How NIS2 Will Impact Your Business and How to Identify Essential Services

The Network and Information Systems Security Directive 2 (NIS2) represents a significant expansion of cybersecurity regulations across the European Union, including Romania. NIS2 entered in force in January 2023, but the Member States had 21 months to transpose it into national laws. As businesses prepare for compliance, understanding your obligations under NIS2 and identifying whether your organization provides essential services has become crucial for Romanian enterprises.

What is NIS2 and Why Should Romanian Businesses Care?

On 30th of December 2024, Romania published OUG 155/2024 which creates a legislative space that revolutionise the cyber security space. NIS2 strengthens the original NIS Directive, expanding its scope to include more sectors and introducing stricter cybersecurity requirements. For Romanian businesses, this means enhanced cybersecurity measures, mandatory incident reporting, and potential fines of up to €10 million or 2% of global annual turnover for non-compliance.

Key Changes Under NIS2

The directive introduces several significant changes that Romanian businesses must understand:

1. Expanded Scope: NIS2 now covers additional sectors including:
   • Digital infrastructure providers
   • Public administration
   • Healthcare organizations
   • Manufacturing of critical products
   • Food production and distribution
   • Waste management
   • Chemical manufacturing
   • Digital providers
2. Enhanced Security Requirements:
   • Implementation of state-of-the-art security measures
   • Regular risk assessments and documentation
   • Incident response planning and testing
   • Supply chain security assessments
   • Encryption and vulnerability management

How to Identify if Your Business Provides Essential Services for NIS2

Understanding whether your organization falls under NIS2 requires careful evaluation of your operations. This can be achieved by validating if your business meets any of the following requirements:

Size-Based Assessment

Your organization likely falls under NIS2 if it:

• Employs more than 50 people
• Has an annual turnover exceeding €10 million
• Provides services in one of the covered sectors

Sector-Specific Evaluation

Consider whether your organization operates in any of these essential service categories:

1. Energy sector:
   • Electricity suppliers
   • District heating providers
   • Oil production and distribution
   • Gas suppliers
2. Transport:
   • Air carriers
   • Railway companies
   • Shipping companies
   • Road transport services
3. Banking and Financial Markets:
   • Credit institutions
   • Trading venues
   • Central counterparties
4. Healthcare:
   • Healthcare providers
   • Research laboratories
   • Pharmaceutical manufacturers

Steps to Prepare for NIS2 Compliance

Preparing for NIS2 compliance is not that easy and straightforward, but if you follow the steps and implement the required procedures, your business is covered. Here are some easy steps for your business to prepare for this new directive:

1. Conduct a Gap Analysis

• Review your current security measures against NIS2 requirements
• Identify areas where there is a need of improvement
• Document any existing security controls and policies

2. Implement Required Security Measures

• Deploy advanced threat detection systems
• Establish strict incident response procedures
• Implement access control and authentication systems
• Ensure regular security training for staff

3. Establish Reporting Mechanisms

• Create incident reporting procedures
• Define clear communication channels with authorities
• Train relevant personnel on reporting requirements

Potential Impact on Your Business Operations

Operational Changes

• Enhanced security monitoring
• Regular security assessments
• Documentation requirements
• Staff training programs

Financial Considerations

• Investment in security infrastructure
• Compliance monitoring costs
• Training and certification expenses
• Potential penalties for non-compliance

Next Steps for Romanian Businesses Under NIS2 Directive

1. Assess Your Organization’s Status
   • Determine if you fall under NIS2 scope
   • Evaluate current security measures
   • Identify compliance gaps
2. Develop an Implementation Plan
   • Create a timeline for compliance
   • Allocate necessary resources
   • Assign responsibilities
3. Seek Expert Guidance
   • Consult with cybersecurity professionals
   • Engage legal experts for compliance requirements
   • Consider partnering with security service providers

Conclusion

NIS2 represents an important shift in cybersecurity requirements for Romanian businesses. Understanding your obligations and taking proactive steps toward compliance is essential for maintaining business continuity and avoiding penalties. By carefully assessing your organization’s status and implementing necessary security measures, you can ensure compliance while strengthening your overall security posture.

Looking for expert guidance on NIS2 compliance? Contact our team of cybersecurity specialists to schedule a consultation and learn how we can help protect your business.