Contents
In 30 seconds
- NIS2 applies from 18 October 2024 to medium and large entities in 18 sectors and, regardless of size, to a few critical categories 1.
- NIS2 Art. 21(2)(f) and GDPR Art. 32(1)(d) require the same thing: a process for assessing the effectiveness of security measures 18.
- A significant incident is reported within 24 h, 72 h and one month (NIS2); a personal data breach within 72 h (GDPR) 18.
- Romania transposed NIS2 through Ordinance 155/2024, with a mandatory audit by DNSC-certified auditors and 6-hour reporting for cross-border impact 4.
- Penetration tests appear explicitly in the implementing regulation, in ENISA’s guidance and in EDPB guidelines as a means of verification 239.
Two frameworks, one goal
NIS2 (Directive (EU) 2022/2555) was adopted on 14 December 2022. Member states had to transpose it by 17 October 2024, and the measures apply from 18 October 2024, when the first NIS directive was repealed 1. It is about the continuity and security of services essential to the economy and society.
GDPR (Regulation (EU) 2016/679) protects personal data. Art. 32 requires security measures appropriate to the risk, including “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures” (Art. 32(1)(d)) 8.
Who NIS2 applies to
NIS2 applies to entities in the sectors of Annexes I and II that are at least medium-sized enterprises. Some categories are covered regardless of size: public electronic communications networks and services, trust service providers, TLD registries, DNS providers, sole providers in a state and critical entities (Art. 2) 1.
| Annex | Sectors |
|---|---|
| I — high criticality | Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (B2B), public administration, space 1 |
| II — other critical sectors | Postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research 1 |
Essential entities are mainly the large ones in Annex I, qualified trust service providers, TLD and DNS registries, central public administration and critical entities; the rest are important (Art. 3) 1. The difference matters for supervision and fines: essential entities are supervised ex ante, important ones ex post 1.
What Article 21 requires
NIS2 Art. 21(2) sets ten minimum measures, based on an all-hazards approach 1:
- a) risk analysis and information system security policies;
- b) incident handling;
- c) business continuity: backups, disaster recovery, crisis management;
- d) supply chain security;
- e) security in acquiring, developing and maintaining systems, including vulnerability handling and disclosure;
- f) policies and procedures to assess the effectiveness of risk-management measures;
- g) cyber hygiene and training;
- h) cryptography and, where appropriate, encryption;
- i) human resources security, access control, asset management;
- j) multi-factor or continuous authentication and secured communications, including emergency ones.
Implementing Regulation (EU) 2024/2690 details these measures for digital entities: DNS, TLD, cloud, data centres, CDNs, managed service providers (MSP, MSSP), online marketplaces, search engines, social networks and trust services (Art. 1) 2. For other entities it remains a useful reference.
Where penetration testing appears
Neither NIS2 nor GDPR says “penetration test” in its articles. The texts that implement them do: recital 15 of Regulation 2024/2690 says security tests “may include … penetration tests, vulnerability scanning”, static and dynamic application testing or audits 2. Recital 128 of the directive notes that authorities may use security audits and penetration tests 1.
| Text | What it requires |
|---|---|
| Reg. 2024/2690, point 6.5 | A testing policy; scope and frequency based on risk; a documented methodology; results with criticality per finding; critical findings mitigated 2 |
| Reg. 2024/2690, point 6.10.2(b) | Vulnerability scans at planned intervals, with results recorded 2 |
| ENISA, technical guidance | Vulnerability assessments, penetration tests, red teaming; as evidence, reports of previous tests 3 |
| EDPB, Guidelines 01/2021 | Periodic IT security audits, vulnerability assessments and penetration tests as measures against breaches 9 |
Incident reporting: NIS2 and GDPR
- 24 hNIS2: early warning
From the moment you become aware of a significant incident (Art. 23(4)(a)) 1.
- 72 hNIS2: incident notification
With an initial assessment (Art. 23(4)(b)); an intermediate report on request 1.
- 72 hGDPR: notification to the data protection authority
“Without undue delay and, where feasible”, within 72 hours (Art. 33(1)); a processor informs the controller without delay 8.
- 1 monthNIS2: final report
Within one month of the notification; for an ongoing incident, a progress report first (Art. 23(4)(d), (e)) 1.
People whose data was affected are informed if the risk to them is high; this is not needed if the data was encrypted and unintelligible (Art. 34) 8. Every breach is documented, even those not notified (Art. 33(5)) 8. EDPB Guidelines 9/2022 explain notification step by step 10.
The two frameworks talk to each other: the NIS authority informs the data protection authority when a breach of Art. 21 or 23 may involve a personal data breach (Art. 35(1)). If the data protection authority has already fined the same conduct, no NIS2 fine is added (Art. 35(2)) 1.
The incident clock: what you report, to whom and how fast
Indicative, based on NIS2 Art. 23, Art. 15 of Ordinance 155/2024 and GDPR Art. 33–34. The clock starts when you become aware of the incident. Not legal advice.
Your reporting calendar
Without NIS2 and with no personal data affected, these two frameworks set no deadlines for you. Still document the incident: cause, impact and what you changed.
- 6 hCross-border impact: report to DNSC
A Romanian rule on top of NIS2 (Art. 15(3) of Ordinance 155/2024).
- 24 hNIS2: early warning
To the CSIRT or competent authority; in Romania, to DNSC through the PNRISC platform.
- 72 hNIS2: incident notification
Updates the early warning with an initial assessment of the incident.
- 72 hGDPR: notification to the data protection authority
“Without undue delay and, where feasible”, within 72 hours; in Romania, to ANSPDCP.
- 1 monthNIS2: final report
Within one month of the 72-hour notification; if the incident is ongoing, a progress report first.
- Data subjects, without undue delay, if the risk to them is high; not needed if the data was encrypted and unintelligible (Art. 34).
- Document every breach, even those that are not notified (Art. 33(5)).
A documented penetration test done before an incident is the evidence required by NIS2 Art. 21(2)(f) and GDPR Art. 32(1)(d); after an incident, it shows the gap was closed.
Request a test with an auditor-ready report →In the Republic of Moldova, Law 48/2023 applies
The law partly transposes NIS2, with its own deadlines and authority. We explain them article by article, with an “does it apply to you” check, in the dedicated guide.
Open the Law 48 guide →Romania: Ordinance 155/2024
Romania transposed NIS2 through Emergency Ordinance No. 155/2024, published in Official Gazette No. 1332 of 31 December 2024 4, approved with 23 amendments by Law No. 124/2025, in force from 10 July 2025 5. The authority is DNSC (the National Cyber Security Directorate) 4. The ordinance applies without prejudice to GDPR (Art. 2(5)) 5.
| Step | Deadline |
|---|---|
| Notification to DNSC for registration | 30 days from the date the provisions apply to you (Art. 18(2)) 4 |
| DNSC decision | 60 days (essential), 150 days (important) 4 |
| Risk level assessment | 60 days from the decision (Art. 18(6)) 4 |
| Maturity self-assessment | 60 days after the risk assessment, then yearly (Art. 18(7), 12(4)) 4 |
| Remediation plan (essential) | 30 days after the self-assessment (Art. 12(5)) 4 |
| Security officers | 30 days from the registration decision (Art. 14(3)) 5 |
- Mandatory audit: essential and important entities undergo a cybersecurity audit, with frequency set by DNSC order according to risk level (Art. 11(5)) 4.
- The audit is done by DNSC-certified auditors; the certificate is valid for 3 years, and the same auditor cannot perform more than 3 consecutive audits at the same entity (Art. 58) 4.
- Incidents are reported through the PNRISC platform at 24 h / 72 h / one month, and within 6 h if they have cross-border impact (Art. 15) 4.
- DNSC Orders 1/2025 and 2/2025 (Official Gazette No. 776 of 20.08.2025) set the registration notification and the risk-level methodology 6.
- DNSC Order 1/2026 (Official Gazette No. 712 of 27.08.2026) approves the risk-management measures, across 6 functions and 3 assurance levels, and the self-assessment methodology; entities under DORA apply the DORA measures 7.
Fines and management liability
| Framework | Fine ceiling |
|---|---|
| NIS2, essential entities | at least €10M or 2% of worldwide turnover, whichever is higher (Art. 34(4)) 1 |
| NIS2, important entities | at least €7M or 1.4% (Art. 34(5)) 1 |
| Romania, essential / important | from RON 10,000 up to €10M or 2% / from RON 5,000 up to €7M or 1.4% (Art. 60(2)) 5 |
| GDPR, security and notification | up to €10M or 2% (Art. 83(4)(a), for Art. 25–39) 8 |
NIS2 moves liability to the top: management bodies approve the measures, oversee them and can be held liable; their members must follow training (Art. 20) 1. For essential entities, the authority can request a temporary ban on exercising managerial functions (Art. 32(5)(b)) 1. In Romania, management attends accredited training courses (Art. 14) 4.
What about the Republic of Moldova?
NIS2 does not apply directly in the Republic of Moldova. Law No. 48/2023 on cybersecurity partly transposes it, with its own categories, deadlines and authority 11. Moldovan companies working for EU clients under NIS2 feel the directive anyway, through the supply-chain security requirements of Art. 21(2)(d) 1.
For the Republic of Moldova, read our Law 48/2023 guide: who is covered, which deadlines apply and how an incident is reported.
How to build evidence through a test
- Scope based on risk
The scope and frequency of tests follow the risk assessment (point 6.5.2(a)) 2.
- Documented methodology
Testing follows a written methodology; ENISA points to OWASP WSTG and OSSTMM (point 6.5.2(b)) 23.
- Findings with criticality
Type, scope, timing and results, with criticality and mitigation actions per finding (point 6.5.2(c)) 2.
- Remediation and retest
Critical findings are mitigated (point 6.5.2(d)); the retest closes each finding with evidence 2.
- Report to management
Results of independent reviews are reported to management bodies (point 2.3), who are accountable for the measures (NIS2 Art. 20) 12.
Frequently asked questions
Do NIS2 and GDPR require penetration tests?
From what date does NIS2 apply?
How fast must an incident be reported?
Can I be fined under both NIS2 and GDPR for the same incident?
Who performs the NIS2 audit in Romania?
Sources
Every statement about a law or standard links to its official source. Consulted on the date shown.
- Directive (EU) 2022/2555 (NIS2)eur-lex.europa.eu · accessed 22 October 2026
- Implementing Regulation (EU) 2024/2690 — technical requirements for digital entitieseur-lex.europa.eu · accessed 22 October 2026
- ENISA — NIS2 Technical Implementation Guidance (v1.0, June 2025)enisa.europa.eu · accessed 22 October 2026
- Emergency Ordinance No. 155/2024 on the cybersecurity framework for networks and information systems (Romania)legislatie.just.ro · accessed 22 October 2026
- Law No. 124/2025 approving Emergency Ordinance 155/2024 (Romania)legislatie.just.ro · accessed 22 October 2026
- DNSC — press release on Orders 1/2025 and 2/2025 (registration and risk level)agerpres.ro · accessed 22 October 2026
- DNSC Order No. 1/2026 — risk management measures and maturity self-assessmentlegis.medleg.ro · accessed 22 October 2026
- Regulation (EU) 2016/679 (GDPR), consolidated texteur-lex.europa.eu · accessed 22 October 2026
- EDPB — Guidelines 01/2021 on examples regarding personal data breach notificationedpb.europa.eu · accessed 22 October 2026
- EDPB — Guidelines 9/2022 on personal data breach notificationedpb.europa.eu · accessed 22 October 2026
- Law No. 48/2023 on cybersecurity (Republic of Moldova)legis.md · accessed 22 October 2026
About the authors
The guides are written by the team that does the testing, not a marketing department. We update them when the law, the standard or what we see in testing changes.
Informational material, not legal advice. Legal texts may change, and the specific classification is decided by the competent authorities. Sources were consulted on the update date.