RomaniaDNSC Order 1/2025, Notification for Registration of Essential and Important Entities
Ordinul directorului DNSC nr. 1/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-6
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/301474In force since .
A sector security regimes rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Criminal exposure note
- The order creates no offence and sets no penalty of its own.
- Obligation class
- Governance, Reporting
As of .
What it requires
- If you are an entity in a sector of Annex 1 or 2 of Ordonanța de urgență nr. 155/2024, use the NIS2@RO platform or the NIS2@RO tool to evaluate whether you are an essential or important entity and to generate the notification form for registration (Articles 2 and 3).
- Complete the notification form's six sections: general data, specific data (including size, services, contact points and your network address ranges), specific situations, attached documents, preliminary assessment and entity representation (Articles 4 and 5).
- Attach the documents that show you meet the medium or large enterprise thresholds, and any further documents DNSC asks for before registration (Article 5(4)).
- Have your legal representative sign the form with a qualified electronic signature and upload it to the platform, or send it to evidenta@dnsc.ro or file it on paper at DNSC's headquarters when you use the tool (Article 6).
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
Directoratul Național de Securitate Cibernetică (DNSC), which issues the order under Article 10(2) and Article 18 of Ordonanța de urgență a Guvernului nr. 155/2024 and receives the notifications and self-assessments it requires.
Settledness
- As of
What this law does
Order No. 1 of of the Director of the National Cyber Security Directorate (Ordinul directorului Directoratului Național de Securitate Cibernetică) approves the requirements for the process of notification for registration of essential and important entities and the method of transmitting the information, and was published in Monitorul Oficial No. 776 of .
DNSC provides two mechanisms for notification, the NIS2@RO digital tool that generates the notification form and the NIS2@RO platform for enrolment, information and cooperation. The notification form has six sections: general data, specific data, specific situations, attached documents, preliminary assessment and entity representation.
The entity must attach documents showing that it meets the medium or large enterprise thresholds on average annual employees, annual net turnover and total assets, together with its self-assessment under DNSC Order 2/2025 where applicable. The form is signed with a qualified electronic signature and uploaded to the platform, or, when the tool is used, sent to evidenta@dnsc.ro or filed on paper at DNSC's headquarters.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank, is a securities firm or provides telecom services.