RomaniaDNSC Order 2/2025, Service-Disruption Criteria and Entity Risk-Level Methodology
Ordinul directorului DNSC nr. 2/2025 (11 august 2025), Monitorul Oficial nr. 776/2025, art. 1-5
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2026. Publisher's page: https://legislatie.just.ro/Public/DetaliiDocument/301475In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- If you are an entity within Annex 1 or 2 of Ordonanța de urgență nr. 155/2024 that has not been qualified as essential or important under its Articles 5, 6 and 9 criteria, assess the degree of disruption of each service you provide that falls within those Annexes, using the thresholds in Annex 1 to Order 2/2025, and use the result to complete the registration information (Article 1).NIST CSF 2.0ID.RA-04
- Calculate your overall risk score with the formulas in Annex 2 to the order, starting from the base values for your entity type or sector and your size, and implement the category of security measures that the score sets (Articles 4 and 5(1)).NIST CSF 2.0ID.RA-05
- If you operate in several sectors, assess your risk level for each sector and implement the level of measures that matches your highest overall score (Article 5(2)).NIST CSF 2.0ID.RA-05
- If your own impact or probability values differ from the sector base values, send DNSC an analysis with a sound reason for each value you ask to change (Article 5(3)).NIST CSF 2.0GV.OC-03
- Recalculate your overall score every three years and whenever the high impact threshold for your sector is exceeded, unless you already apply the highest level of measures (Article 5(5)).NIST CSF 2.0ID.RA-05
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- ID.RA-04Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The order creates no offence and sets no penalty of its own; sanctions for breaching the security measures it selects are those of Ordonanța de urgență nr. 155/2024.
Who enforces it
Enforcement body
Directoratul Național de Securitate Cibernetică (DNSC), which issues the order under Article 10(2) and Article 18 of Ordonanța de urgență a Guvernului nr. 155/2024 and receives the notifications and self-assessments it requires.
Settledness
- As of
What this law does
Order No. 2 of of the Director of the National Cyber Security Directorate (Ordinul directorului Directoratului Național de Securitate Cibernetică) approves the criteria and thresholds for determining the degree of disruption of a service and the methodology for assessing the risk level of entities, and was published in Monitorul Oficial No. 776 of .
Article 1 requires an entity that has not been qualified as essential or important under the listed criteria of Emergency Ordinance No. 155/2024 to assess the degree of disruption of each service it provides that falls within Annex 1 or 2, so as to complete the information that DNSC Order 1/2025 asks for.
Article 4 states that the methodology determines the category of technical, operational and organizational risk-management measures an entity must implement, and that the entity's overall score sets the complexity of the security measures. Under Article 5, an entity that operates in several sectors assesses its risk level for each sector and implements the level of security measures that matches its highest overall score.
An entity recalculates its overall score every three years and whenever the high impact threshold for its sector is exceeded, unless it already applies the highest level of measures. An entity that is the only provider in Romania of a service listed in Annex 1 is an essential entity, and one that is the only provider of an Annex 2 service is an important entity, if the other criteria of Emergency Ordinance No. 155/2024 do not already identify it.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank, is a securities firm or provides telecom services.