{"id":252,"date":"2026-10-06T00:04:37","date_gmt":"2026-10-06T00:04:37","guid":{"rendered":"https:\/\/proit-romania.ro\/nis2-annual-self-assessment\/"},"modified":"2026-10-06T00:04:37","modified_gmt":"2026-10-06T00:04:37","slug":"nis2-annual-self-assessment","status":"publish","type":"post","link":"https:\/\/proit-romania.ro\/en\/nis2-annual-self-assessment\/","title":{"rendered":"The annual NIS2 self-assessment: what to prepare and when"},"content":{"rendered":"

In brief:<\/strong> NIS2 does not end with the notification to DNSC. After the registration decision come the entity risk-level evaluation and then the maturity self-assessment, each with its own deadline and both recurring. On 30 September 2026 DNSC announced its first contravention sanction for failing to meet the notification obligation, in the amount of 50,000 lei. The information stage is over.<\/p>\n\n

The first fine, as a signal<\/h2>\n

The decision was issued on 29 September 2026 against a legal entity in the public administration sector, for missing the notification deadline set by the ordinance. The amount, 50,000 lei, is useful as a reference point: nowhere near the million-euro ceilings written about in the press, but a real sum, applied for an administrative delay rather than for a security incident.<\/p>\n

The practical conclusion is that the authority checks deadlines, not only incidents. A company can be well protected technically and still be sanctioned for a document not sent on time.<\/p>\n\n

The chain of deadlines, in order<\/h2>\n

Every deadline after the notification runs from the date of the DNSC decision, not from the date of the law. This is the source of most of the confusion.<\/p>\n

\n
Stage<\/th>Deadline<\/th><\/tr><\/thead>
Notification to DNSC<\/td>30 days from the moment the provisions become applicable to the company<\/td><\/tr>\n
DNSC identification and registration decision<\/td>60 days for essential entities, 150 days for important ones<\/td><\/tr>\n
Designating the security officer<\/td>30 days from communication of the decision<\/td><\/tr>\n
Entity risk-level evaluation<\/td>60 days from the DNSC decision<\/td><\/tr>\n
Maturity self-assessment of the measures<\/td>60 days from the risk-level evaluation<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n

For an important entity, almost eleven months can pass between the notification and the last deadline. That is long enough to forget, and the calendar is precisely what gets forgotten.<\/p>\n\n

The tools and what each is for<\/h2>\n