Guide
DNSC Order 1/2026 explained
DNSC Order 1/2026 says in concrete terms which security measures apply and how you assess yourself. It has two annexes: the measures, grouped in six functions and three levels, and the self-assessment methodology, with scores from 1 to 5 and a threshold of 2.5 or 3 for key measures.
- Published
- Official Gazette 712, 27 August 2026
- Functions
- 6, from Govern to Recover
- Levels
- 3: Basic, Important, Essential
- Scores
- 1–5, with the EVAL_MMS tools
DefinitionDNSC Order 1/2026 is the act that details the risk-management measures required by Art. 11–13 of GEO 155/2024. Annex 1 holds the measures and Annex 2 the maturity self-assessment methodology. It is issued by the National Cyber Security Directorate.
What is DNSC Order 1/2026?
It is Order no. 1 of 6 August 2026, published in Official Gazette 712 of 27 August 2026. Annex 1 sets the risk-management measures and Annex 2 the maturity self-assessment methodology. It applies to the essential and important entities of GEO 155/2024, which implement the measures at their own risk level.
How are the measures organised?
The measures are grouped in six functions: Govern, Identify, Protect, Detect, Respond and Recover. Each control has a code, for example PR.DS-11.1, and applies from a given assurance level. Some controls are marked as key measures and take priority, because they have their own thresholds in the self-assessment.
Which level applies to my company?
The level comes from the score obtained with ENIRE@RO until DNSC's NIS2@RO platform is operational, under the methodology in DNSC Order 2/2025. A score of 0–99 means Basic, 100–199 means Important and 200–1,500 means Essential. The level sets the applicable controls and is not the same thing as the entity class in the law.
| Risk score | Assurance level | Self-assessment tool |
|---|---|---|
| 0–99 | Basic | EVAL_MMS_B |
| 100–199 | Important | EVAL_MMS_I |
| 200–1,500 | Essential | EVAL_MMS_E |
Until the NIS2@RO platform is operational, DNSC provides the ENIRE@RO and EVAL_MMS tools as downloads on the DNSC page on the duties of registered entities. Check there for the latest version.
How is the official self-assessment done?
The official self-assessment is the one in Annex 2, done with the EVAL_MMS_B, _I or _E tools until the NIS2@RO platform is operational. Each control gets a score from 1 to 5 for documentation and one for implementation. The first comes 60 days after the risk-level assessment, then it repeats yearly, signed off by management.
The self-assessment on this site is a quick check and does not replace the official one. This is not an audit under GEO 155/2024 and does not replace one.
What thresholds must be reached?
Key measures must reach at least 2.5 at Basic level and 3 at Important and Essential level. The total score must be at least 2.5, 3 and 3.5 respectively, and at Essential level each category must reach 3. Below target a remediation plan is required, under Art. 3 of the methodology.
| Level | Threshold for key measures | Each category | Total score |
|---|---|---|---|
| Basic | 2.5 | – | 2.5 |
| Important | 3 | – | 3 |
| Essential | 3 | 3 | 3.5 |
What does the order ask for backups?
Control PR.DS-11.1, a key measure at every level, requires backups of critical data on a system different from the one holding the original data. PR.DS-11.2 requires, from Important level, regular checks of reliability and integrity. The implementation guide says testing should take place at least yearly, or more often on a sample basis.
| Control | What it asks for | Levels |
|---|---|---|
| PR.DS-11.1 | Backups of critical data, stored on a different system. Key measure. | Basic, Important, Essential |
| PR.DS-11.2 | Reliability and integrity of backups checked and tested regularly. | Important, Essential |
| PR.DS-11.3 | A separate storage location, with controls equivalent to the main environment. | Important, Essential |
| PR.DS-11.4 | Recovery tests coordinated with continuity and incident response. | Essential |
| PR.DS-11.5 | Backups of critical systems, separate from those of critical information. | Essential |
Does the order ask for an offline copy?
The DNSC order on mandatory measures states that at least one backup copy should be kept fully offline or physically isolated. The wording appears in the implementation guide of control PR.DS-11.1 and uses "should". The text of the control asks for storage on a different system and names no technology.
What happens if I do not follow the order?
Failing to apply the security measures falls in the highest fine category: up to 7,000,000 EUR or 1.4% of worldwide turnover for important entities and up to 10,000,000 EUR or 2% for essential ones, whichever is higher (Art. 60(2)). These are maximum limits, not typical amounts.
What to do next
- Find out whether the company is in scope, and in which class.
- Set the risk level with ENIRE@RO.
- Do the official self-assessment with the EVAL_MMS tool for your level.
- Cover the key measures first and put the rest in a dated plan.
Frequently asked questions
What is the difference between entity class and assurance level?
The class (essential or important) comes from GEO 155/2024 and depends on sector and size. The level (Basic, Important, Essential) comes from the risk score and shows which controls you apply. An important entity may, for example, be at Basic level.
Must management sign off the self-assessment?
Yes. The self-assessment repeats yearly and is signed off by management (Art. 12(4)). Management bodies approve the measures, oversee them and answer for breaches (Art. 14(1)).
Who must file a remediation plan?
The methodology asks for a remediation plan below target. In addition, essential entities file the plan within 30 days of each self-assessment (Art. 12(5)).
Does the self-assessment on this site replace the official one?
No. It is a quick check in 25 questions, to show where the gaps are. The official self-assessment is done with the EVAL_MMS tools.
How does CyFun relate to the official self-assessment?
DNSC's EVAL_MMS files are the self-assessment tools for the CyberFundamentals framework (CyFun), version 2025, developed by the Centre for Cybersecurity Belgium. The official self-assessment follows Annex 2 to DNSC Order 1/2026 and uses these tools.
How does the order relate to the 2025 DNSC orders?
Order 1/2025 covers notification and registration, Order 2/2025 thresholds and the risk level, and Order 3/2025 supervision and control. Order 1/2026 adds the measures and the self-assessment.