The NIS2 Directive has changed the way many organisations look at cybersecurity. For companies in essential or important sectors, security is no longer just good practice; it is an obligation that has to be demonstrated.
Who NIS2 applies to
NIS2 targets organisations in essential or important sectors, such as energy, transport, healthcare, utilities, telecommunications, IT and digital services, as well as other services that society depends on. In Romania, the competent authority is the National Cyber Security Directorate (DNSC).
The first step is to establish whether your organisation falls within the scope of the directive and what obligations follow from it. NIS2 requirements often overlap with other applicable frameworks, such as DORA for the financial sector or BNR, ASF and ADR requirements.
What it requires in practice
When we assess NIS2 compliance, we look at the measures that cover the organisation’s main risk areas:
- cybersecurity risk management and governance;
- incident management and business continuity;
- supply chain security;
- vulnerability management;
- cyber hygiene and access control.
It is not enough for these measures to exist on paper. What matters is whether they are implemented in practice, whether there is evidence of their application and whether they are monitored over time.
How to prepare
The most efficient starting point is a gap analysis: a comparison between what you have now and what NIS2 requires. It shows you clearly what is missing and what is worth prioritising before an official audit.
Next comes the cybersecurity audit, which assesses the technical and organisational controls in place and identifies non-conformities. Penetration testing can complete the picture by validating technical controls under real-world conditions. The results are then turned into a prioritised remediation plan, tailored to the organisation’s resources.
Why a certified auditor matters
For audits required in the NIS2 context, it matters that the assessment is carried out by a certified cybersecurity auditor. Dataeye is a DNSC-accredited cybersecurity auditor, registered in the National Register of Cybersecurity Auditors under IDASC QC-18310A7. If you want a clearer picture of where you stand against NIS2 requirements, we can start with a discussion about your organisation’s context.
