RomaniaOrdonanța de urgență nr. 155/2024, Incident Notification
Ordonanța de urgență a Guvernului nr. 155 din 30 decembrie 2024 privind instituirea unui cadru pentru securitatea cibernetică a rețelelor… și sistemelor informatice din spațiul cibernetic național civil, approved by Legea nr. 124/2025, art. 15-17
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://legislatie.just.ro/Public/DetaliiDocumentAfis/293121In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds an essential or important entity under Articles 5 and 6, which name a piață online (online marketplace), a motor de căutare online (online search engine) and a platformă de servicii de socializare în rețea (social-networking-services platform) among the digital-provider categories it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management row.
- Report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of your services, through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).NIST CSF 2.0RS.CO-02
- Report to the national cybersecurity-incident-response team any information that lets it establish a cross-border impact of the incident, without undue delay and in any event within 6 hours of becoming aware of that information (Article 15(3)).NIST CSF 2.0RS.CO-03
- Submit an early warning within 24 hours of becoming aware of a significant incident, stating whether it is suspected unlawful, malicious, or cross-border in impact; follow with a fuller incident report within 72 hours giving an initial severity and impact assessment and any known indicators of compromise; submit an interim report if the computer security incident response team (CSIRT) requests one; and submit a final report within one month of the 72-hour report, or a progress report followed by a final report if the incident is still ongoing at that point.NIST CSF 2.0RS.CO-02
- Where relevant, notify the recipients of your services of a significant incident that could affect them.NIST CSF 2.0RS.CO-02
- If you are a trust service provider, report an incident affecting your trust services within a flat 24 hours of becoming aware of it, rather than on the graduated clock.NIST CSF 2.0RS.CO-02
These lines are LexLint's reading of the law's text. Also read by: Directoratul Național de Securitate Cibernetică (DNSC) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 60(1) letters l) and m) make a violation of the Article 15(1) reporting clock, or of the duty to notify service recipients, a contravenție (an administrative regulatory offence) only where the conduct does not separately meet a criminal offence's elements under other law; this instrument's own sanction, an amendă contravențională under Article 48, is administrative rather than criminal.
Penalty structure
Article 60(2)(a)-(b), as rewritten by Legea nr. 124/2025, applies the same top penalty tier that governs an Article 11(1) violation (EUR 10,000,000 or 2 percent of annual worldwide turnover for an essential entity, EUR 7,000,000 or 1.4 percent for an important entity, whichever is greater) to a violation of Article 60(1) letters a) through m), which include letter l) (missing the Article 15(1) reporting clock or conditions) and letter m) (failing to notify service recipients under Article 15(1)). Letter n), as rewritten by Legea nr. 124/2025, covers failing to notify or remedy significant incidents, or to remedy deficiencies found by the competent authorities, within the deadlines and conditions they indicate; it falls in the lower fixed-lei tier of Article 60(2)(c)-(d), which runs from 1,000 to 300,000 lei for an important entity and from 1,500 to 500,000 lei for an essential entity. A serious infringement under Article 50(2), among them a repeated infringement and false or manifestly distorted information on the Article 15 reporting duties, is fined from 3,000 to 600,000 lei under Article 60(2^1), with the limits raised by half for a repeated infringement under Article 60(4).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Directoratul Național de Securitate Cibernetică (DNSC), acting as the national CSIRT that receives the notification, or, for a sector with its own designated sectoral competent authority under Article 37, that authority acting alongside DNSC.
Settledness
- As of
- Guidance link
- https://www.dnsc.ro/pagini/legislatie-nis2
- Guidance body
- Directoratul Național de Securitate Cibernetică (DNSC)
- Open questions
- Has DNSC published guidance on how it applies the significant-incident criteria in Article 15(6), as that paragraph's introductory words were rewritten by Law 124/2025?
What this law does
Article 15(1) requires an essential or important entity to report to the national cybersecurity-incident-response team, without undue delay, any incident with a significant impact on the provision of its services, and, where relevant, to notify the recipients of its services of a significant incident that could affect them. Article 15(2) routes this reporting through the Platforma națională pentru raportarea incidentelor de securitate cibernetică (PNRISC).
Article 15(7) sets a graduated clock: an early warning within 24 hours of becoming aware of the significant incident, indicating whether it is suspected to be caused by unlawful or malicious acts or to have cross-border impact; an incident report within 72 hours, updating the early warning and giving an initial assessment of the incident's severity and impact, including indicators of compromise where available; an interim report on the national computer security incident response team (CSIRT)'s request; and a final report within one month of the 72-hour incident report, including a detailed description of the incident, its likely cause, mitigation measures applied and in progress, and any cross-border impact, or, if the incident is still ongoing at that point, a progress report followed by a final report once it has been resolved.
Article 15(8) sets a flat 24-hour clock for a trust service provider's incidents affecting its trust services. Article 16 lets an entity outside the mandatory scope voluntarily report incidents, cyber threats and near misses to the national CSIRT under the same Article 15 channel, without that report itself creating any additional obligation.
Article 17 extends Articles 15 and 16 to certain electronic-communications entities under Legea nr. 58/2023 that are identified as essential or important entities under this OUG. Article 62 separately requires DNSC to inform ANSPDCP, Romania's data-protection authority, without undue delay when a cybersecurity incident it supervises also implicates personal-data protection.
Law 124/2025, which approves the Ordinance with amendments and completions, rewrites the introductory words of Article 15(6), the paragraph that sets when an incident counts as significant. Article 2(3) applies only Articles 5 to 10 and Article 18 of this Ordinance to an entity that Regulation (EU) 2022/2554 (DORA) covers.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .