Gap analysis across 6 domains
We assess Governance, Identify, Protect, Detect, Respond and Recover against GEO no. 155/2024 and DNSC Order no. 1/2026.
DNSC has started fining unregistered organizations, up to RON 500,000 for failing to notify.
NIS2 gap analysis and self-assessment under DNSC Order no. 1/2026
A NIS2 gap analysis shows how far you are from the measures in DNSC Order no. 1/2026. We prepare the evidence for your NIS2 self-assessment and deliver the remediation plan, for organizations across Romania.
- We compare your real situation with DNSC Order no. 1/2026
- We prepare the evidence for your self-assessment
- You receive a prioritized remediation plan
Request a NIS2 gap analysis
Get a quote for NIS2 gap analysis and self-assessment.
- 6 domains
- checked against DNSC Order no. 1/2026
- 60 days
- for the risk level assessment, from the DNSC decision
- 30 days
- for the remediation plan, for essential entities
WHY STOREWEB
Our own infrastructure, certified processes
Since 2008 we have worked with the servers, networks and data of companies and public institutions across Romania. We do cybersecurity on infrastructure we manage every day.
- ISO 9001:2015Certified quality management system
- ROTLD accredited partnerAuthorized registrar for .ro domains
- Directive (EU) 2022/2555Services aligned with NIS2 requirements
- GDPRData protection audit and implementation
WHAT'S INCLUDED
What the NIS2 gap analysis includes
Every project is tailored to your organization's size, infrastructure and sector.
ENIRE@RO and SecureRO support
We structure the risk register, the critical asset inventory and the evidence needed for the self-assessment on the SecureRO / CyFun platform.
Action plan and pre-audit
We prioritize technical and organizational measures by risk, impact and budget, with clear owners and deadlines before the certified audit.
NIS2 gap analysis, step by step
- ScopeTogether we define the infrastructure, applications, sites and critical suppliers in scope.
- AnalysisWe compare existing documentation, technical controls and policies with NIS2 requirements.
- Report and planYou receive the gap report and a remediation plan ordered by priority.
WHAT DNSC REQUIRES
The three assessments DNSC requires and where the gap analysis fits
After registration come three deliverables with deadlines. The gap analysis comes first, so you know what you will declare and with what evidence.
| Assessment | Legal basis | Deadline |
|---|---|---|
| 1. Risk level assessment | DNSC Order no. 2/2025, with the ENIRE@RO tool | 60 days from notification of the registration decision |
| 2. Maturity self-assessment | DNSC Order no. 1/2026, in force since 27 August 2026, covering risk management measures and the self-assessment methodology | 60 days from submission of the risk assessment |
| 3. Remediation measures plan | GEO no. 155/2024; essential entities submit it to DNSC | 30 days from the self-assessment |
Deadlines are those in GEO no. 155/2024 and the DNSC orders as publicly communicated. Check the current version before making a decision.
Why evidence matters, not just ticked boxes
DNSC representatives have stated publicly that self-assessments may be compared with what is found during an inspection and, later, with the circumstances of any incident. The gap analysis shows where you stand against the measures in Order no. 1/2026 and what evidence supports each answer.
SecureRO is DNSC's platform with a self-assessment questionnaire based on the CyberFundamentals (CyFun) framework and a free toolset. We use it as a starting point where the organization is already registered.
If you have not notified DNSC yet, start with DNSC registration and the deadline timeline.
GAP ANALYSIS GUIDE
NIS2 gap analysis and NIS2 self-assessment, explained in plain English
What the analysis checks, how it prepares you for the NIS2 self-assessment and ENIRE@RO, and what you get at the end.
What is a NIS2 gap analysis
The analysis compares what your organization does today with the measures required by GEO no. 155/2024 and DNSC Order no. 1/2026. The result shows, domain by domain, where you are covered, where you have gaps and which evidence is missing.
Unlike a ticked box on a questionnaire, the analysis checks real evidence such as approved policies, configurations, logs, supplier contracts and restore tests.
NIS2 self-assessment, what you send to DNSC and when
The NIS2 maturity self-assessment is sent to DNSC after the risk level assessment, within the deadline set by the DNSC orders. DNSC has stated publicly that self-assessments may be compared with what is found during an inspection.
That is why the NIS2 gap analysis comes before the self-assessment. You know what you declare and have evidence for every answer.
Risk level assessment with ENIRE@RO
DNSC Order no. 2/2025 sets the risk level assessment methodology, using the ENIRE@RO tool. The assessment is due within 60 days of the registration decision.
We prepare the data ENIRE@RO asks for, the critical asset inventory and the risk register, so the assessment is done once and done right.
Which domains we check
We analyse governance, asset and risk identification, protection, detection, incident response and recovery. For each domain we record the current level, the target level and what needs to be done.
We check the technical side directly on the infrastructure, with a team that has managed servers and networks since 2008.
NIS2 analysis for suppliers and SMEs
Companies not directly covered by NIS2 increasingly receive security questionnaires from their large customers. An analysis done early gives you the answers and evidence they ask for.
For SMEs we offer a shorter version focused on what customers usually ask for, with a remediation plan that fits a realistic budget.
How long a NIS2 gap analysis takes and what it costs
Duration and price depend on the number of sites, systems and critical suppliers and on existing documentation. A company with a single office finishes faster than a group with several sites.
We work remotely with organizations across Romania. Fill in the form above and get a quote with clearly defined stages and deliverables.
FREQUENTLY ASKED QUESTIONS
Frequently asked questions about the NIS2 gap analysis
What does a NIS2 gap analysis under DNSC Order no. 1/2026 cover?
The analysis covers all six domains of the national framework (Governance, Identify, Protect, Detect, Respond and Recover), identifying what is missing and what must be implemented.
What is the difference between a gap analysis and the regulated DNSC audit?
The gap analysis is a preliminary readiness assessment and internal diagnosis. The regulated audit (Articles 57-58 of GEO no. 155/2024) is performed only by a certified auditor listed by DNSC.
What documents does the organization receive after the assessment?
An executive summary for management, the gap matrix against NIS2 requirements, a preliminary risk register and a prioritized plan of technical and organizational measures.
Who must complete a NIS2 self-assessment?
Essential and important entities in the DNSC register submit the maturity self-assessment after the risk level assessment, under the DNSC orders.
Can the NIS2 analysis be done remotely?
Yes. Interviews and document review happen online, and technical checks through controlled access. We work with organizations across Romania.
THE NIS2 JOURNEY
Four steps from registration to audit
Each step prepares the next one. You can start with any of them, depending on where your organization is now.
Step 1
NIS2 classification and DNSC registration
Find out whether NIS2 applies and notify DNSC within the 30 days.
See what's includedYou are hereStep 2
Gap analysis and ENIRE@RO
See how far you are from the required measures and what to fix.
Request a quote for this step
Step 3
CSIRT and PNRISC procedures
Know exactly who does what and how to report on the day of an incident.
See what's included
Step 4
Audit readiness
Reach the DNSC audit with your evidence ready and the plan in progress.
See what's includedPrepare your self-assessment before the deadline
Leave your details in the form and we will come back with a quote, or call us now.
