NIS2 Compliance — What Website Owners Need to Know

By Tibzi Team — 2026-03-03T14:47:19.135Z

The NIS2 Directive (Network and Information Security Directive 2) is the most important European legal framework for cybersecurity. Adopted in 2022, it was transposed into Romanian law through OUG 155/2024 (Government Emergency Ordinance 155/2024) and Legea 124/2025 (Law 124/2025). If you run a commercial website or provide digital services, this guide helps you figure out whether you are affected and what you need to do.

What NIS2 is and why it matters

NIS2 (Directive 2022/2555) replaces the original 2016 NIS Directive and brings major changes:

  • Broader scope — it covers far more sectors and entities than NIS1
  • Significant fines — up to EUR 10 million or 2% of global turnover
  • Accountability at management level — management is directly responsible
  • Mandatory incident reporting — within 24 hours of detection
  • Specific technical measures — clear cybersecurity requirements

Who is affected in Romania

NIS2 sorts entities into two categories:

Essential entities

Organizations in critical sectors with more than 250 employees or turnover above EUR 50M:

  • Energy (electricity, oil, gas, hydrogen)
  • Transport (air, rail, water, road)
  • Banking and financial market infrastructure
  • Health (hospitals, laboratories, pharmaceutical manufacturers)
  • Drinking water and wastewater
  • Digital infrastructure (IXPs, DNS, TLDs, cloud, data centers)
  • Public administration
  • Space

Important entities

Organizations in other relevant sectors with more than 50 employees or turnover above EUR 10M:

  • Postal and courier services
  • Waste management
  • Chemical manufacturing
  • Food production
  • Digital service providers (online marketplaces, search engines, social media platforms)
  • Research
  • Manufacturing of medical devices, computers and electrical equipment

Does NIS2 affect you?

If you are an SME with a website and fewer than 50 employees, you are probably not directly covered by NIS2 (exceptions: DNS service providers, TLD registries, trust service providers). However, if you are a supplier or subcontractor of a covered entity, the requirements may be imposed on you indirectly through supply chain security.

Transposition in Romania

Romania transposed NIS2 through:

  • OUG 155/2024 — the main legal framework
  • Legea 124/2025 — additions and implementing rules
  • DNSC (National Cyber Security Directorate) — the supervisory authority

Deadlines:

  • September 2025 — deadline for covered entities to register with DNSC
  • Ongoing — implementing technical and organizational measures
  • 24 hours — deadline for the initial security incident report
  • 72 hours — detailed interim incident report
  • 1 month — complete final report

NIS2 technical requirements

Article 21 of the directive requires technical and organizational measures that include:

  1. Risk analysis and security policy — regular assessment of cyber risks
  2. Incident handling — procedures for detection, reporting and response
  3. Business continuity — backups, disaster recovery, crisis management
  4. Supply chain security — assessment of suppliers and subcontractors
  5. Network and system security — secure configuration, patch management
  6. Effectiveness assessment — regular security audits and tests
  7. Cryptography — appropriate use of encryption
  8. Human resources security — training, access control, multi-factor authentication

Fines and penalties

  • Essential entities — fines of up to EUR 10 million or 2% of total worldwide annual turnover (whichever is higher)
  • Important entities — fines of up to EUR 7 million or 1.4% of total worldwide annual turnover
  • Personal liability — members of management can be held individually liable
  • Temporary bans — suspension of activity for serious non-compliance

Practical compliance steps

Step 1: Initial assessment

Determine whether your organization is covered by NIS2. Check your sector, number of employees and turnover, and whether you supply a covered entity.

Step 2: Security audit

Run a full audit of your digital infrastructure. Our free audit checks 27 aspects of your website — a concrete first step in assessing your security posture.

Step 3: Identify gaps

Compare the audit results with the NIS2 requirements. Prioritize fixing critical vulnerabilities: SSL, security headers, exposed ports, email authentication.

Step 4: Remediation plan

Draw up an action plan with deadlines, owners and budgets. Include: security configuration, policies and procedures, employee training and an incident response plan.

Step 5: Register with DNSC

If you are a covered entity, register with the National Cyber Security Directorate within the legal deadlines.

Step 6: Continuous monitoring

NIS2 is not a one-time project — it requires ongoing monitoring and improvement. Run regular audits and keep your security measures up to date.

How Tibzi helps

Tibzi automatically checks many of the NIS2 technical requirements:

Start with a free full audit to assess the current security of your website.