the evidence your client will ask for: a recent penetration test report, with a retest.
- Align your incident procedure with your client’s deadlines: it has 24 hours.
The law does not apply to you directly
Based on your answers, you are not in the law’s sectors or categories. Its measures remain a good security benchmark, and large clients increasingly ask suppliers for them.
- If things change (growth, a new client in a covered sector), run the check again.
What your obligations are
Article 11 requires three things that show up in an inspection: a vulnerability and risk assessment, with a report (para. (2) point 1)), ten minimum security measures (point 2) letters a)–j)) and their verification, “including by carrying out security audits” (point 6)) 1. The measures follow the same chapters as Art. 21 of NIS2 9:
- Risk analysis and information system security policies.
- Incident handling: detection, response, staged notification.
- Business continuity: backups, disaster recovery, crisis management.
- Supply-chain security, including towards direct suppliers.
- Security in acquiring, developing and maintaining systems, including vulnerability handling.
- Assessing the effectiveness of the measures — testing, not just documents.
- Cyber hygiene and staff training.
- Cryptography and encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication and secured communications.
The annex to Decision 562/2025 details the measures: at least one person responsible for security reports directly to management, the security policy is reviewed annually, risks are reassessed at least annually, logs are kept for at least 12 months, and critical access requires multi-factor authentication 3. The provider is also responsible for the third party that manages or hosts its systems (Art. 11(3)) 1.
The Decision 562/2025 deadlines
The decision of 3 September 2025 replaced the old minimum requirements (Decision 201/2017) and set different deadlines by category 3:
| Obligation | Essential providers | Important providers |
|---|---|---|
| Risk analysis and treatment plan | 6 months | 9 months |
| Risk report and plan sent to the Agency | 10 days after approval | 10 days after approval |
| Full implementation of the requirements | 12 months | 18 months |
| First conformity assessment by certified auditors | 18 months | 24 months |
| Security audit, thereafter | at least every 3 years; report to the Agency within a month | at least every 3 years |
A valid ISO/IEC 27001 certificate exempts you from the decision’s annex, but the Agency may still assess you. A requirement you do not apply must be justified and reported to the Agency within 10 days 3.
Incident reporting: 24h, 72h, one month
An incident has a significant impact if its severity is at least “high” in the risk report, if it breaches the committed service level, if it disrupts another provider or if it causes considerable damage (Art. 12(5)) 1. The deadlines are in the law; Decision 562/2025 sets the content of each stage and thresholds by service type (DNS, cloud, data centres, MSPs) 13.
- 0 hYou become aware of the incident
The deadlines run from here. Record the moment in the log.
- ≤ 24 hInitial notification
“Without undue delay” to the Agency; public bodies via the Government Incident Response Centre. The Agency responds within 24 hours as well 1.
- ≤ 72 hThe update
The initial assessment: severity, impact and indicators of compromise 1.
- 1 month
Notification goes through the Agency’s platform or to [email protected] 7. A third party managing your systems must notify you within the same deadlines (Art. 12(4)) 1.
Inspections, supervision and sanctions
The Agency supervises providers, including through security audits (Art. 18), and carries out risk-based state control under the inspections law (Art. 19) 1. Decision 825/2025 allows unannounced inspections, with at least two inspectors, and the annual inspection plan is published. Afterwards the Agency can issue warnings and binding instructions and require audit recommendations to be applied 5.
Where security testing fits
The decision does not require an “annual pentest” in so many words. It asks for something more precise: security tests set on the basis of risk, following a documented methodology, recording the type, scope, time and results, with critical findings mitigated (annex to Decision 562/2025, points 74–76); vulnerability scans at planned intervals (point 88.2) and tests in the development cycle (point 64.4) 3. The first conformity assessment is done by people certified in information security auditing 3.
| What the act requires | What is not enough | What a penetration test produces |
|---|---|---|
| Vulnerability and risk assessment, with a report (Art. 11) | A risk table filled in at a desk | The real vulnerabilities, with severity and evidence, feeding the analysis 1 |
| Tests following a documented methodology (pts. 74–76) | A one-off scan with no defined scope | Scope, methodology, times, results — exactly what the record must hold 3 |
| Mitigating critical findings | A list of findings with no follow-up | The retest, which proves closure |
| Documented consent before testing (Decision 824/2025) | A verbal agreement | A signed testing authorization: parties, object, period, test types, limits 6 |
IT suppliers and the supply chain
Even if your company is not identified, the law can reach you through your client. Chapter V of the annex to Decision 562/2025 requires identified providers to choose partners on security criteria, to put incident notification, the right to audit, vulnerability management and subcontracting rules in the contract, and to keep a register of direct suppliers 3.
For a development, hosting or maintenance company, this means new questions in tenders and contract renewals: do you have a recent penetration test? What did you fix? How will you notify us of an incident in time for us to meet the 24 hours?
Where to start: six steps
- Check your classification
Sector, size, the no-threshold categories. If you received a notice from the Agency, you have 15 days to object 2.
- Take inventory
The systems behind the critical service, who has access to them and what is exposed to the internet.
- Test what is exposed
An external penetration test shows what an attacker would find and sets the priorities of the risk analysis.
- Write the risk analysis
With a report and treatment plan, sent to the Agency within 10 days of approval 3.
- Prepare the incident procedure
For 24h, 72h and one month, with a pre-filled template and the Agency contacts 17.
- Gather the evidence
The test report with a retest, 12 months of logs and the supplier register — exactly what the conformity assessment will ask for 3.
Frequently asked questions
What is Law 48/2023?
How do I know if my company is covered?
How quickly must an incident be reported?
Does the law require penetration tests?
Are there fines for non-compliance?
Sources
Every statement about a law or standard links to its official source. Consulted on the date shown.
- Law No. 48/2023 on cybersecurity (consolidated version)legis.md · accessed 22 October 2026
- Government Decision No. 860/2024: identification of service providers (sectors, thresholds, procedure)legis.md · accessed 22 October 2026
- Government Decision No. 562/2025: cybersecurity obligations and incident notificationlegis.md · accessed 22 October 2026
- Government Decision No. 1028/2023: establishing the Cybersecurity Agencylegis.md · accessed 22 October 2026
- Government Decision No. 825/2025: state control in cybersecuritylegis.md · accessed 22 October 2026
- Government Decision No. 824/2025: coordinated vulnerability disclosurelegis.md · accessed 22 October 2026
- Cybersecurity Agency: reporting an incidentncsc.md · accessed 22 October 2026
- MDED explanatory note to the draft decision on control (December 2025)gov.md · accessed 22 October 2026
- Directive (EU) 2022/2555 (NIS2)EUR-Lex · accessed 22 October 2026
- Law No. 48/2023, version in force from 29.03.2027 (amended by Law 209/2026)legis.md · accessed 22 October 2026
- Contravention Code (version in force)legis.md · accessed 22 October 2026
About the authors
The guides are written by the team that does the testing, not a marketing department. We update them when the law, the standard or what we see in testing changes.
Informational material, not legal advice. Legal texts may change; the specific classification is made by the Cybersecurity Agency. Sources were consulted on the update date.