NIS2 classification file
We document your classification based on CAEN (NACE) codes, turnover, headcount and legal exceptions, so you can defend it before DNSC.
DNSC has started fining unregistered organizations, up to RON 500,000 for failing to notify.
DNSC registration and NIS2 notification for companies in Romania
For DNSC registration you have 30 days from the moment NIS2 starts applying to your organization. See below whether your sector is covered. We prepare the classification file, the DNSC notification and the NIS2 audit, for companies and institutions across Romania.
- A classification file backed by documents
- The DNSC notification, within the 30-day deadline
- NIS2 audit readiness
Request a quote for DNSC registration
Get a quote for the classification file, notification and NIS2 audit.
- 30 days
- deadline for notifying DNSC
- 60 / 150 days
- DNSC deadline for the registration decision
- RON 500,000
- maximum announced fine for failing to notify
WHY STOREWEB
Our own infrastructure, certified processes
Since 2008 we have worked with the servers, networks and data of companies and public institutions across Romania. We do cybersecurity on infrastructure we manage every day.
- ISO 9001:2015Certified quality management system
- ROTLD accredited partnerAuthorized registrar for .ro domains
- Directive (EU) 2022/2555Services aligned with NIS2 requirements
- GDPRData protection audit and implementation
WHO NIS2 APPLIES TO
Is your company in one of these sectors?
GEO no. 155/2024 covers companies in 18 sectors with at least 50 employees or over EUR 10 million turnover. Large companies have over 250 employees or EUR 50 million. If your sector is listed here, notifying DNSC is mandatory.
Essential entities
Large companies in highly critical sectors. Medium-sized companies in these sectors are important entities.
11 sectors, most critical first
- 1Energy electricity, district heating, oil, gas, hydrogen, offshore wind, charging points
- 2Health hospitals, clinics, laboratories, medicine manufacturers and distributors, pharmacies
- 3Drinking water
- 4Digital infrastructure cloud, data centres, DNS, electronic communications, trust services
- 5Transport air, rail, water, road, aircraft maintenance
- 6Banking
- 7Financial market infrastructure
- 8Public administration
- 9Waste water
- 10Managed ICT services (B2B) managed IT and security for other businesses
- 11Space ground infrastructure for space services
Important entities
Large and medium-sized companies in the other critical sectors
7 sectors, most critical first
- 1Food production, processing or distribution
- 2Manufacturing medical devices, electronics, electrical equipment, machinery, vehicles
- 3Chemicals manufacture, production, distribution
- 4Digital providers online marketplaces, search engines, social networks
- 5Postal and courier services
- 6Waste management
- 7Research
Essential or important?
Large company in the essential sectorsessential entity
Medium company in the essential sectorsimportant entity
Large or medium company in the other sectorsimportant entity
Some companies fall under NIS2 even if they are small
DNS providers, domain registries, trust service providers, electronic communications providers, public administration and companies designated by DNSC have separate rules. Since 2025, pharmacies and medicine distributors are covered too. Size thresholds also count companies in the same group. A wrong classification means either a fine for not notifying or paying for obligations you do not have.
NIS2 ELIGIBILITY CALCULATOR
NIS2 classification calculator: essential or important entity?
Select your sector and company size for an indicative classification (essential entity, important entity or supply chain supplier).
The result is indicative and is not legal advice. The official classification is confirmed by analysing your CAEN (NACE) codes and the criteria in GEO no. 155/2024.
Send the result and request a quoteWHAT'S INCLUDED
What the DNSC registration service includes
Every project is tailored to your organization's size, infrastructure and sector.
DNSC registration file
We prepare the technical and administrative information needed for the DNSC notification within the 30-day legal deadline from meeting the criteria.
The NIS2 officer role
We define the duties of your DNSC contact person, management responsibilities and the internal appointment documents.
DNSC registration, step by step
- Basic detailsYou tell us your sector, company size and the digital services you provide.
- ClassificationWe document your classification as an essential or important entity and your obligations under GEO no. 155/2024.
- NotificationWe prepare the DNSC notification and show you what follows after the registration decision.
NIS2 TIMELINE
NIS2 deadlines after notification: what comes next and when
Registration is the first step in a chain of deadlines. Each deadline runs from the previous step.
| Stage | Deadline | What it involves |
|---|---|---|
| 1. Notification to DNSC | 30 days | From the date GEO no. 155/2024 starts applying to your organization. Prepared under DNSC Order no. 1/2025, using the NIS2@RO tools. |
| 2. DNSC decision | up to 60 / 150 days | Identification and registration decision: up to 60 days for essential entities and up to 150 days for important entities. |
| 3. Risk level assessment | 60 days | From notification of the decision, using the methodology in DNSC Order no. 2/2025 (the ENIRE@RO tool). |
| 4. Maturity self-assessment | another 60 days | From submission of the risk assessment, under DNSC Order no. 1/2026. |
| 5. Remediation plan | 30 days | Essential entities prepare and submit to DNSC the plan of measures for the gaps found in the self-assessment. |
Deadlines are those in GEO no. 155/2024 and the DNSC orders as publicly communicated. Check the current version before making a decision.
What you risk if you do not register with DNSC
According to DNSC's public statements, proceedings for the first fines have started, targeting for now organizations that have not met the registration obligation. For failing to notify, DNSC has warned that the fine can reach RON 500,000.
The next steps are described on our pages about NIS2 gap analysis and CSIRT procedures and PNRISC reporting.
DNSC REGISTRATION GUIDE
DNSC registration and NIS2 notification, explained in plain English
What the DNSC notification contains, who submits it, what follows after registration and how to reach NIS2 compliance without missed deadlines.
What DNSC registration means
DNSC registration is the notification by which an organization covered by GEO no. 155/2024 declares itself to Romania's National Cyber Security Directorate. Based on it, DNSC decides whether to register you as an essential or important entity.
The deadline is 30 days from the date the law starts applying to your organization. A notification with wrong or incomplete data can lead to a wrong classification and to obligations you do not have or, worse, obligations you are not meeting.
What the DNSC notification contains
The DNSC notification includes your organization's identification details, sector and type of services, the NIS2 contact person, the countries where you provide services and the relevant IT resources.
This data must match your registered CAEN (NACE) codes, turnover and headcount. We prepare it in a classification file that you can defend during an inspection.
DNSC registration for groups of companies
In groups, company size also counts partner and linked companies. A company that is small on paper can be medium or large for NIS2 if it belongs to a group.
We check every company in the group, determine which ones need DNSC registration and how each is classified, so you notify neither too little nor too much.
What follows after DNSC registration
After notification, DNSC decides on registration within 60 days for essential entities and 150 days for important entities. The deadlines for the risk level assessment and the maturity self-assessment run from that decision.
To avoid working under deadline pressure, you can start early with the NIS2 gap analysis and the incident reporting procedures.
NIS2 compliance after notification
NIS2 compliance does not end with registration. Next come risk management measures, incident reporting, management training and, for many entities, the NIS2 audit.
STOREWEB covers the whole journey, from notification to cybersecurity audit readiness, with a single team.
How much DNSC registration with STOREWEB costs
The price depends on the number of companies, the complexity of your activity and existing documents. A single company with a clear activity needs less time than a group active in several sectors.
We work remotely with organizations across Romania. Fill in the form above and get a quote with clearly defined stages and deadlines.
FREQUENTLY ASKED QUESTIONS
Frequently asked questions about DNSC registration
Who must register with DNSC under NIS2?
Public and private entities in the critical sectors listed in GEO no. 155/2024 that meet the size thresholds or the special applicability criteria.
What is the deadline for notifying and registering with DNSC?
Covered entities must submit the notification to DNSC within 30 days of meeting the conditions for classification as an essential or important entity.
Does STOREWEB submit the notification or provide preparation support?
We prepare the classification analysis, the required data and supporting documents, so that your legal representative or designated person can submit a correct notification to DNSC.
Where is DNSC registration done?
The notification is sent to DNSC through the tool provided on the DNSC website. STOREWEB prepares the data and documents, and your organization's representative submits it.
Do you work with companies across Romania?
Yes. We handle DNSC registration, gap analysis and NIS2 audit preparation remotely for companies and institutions in any county, and visit your premises when needed. We also work with foreign groups that have Romanian subsidiaries.
THE NIS2 JOURNEY
Four steps from registration to audit
Each step prepares the next one. You can start with any of them, depending on where your organization is now.
You are hereStep 1
NIS2 classification and DNSC registration
Find out whether NIS2 applies and notify DNSC within the 30 days.
Request a quote for this step
Step 2
Gap analysis and ENIRE@RO
See how far you are from the required measures and what to fix.
See what's included
Step 3
CSIRT and PNRISC procedures
Know exactly who does what and how to report on the day of an incident.
See what's included
Step 4
Audit readiness
Reach the DNSC audit with your evidence ready and the plan in progress.
See what's includedThe notification deadline is 30 days
Leave your details in the form and get a quote for DNSC registration and the NIS2 audit, or call us now.
