NIS2 and GDPR
NIS2 and GDPR compliance in Romania: NIS2 audit, consulting and implementation
NIS2 and GDPR compliance means knowing whether the law applies to you, implementing the required technical and organizational measures and having your documentation ready for an inspection. Implementation projects start at €5,000 + VAT.
What’s included
- 01
NIS2 and GDPR gap analysis
We assess your current state against the NIS2 risk-management measures and the relevant GDPR articles, with a maturity score for each control.
- 02
Technical measures
MFA on critical accounts, network segmentation, encryption, vulnerability management, centralized logging and ransomware-resistant backup.
- 03
Documentation
Security policies, the record of processing activities (RoPA), DPIAs where required, incident response and business continuity plans.
- 04
Notification procedures
Clear workflows for reporting incidents to DNSC within the NIS2 deadlines and personal data breaches to ANSPDCP within 72 hours.
- 05
Training and awareness
Tailored sessions for management, the IT team and end users, plus phishing simulations.
- 06
Maintenance and review
Regular review of controls and documentation, adapted to legislative and organizational changes.
NIS2 and GDPR in brief
NIS2 (Directive (EU) 2022/2555) requires in-scope entities to adopt cybersecurity risk-management measures, report significant incidents and involve their management bodies. In Romania, the directive was transposed by Government Emergency Ordinance (OUG) 155/2024, and the competent authority is the National Cybersecurity Directorate (DNSC).
GDPR (Regulation (EU) 2016/679) applies to any company that processes personal data. The supervisory authority is ANSPDCP (the Romanian data protection authority), and personal data breaches must generally be notified within 72 hours.
The two regimes overlap in many areas: access control, encryption, backup, logging, incident response. That’s why we handle them in a single program, not as two separate projects. For companies that later want formal certification, we use ISO 27001, NIST CSF 2.0 and CIS Controls v8 as complementary benchmarks.
What’s at stake
NIS2 fines for essential entities can reach €10 million or 2% of global annual turnover, and GDPR provides for fines of up to 4% of global annual turnover. Beyond penalties, more and more large customers and public institutions ask their suppliers for evidence of compliance.
The IBM Cost of a Data Breach Report 2024 put the global average cost of a data breach at USD 4.88 million. For an SME, even a fraction of that amount can exceed several years of IT budget.
Indicative budget ranges
| Company type | Indicative budget |
|---|---|
| Fewer than 30 employees, one location, simple IT | €5,000–€8,000 + VAT |
| Medium-sized company, 2–5 locations, mixed infrastructure | €10,000–€25,000 + VAT |
| Essential entity, complex requirements | from €30,000 + VAT |
What you get: the gap analysis report with a score for each control, the prioritized remediation plan, the implemented technical controls, the written policies and registers, and team training. Everything is organized as a file you can present during a DNSC or ANSPDCP inspection, or to a customer asking for evidence.
How to get started
The first step is finding out where you stand. The technical measures are implemented together with our cybersecurity and business continuity service, and their effectiveness can be verified with a penetration test. The information on this page is general in nature and does not replace legal advice. Request a compliance audit.
NIS2 audit and NIS2 consulting
A NIS2 audit determines whether your company falls under the directive (as an essential or important entity), which risk-management measures are missing and which documents need to be prepared. The result is a report of the gaps against the requirements and a prioritized remediation plan.
NIS2 consulting supports you after the audit: policies and procedures, the incident response plan, supplier management, team training and preparation for a DNSC inspection. We can implement the technical measures (two-factor authentication, immutable backup, logging, network segmentation) directly, and the technical review can start from an IT security audit.
Not sure yet whether NIS2 applies to your company? Take the NIS2 self-assessment (in Romanian) or request a quote for a NIS2 compliance audit.
How we work
- Step 1
Scoping and gap analysis
We determine whether your company is an essential entity, an important entity or a supplier in an in-scope supply chain, then assess the gaps against the requirements.
- Step 2
Remediation plan
We prioritize measures by risk, effort and budget, with a phased timeline and a few quick wins in the first weeks.
- Step 3
Implementation
Our team does the technical work and writes the documentation, and you sign off on the result at each stage.
- Step 4
Periodic review
We re-check the controls, update procedures and prepare the report for management.
Frequently asked questions
Another question? +40 750 293 932 · office@secureitsolutions.ro
Does NIS2 apply to my company?
NIS2 generally covers medium-sized and large entities in the sectors listed in the directive, such as energy, transport, healthcare, digital infrastructure, manufacturing or digital services. In some cases it also applies to smaller companies, and suppliers to an in-scope entity may receive requirements through their contracts. In Romania, the framework is set by Government Emergency Ordinance (OUG) 155/2024, which transposes NIS2 into Romanian law, and the competent authority is DNSC (Romania's National Cybersecurity Directorate). Your exact status is determined from your company's activity and data; for a formal legal opinion we work together with specialized lawyers.
How long does a compliance audit take?
For a medium-sized company, the audit and remediation plan usually take 4–8 weeks. The duration depends on the infrastructure, the number of locations and how quickly documents and people are available for interviews. We deliver an interim report so obvious fixes can start in parallel.
How much does implementation cost?
As a guide, €5,000–€8,000 + VAT for companies with fewer than 30 employees and a single location, €10,000–€25,000 + VAT for medium-sized companies with mixed infrastructure, and €30,000 + VAT or more for essential entities with complex requirements. You receive a firm quote after the audit.
Is the legal side included?
We cover the technical, organizational and documentation side. For strictly legal matters, such as negotiating contracts with processors, data transfers outside the EU or representation before the authorities, we work with lawyers specialized in digital law, whom we coordinate within the project.
Do you guarantee compliance?
We guarantee delivery of the agreed technical controls and documentation. Compliance, however, is an ongoing state: it depends on how your team applies the procedures, on changes within the company and on legislative changes. That's why we recommend periodic reviews after implementation.
Related services
- Outsourced IT departmentAn outsourced IT department is an external team that takes over your company's IT support, administration, security and projects for a fixed monthly fee. Plans start at €150/month + VAT.
- Cybersecurity and business continuityCybersecurity for businesses combines EDR on workstations and servers, SOC monitoring, immutable backup and a tested recovery plan, so an attack doesn't stop your operations. We start with a free security audit.
- Penetration testingA penetration test is a simulated, controlled attack on your company's systems. It shows which vulnerabilities can actually be exploited, with what impact and in what order they should be fixed. Pricing is set based on scope.
Quote and free audit
Get a quote: NIS2 and GDPR compliance
We get back to you within 24 business hours. The first call and the initial audit are free.
Or message us on WhatsApp.
Request a quoteReply within 24 business hours