URL: https://auditcybersecurity.ro/en/nis2-energy/
Updated: 2026-11-05. Legal texts last checked: 2026-11-05.

Sector guide

# NIS2 for energy companies

Energy is a high-criticality sector, in Annex 1 of [GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690). Large companies are essential entities, medium ones are important, and the standard risk scores are 190 and 285. Fines reach 10,000,000 EUR or 2%.

- **Sector**: Energy, Annex 1

- **Large company**: essential entity

- **Medium company**: important entity

- **Standard score**: 190 and 285

**Definition**A critical entity is one identified under the resilience law. For NIS2 it is an essential entity whatever its size ([Art. 5(1)(c)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)), which matters in energy, where smaller operators can also play critical roles.

## Which energy companies are under NIS2 in Romania?

Medium and large companies in electricity, district heating or cooling, oil, gas and hydrogen are in scope, plus beneficiaries of the Modernisation Fund (GEO 60/2022). From 50 employees you are covered. Large companies are essential entities and medium ones important, under [GEO 155/2024](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690). CAEN codes are only hints.

| Subsector | Activities | CAEN hint |
|---|---|---|
| Electricity | Generation, distribution, supply, charging points | 35.1 |
| Heating and cooling | District heating or cooling | 35.3 |
| Oil | Pipelines, refining, storage, transport | 06, 19 |
| Gas | Supply, distribution, transport, storage, LNG | 35.2 |
| Hydrogen | Production, storage, transport | – |

Check your company

## When is an energy company essential?

A large company in Annex 1 is essential. Large means from 250 employees, and the test also looks at turnover of 50 million EUR and a balance sheet of 43 million EUR. Whatever their size, critical entities and those identified by DNSC under the [Art. 9](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) criteria are also essential.

## What risk level does an energy company have?

The standard energy scores in the annex to [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477) are 190 for a medium company and 285 for a large one. That usually means Important level and Essential level respectively. The real score comes from ENIRE@RO until [DNSC's NIS2@RO platform](https://platformanis2.ro) is operational, and decides which controls you apply.

| Size | Standard score | Range | Level |
|---|---|---|---|
| Medium | 190 | 100–199 | Important |
| Large | 285 | 200–1,500 | Essential |

At Essential level, key measures must reach at least 3 and the overall target is 3.5. See the [guide to DNSC Order 1/2026](https://auditcybersecurity.ro/en/dnsc-order-1-2026/).

## What deadlines does an energy company have?

The company notifies DNSC within 30 days, and DNSC decides within 60 days for essential and 150 days for important entities. From the decision (T0) you designate the officer within 30 days and send the risk-level assessment within 60 days. Essential entities also file a remediation plan within 30 days of the self-assessment.

| What | When | Basis |
|---|---|---|
| Notification to DNSC | within 30 days of coming under the law | [Art. 18(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| DNSC decision (T0) | within 60 days for essential, 150 days for important entities | [Art. 18(4)–(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Security officer designated | T0 + 30 days | [Art. 14(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Risk-level assessment | T0 + 60 days | [Art. 18(6)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Maturity self-assessment | 60 days after the risk-level assessment, then yearly, signed off by management | [Art. 18(7), 12(4)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Remediation plan (essential entities only) | within 30 days of each self-assessment | [Art. 12(5)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| The officer's accredited course (essential entities) | within 12 months of designation | [Art. 14(4)(e)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Changes to registration data | within 2 weeks or 3 months, depending on the item | [Art. 18(8)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |

Work out your deadlines

## How are OT systems treated?

The implementation guide of control PR.DS-11.1 says backup strategies should also cover OT systems: control system configurations, operational data and the settings of critical devices. In energy this means that the inventory, restore tests and continuity plan include the plant and the grid equipment, and not only the company's office systems.

- Put control systems and critical devices in the inventory.
- Keep copies of configurations on a different system, under PR.DS-11.1.
- Coordinate recovery tests with continuity and incident response; PR.DS-11.4 asks for this at Essential level.

[Read the backup guide](https://auditcybersecurity.ro/en/nis2-backup/)

## How is an incident reported in energy?

A significant incident is reported in three steps: an early warning within 24 hours, a notification within 72 hours and a final report within one month ([Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). Information on cross-border impact goes out within 6 hours, which is worth preparing if your networks or customers cross Romania's borders.

| Step | Deadline | Basis |
|---|---|---|
| Early warning | 24 hours | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Incident notification | 72 hours | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Final report | one month | [Art. 15](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |
| Information on cross-border impact | 6 hours | [Art. 15(3)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) |

## What fines does an energy company face?

An essential entity faces 10,000 lei up to 10,000,000 EUR or 2% of worldwide turnover, and an important one 5,000 lei up to 7,000,000 EUR or 1.4%, whichever is higher ([Art. 60(2)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). The percentage only raises the limit above 500 million EUR of turnover.

[See all NIS2 fines](https://auditcybersecurity.ro/en/nis2-fines-romania/)

## What to do next

Check if your company is in scope
Take the self-assessment

## Frequently asked questions

### Is a small energy supplier under NIS2?

As a rule no, if the company has fewer than 50 employees. The exceptions are critical entities and those identified by DNSC under the [Art. 9](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690) criteria.

### Are charging points covered?

Yes. The electricity subsector includes charging points, alongside generation, distribution and supply, with the same size thresholds.

### Are Modernisation Fund beneficiaries in scope?

Yes, they are listed in the energy sector by reference to GEO 60/2022. Check your exact situation with the [free scope check](https://auditcybersecurity.ro/en/nis2-scope-check/).

### Who is responsible for NIS2 in an energy company?

Management bodies approve the measures, oversee them and answer for breaches ([Art. 14(1)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). The security officer is designated within 30 days of the DNSC decision.

### How often does the self-assessment repeat?

Yearly, signed off by management ([Art. 12(4)](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)). The official self-assessment is done with the EVAL_MMS tools until the NIS2@RO platform is operational.

## Official sources

- [GEO 155/2024, Annex 1, consolidated text](https://legislatie.just.ro/Public/DetaliiDocumentAfis/311690)
- [the methodology in DNSC Order 2/2025](https://legislatie.just.ro/Public/DetaliiDocumentAfis/301477)
- [the Measures approved by DNSC Order 1/2026](https://legislatie.just.ro/Public/DetaliiDocumentAfis/314360)

About this guide

Published by AuditCyberSecurity.ro. This site is informative and sells nothing. The person behind it is involved in AirVault, an offline backup service; the link is stated wherever AirVault appears on a page.

Updated: 5 November 2026 · Legal texts last checked: 5 November 2026 · Information, not legal advice; check the official text.