NIS2 cybersecurity audit and NIS2 consulting in Romania

A cybersecurity audit checks, based on evidence, how well an organization protects its networks, systems, data and services. It does not stop at hardware. It looks at who decides, which rules exist, how they are applied and what happens when an incident occurs.

The result is a clear view of your risks, a list of findings ranked by severity and recommendations management can approve and fund. For a company, a cybersecurity audit is the fastest way to find where it is exposed before an attacker or an inspector does.

Any organization can commission a voluntary cybersecurity audit, to understand its risks or because a large customer asks for one. The regulated NIS2 audit is different. GEO no. 155/2024 requires it for essential and important entities, and only a DNSC-certified cybersecurity auditor can perform it, under strict independence rules.

STOREWEB performs the technical assessment, the NIS2 consulting and the full preparation. When the regulated NIS2 audit comes, your organization already has the documentation, the evidence and a remediation plan in progress, so the auditor's findings are few and easy to close.

A NIS2 audit checks whether the risk management measures required by law are in place and documented. DNSC Order no. 1/2026 groups these measures into 6 domains, from governance and risk analysis to incident handling, continuity and supplier security.

Management accountability is checked too. Management approves the measures, oversees their implementation and takes part in training. That is why a well-prepared NIS2 audit starts with governance documents, not with the firewall.

NIS2 consulting from STOREWEB covers the whole journey. We determine whether you are an essential or important entity, prepare your DNSC registration, carry out the NIS2 gap analysis and the risk level assessment, and write the incident response and reporting procedures.

The difference from paper-only consulting is the technical side. We have worked with servers, networks, hosting and backups since 2008, so our cybersecurity recommendations can actually be implemented, not just written in a report.

Many small companies are not directly covered by NIS2 but work for companies that are. Those customers must check supply chain security, so they ask suppliers for concrete evidence about passwords, access, backups, updates and incident handling.

A cybersecurity audit done early helps these suppliers answer customer questionnaires quickly and keep their contracts. For a small company, cybersecurity becomes a commercial advantage, not just an obligation.

We start with a conversation about your business, digital services and infrastructure. Together we agree which systems are in scope and what evidence already exists. Then come interviews, document review and technical checks on configurations, accounts, network and backups.

At the end you receive the cybersecurity audit report, with findings ranked by risk level, and a remediation plan with priorities and deadlines. If you wish, we implement the technical measures ourselves, through IT outsourcing or on dedicated servers managed by our team.

The notification to DNSC is due within 30 days of the date the law starts applying to your organization. DNSC decides on registration within 60 days for essential entities and 150 days for important entities.

After the decision comes the risk level assessment within 60 days, then the maturity self-assessment within another 60 days. Essential entities submit the remediation plan within 30 days. For failing to notify, DNSC has announced fines of up to RON 500,000.

The price depends on the number of sites, systems and critical suppliers, on existing documentation and on what you need, from classification and registration to a full gap analysis or NIS2 audit preparation. A company with one office and a few servers needs less time than a group with several sites.

Fill in the form above, we have a short call and you receive a quote for the cybersecurity audit or NIS2 consulting, with stages, deliverables and timeline clearly set out.