DNSC has started fining unregistered organizations, up to RON 500,000 for failing to notify.
NIS2 check for Romanian companies: is your company in scope?
Enter the Romanian company ID (CUI) and we pull the NACE (CAEN) code, turnover and headcount from public ANAF data. See whether the company is an essential or important entity, which DNSC deadlines apply and what is missing.
- Indicative classification by NACE (CAEN) code and company size
- DNSC deadlines calculated as calendar dates
- The CyFun® assurance level and the key measures that are missing
Check your company by CUI
Free. Results in seconds, no account needed.
We only use public data from ANAF, the Romanian tax authority. Company data is cached for 24 hours to spare the ANAF service.
- 2 minutes
- from company ID to indicative classification and your deadlines
- ANAF data
- NACE code, turnover and headcount from the latest financial statements
- CyFun® level
- basic, important or essential, using the DNSC methodology
NIS2 check result
Check result
In the next step you confirm what the company does, so the result becomes precise. It takes a minute.
A few details about the company
The result updates instantly.
Does any of the following apply?
Tap what fits. You can pick several or none.
ANAF shows only the main code. You find the others in the trade register certificate.
Is the company part of a group?
In a group, headcount and turnover are added up.
Which assurance level applies
Calculated with the DNSC risk assessment methodology (ENIRE@RO), from the sector and company size.
Where do you stand with DNSC?
We calculate your deadlines as calendar dates.
Key measures: how ready is the company?
Short questions on the key measures DNSC checks in the self-assessment. Pick an answer and we move on automatically.
Your NIS2 report is ready
Classification, dated deadlines and next steps in a PDF, plus a calendar file with the deadlines.
Your report is ready
If we see a missed deadline or a classification worth checking, we call you the same working day.
For a PDF, choose “Save as PDF” in the print dialog.
TEAM AND CERTIFICATIONS
Why STOREWEB for NIS2 compliance
Since 2008 we have worked with the servers, networks and data of companies and institutions across Romania. Our specialists hold Cisco CCNA 1, 2, 3 and 4 certificates, and we do cybersecurity on the infrastructure we run every day.
- ISO 9001:2015Certified quality management system
- ROTLD accredited partnerAuthorized registrar for .ro domains
- Cisco CCNA 1, 2, 3 and 4Certified specialists in networking, routing and access security
- GDPRData protection audit and implementation
NIS2 check in three steps
- Enter the company IDWe pull the name, NACE (CAEN) code, turnover and headcount from public ANAF data.
- Get the classificationWe match the NACE codes against the annexes of GEO no. 155/2024 and calculate the size under EU rules.
- See your deadlinesWe calculate the DNSC deadlines as dates and show what is missing.
The result is indicative. ANAF publishes only the main NACE code and the financial statements, not the group structure. DNSC sets the official classification after notification. For a documented classification, ask for our NIS2 scoping analysis.
NIS2 in Romania: NACE codes, size and deadlines
How a company falls under NIS2 in Romania and what comes next.
Which NACE (CAEN) codes fall under NIS2
The law has no list of NACE codes. Romania's GEO no. 155/2024 targets sectors and types of services, grouped in Annex 1 (sectors of high criticality) and Annex 2 (other critical sectors). The company's authorised NACE codes are the starting point: if none matches a sector in the annexes, the company usually has no direct obligations.
The NIS2 check on this page matches NACE codes (Rev.2 and Rev.3) against the sectors in the annexes. For codes that cover several activities it shows the exact condition, for example whether you provide managed services to other companies or run a marketplace.
How company size is calculated for NIS2
Size follows the EU SME rules. A company is medium-sized from 50 employees, or when both turnover and balance sheet exceed EUR 10 million. It is large from 250 employees, or above EUR 50 million turnover and EUR 43 million balance sheet.
If the company belongs to a group, partner and linked enterprises are added up. That is why a small Romanian subsidiary of a large group can fall under NIS2.
Essential or important entity
Broadly, large companies in Annex 1 sectors are essential entities, while medium companies in Annex 1 and large and medium companies in Annex 2 are important entities. Some categories are in scope regardless of size: DNS service providers, TLD registries, trust service providers and public electronic communications providers.
The difference matters: essential entities get the DNSC decision faster, submit the remediation plan after the self-assessment and face higher fines for serious breaches.
Deadlines after DNSC registration
After notification, DNSC decides within 60 days for essential entities and 150 days for important ones. From the decision you have 30 days to appoint the cybersecurity officer and 60 days for the risk level assessment.
The maturity self-assessment follows within another 60 days, and essential entities then submit the remediation plan. The NIS2 check calculates these dates from your decision date. For the NIS2 gap analysis and risk assessment we can help.
CyFun® assurance levels: basic, important, essential
After registration, each entity calculates its risk level with the ENIRE@RO tool, following DNSC Order no. 2/2025. The score starts from the DNSC values for each sector and grows with company size: below 100 means basic, 100 to 199 important, and 200 or more essential.
The level sets how many security controls must be implemented. The important level has 131 controls, including 22 key measures that cannot be excluded and must reach at least 3 out of 5 in the self-assessment. The NIS2 check on this page estimates your level and shows how many key measures look below target.
Does NIS2 apply to a small company?
Usually not. Small companies are in scope only in special cases: DNS services, TLD registries, trust services, public electronic communications, or when they are the sole provider of an essential service.
Even outside direct scope, large customers that are NIS2 entities may require security measures from you as a supplier. Cybersecurity monitoring and incident procedures help you meet those requirements.
Methodology and sources of the NIS2 check
The classification matches NACE codes against Annexes 1 and 2 of GEO no. 155/2024, approved by Law no. 124/2025, and company size follows the EU SME rules. The assurance level follows the risk assessment methodology of DNSC Order no. 2/2025 (ENIRE@RO), with the default DNSC values for each sector. Deadlines follow GEO no. 155/2024 and DNSC Order no. 1/2026.
The readiness test follows the key measures of the DNSC self-assessment, which is built on the CyberFundamentals (CyFun®) framework. The questions are our own wording and do not reproduce the control texts. The check is maintained by the STOREWEB cybersecurity team, with Cisco CCNA 1, 2, 3 and 4 certified specialists.
We already use CyFun® at group level. What changes in Romania?
Romania applies NIS2 through GEO no. 155/2024 and the DNSC methodology: the ENIRE@RO risk assessment and a maturity self-assessment built on the CyberFundamentals framework. Your Romanian entity still registers with DNSC on its own, receives its own decision and deadlines, appoints a cybersecurity officer with a DNSC-authorised course and submits its documents in Romanian.
Controls run at group level can be reused, but the Romanian entity must show the evidence. We map your group CyFun® evidence to the DNSC self-assessment, translate what is needed and prepare the ENIRE@RO report, so the local team does not start from zero.
What data the NIS2 check uses
We use public ANAF services: the taxpayer register (name, registered office, main NACE code) and the indicators from the latest financial statements (turnover, average headcount, total assets). The euro rate is the National Bank of Romania annual average for that year.
Company data is cached on our server for 24 hours to spare the ANAF service. Your answers stay in your browser until you send the report form.
Updated 14 November 2026. CyFun® is a registered trademark of the Centre for Cybersecurity Belgium (CCB). The STOREWEB check is not an official DNSC or CCB tool and does not replace the ENIRE@RO report, the official self-assessment, an assessment by an accredited body or an audit by a DNSC-certified auditor.
NIS2 Romania check: frequently asked questions
Is the NIS2 check free?
Yes. The company ID check, the indicative classification, the deadlines and the readiness test are free. For the PDF report and the calendar file we ask for your contact details.
Is the result official?
No. It is an indicative classification based on public ANAF data and your answers. DNSC sets the official classification through its decision to enter the company in the register of entities.
Why should I add secondary NACE codes?
ANAF publishes only the main NACE code. An authorised secondary activity can bring the company into scope, so check the trade register certificate and add the relevant codes.
What if the result says we are in scope?
Notify DNSC as soon as possible if you have not done so. With our NIS2 scoping analysis we confirm the category on documents, complete the form correctly and give you the calendar of obligations.
What if we missed the notification deadline?
The registration obligation remains after the deadline, and DNSC has started fining unregistered organisations. Notify DNSC without delay and prepare for the next steps.
What does the CyFun® level in the result mean?
It is the security level DNSC will require: basic, important or essential. We calculate it with the ENIRE@RO methodology from the sector and company size, using the default DNSC values. The official result comes from the ENIRE report you submit to DNSC.
Are Romanian municipalities in scope?
The NIS2 public administration sector covers central public administration, with the exceptions in the law. Municipalities and county councils are not included in this sector, but may have obligations through other activities, such as water or transport.
Do you store the company ID or my data?
Public company data is cached on our server for 24 hours. Your contact details reach us only if you send the report form.
NIS2 compliance in four steps, from registration to audit
Each step prepares the next one. You can start with any of them, depending on where your organization is now.
NIS2 classification and DNSC registration
Find out whether NIS2 applies and notify DNSC within the 30 days.
See what's included
NIS2 gap analysis and ENIRE@RO
See how far you are from the required measures and what to fix.
See what's included
CSIRT incident reporting and PNRISC
Know exactly who does what and how to report on the day of an incident.
See what's included
Cybersecurity audit preparation
Reach the DNSC audit with your evidence ready and the plan in progress.
See what's includedNIS2 check in two minutes, the full analysis with us
Enter the company ID and get the classification, deadlines and report. For a documented analysis, request it through the form.
