RomaniaOrdonanța de urgență nr. 155/2024, Cybersecurity Risk-Management Measures
Ordonanța de urgență a Guvernului nr. 155/2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor și sistemelor… informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 11-14
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://legislatie.just.ro/Public/DetaliiDocumentAfis/293121In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, water, digital infrastructure, public administration, and a size-gated telecom or managed-security-service provider) are reached too, by declaring that you are an essential or important entity.
- Take technical, operational and organisational measures proportionate to your risk exposure to identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services.NIST CSF 2.0ID.RA-05
- Cover at least: risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of your risk-management measures; cryptography and encryption policy; supply-chain security, including the security of your relationship with your direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access control and asset management; incident management; business continuity, including backups, disaster recovery and crisis management; basic cyber-hygiene practices and training; and multi-factor or continuous authentication.NIST CSF 2.0GV.PO-01
- Have your governing body approve these measures, supervise their implementation and bear responsibility for them; have each member of the governing body attend accredited cybersecurity training and train all your staff regularly; establish permanent means of contact and allocate the resources the measures need; and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying you and entering you in the register.NIST CSF 2.0GV.RR-01NIST CSF 2.0GV.RR-02NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text. Also read by: Directoratul Național de Securitate Cibernetică (DNSC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 60(1) makes a Article 11(1) violation a contravenție (an administrative regulatory offence) only "dacă nu au fost săvârșite în astfel de condiții încât să fie considerate infracțiuni potrivit legii" (unless committed under conditions that would make it a criminal offence under other law); this instrument's own sanction, an amendă contravențională under Article 48, is administrative rather than criminal.
Penalty structure
Article 60(2)(b), as rewritten by Legea nr. 124/2025, sets the maximum fine for an essential entity's violation of Article 60(1) letters a) through m), dd), jj) and mm) (which includes the Article 11(1) risk-management duty at letter a)) at the greater of EUR 10,000,000 in lei equivalent or 2 percent of annual worldwide turnover, with a minimum of 10,000 lei. Article 60(2)(a) sets a lower tier for an important entity's violation of the same letters other than letter e) at the greater of EUR 7,000,000 in lei equivalent or 1.4 percent of annual worldwide turnover, with a minimum of 5,000 lei, mirroring NIS2 Article 34(4) and (5). Under Article 60(3), the turnover is the one recorded in the entity's last financial year.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Directoratul Național de Securitate Cibernetică (DNSC), or, for a sector with its own designated sectoral competent authority under Article 37, that authority acting alongside DNSC.
Settledness
- As of
- Guidance link
- https://www.dnsc.ro/pagini/legislatie-nis2
- Guidance body
- Directoratul Național de Securitate Cibernetică (DNSC)
- Open questions
- Has the Directorul DNSC issued the Article 12(1) order detailing the technical, operational and organisational risk-management requirements, due within 120 days of the OUG's entry into force, and does it narrow or add sector-specific requirements for an online marketplace, online search engine or social-networking-services platform specifically?
What this law does
Article 11(1) requires an essential or important entity to take technical, operational and organisational measures proportionate to its risk exposure to identify, assess and manage the risks to the network and information systems it uses, across at least ten baseline categories mirroring NIS2 Article 21(2): risk-analysis and system-security policy and its periodic review; evaluating the effectiveness of risk-management measures; cryptography and, where applicable, encryption policy; supply-chain security, including the security of the entity's relationship with its direct suppliers and service providers; security of system acquisition, development, maintenance and decommissioning, including vulnerability management and disclosure; human-resources security, access-control policy and asset management; incident management; business continuity, including backup management, disaster recovery and crisis management; basic cyber-hygiene practices and cybersecurity training; and multi-factor or continuous authentication.
Article 12(1) requires the DNSC director to issue an implementing order on these technical, operational and organisational requirements within 120 days of the OUG's entry into force. Article 14 requires the entity's governing body to approve these measures, supervise their implementation and bear responsibility for them.
Article 14(2), as rewritten by Law 124/2025, requires the members of the governing body to attend accredited professional training courses and the entity to train all its staff regularly.
Article 14(3), as rewritten by Law 124/2025, requires the governing body to establish permanent means of contact, allocate the resources needed to implement the measures, and designate the officers responsible for network and information-system security within 30 days of the notification of the DNSC director's decision identifying the entity and entering it in the register.
Under Article 50(4), as rewritten by Law 124/2025, neither the general meeting of shareholders nor the board of directors is a governing body of an essential or important entity for the purposes of the Ordinance. Article 66(1)(a) repeals the predecessor statute, Legea nr. 362/2018, outright as of this OUG's own entry into force.
Article 4 defines a piață online (online marketplace) and a motor de căutare online (online search engine) as digital-provider categories among the entities Articles 5 and 6 bind as essential or important. Article 2(3) applies only Articles 5 to 10 and Article 18 of this Ordinance to an entity that Regulation (EU) 2022/2554 (DORA) covers.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .