NIS2 in manufacturing

The NIS2 Directive extends cybersecurity obligations from energy, transport and telecom operators to a large part of manufacturing. In Romania the initial deadline for registering with DNSC (the National Cyber Security Directorate) passed in September 2025, so production companies that fall in scope and have not yet notified are already late.

Legal framework

At European level the basic text is Directive (EU) 2022/2555, known as NIS2. Romania transposed it through Government Emergency Ordinance (OUG) 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civilian cyberspace, published in Monitorul Oficial (the Official Gazette) no. 1332 of 31 December 2024. Parliament approved it with amendments through Law 124/2025, published in Monitorul Oficial no. 638 of 7 July 2025.

The competent authority is DNSC. On 20 August 2025, in Monitorul Oficial no. 776, the first two implementing orders appeared: Order 1/2025 on notification for registration, and Order 2/2025 with the criteria for assessing service disruption and the methodology for assessing the risk level of entities.

Which plants are in scope

The directive has two annexes. Annex I covers sectors of high criticality, Annex II other critical sectors. Industrial production sits mostly in Annex II, which includes:

• manufacture of medical devices and in vitro diagnostic medical devices
• manufacture of computer, electronic and optical products (NACE Rev. 2, division 26)
• manufacture of electrical equipment (division 27)
• manufacture of machinery and equipment n.e.c. (division 28)
• manufacture of motor vehicles, trailers and semi-trailers (division 29)
• manufacture of other transport equipment (division 30)
• manufacture, production and distribution of chemicals
• production, processing and distribution of food, for companies involved in wholesale distribution and in industrial production and processing

Anyone making basic pharmaceutical products and pharmaceutical preparations (division 21) is in Annex I, under the health sector. Law 124/2025 also added the distribution of medicines to that annex.

The second filter is size. The directive applies to companies that are at least “medium-sized” under Recommendation 2003/361/EC, which in broad terms means at least 50 employees, or annual turnover and balance sheet total above 10 million euro. The exact thresholds, including the rules for linked and partner enterprises, are in the recommendation. If you belong to a group, count at the level the recommendation requires, not just the Romanian company.

Say a car supplier has 60 employees and makes electrical equipment for motor vehicles. The activity falls under division 29 and the size is above the threshold, so the company is in scope even if it does not see itself as “critical infrastructure”. Check against the activity you actually carry out, not only the main CAEN code (the Romanian NACE code).

Essential and important entities

Annex I entities above the medium-sized threshold are, as a rule, essential. Annex II entities are, as a rule, important. The state can still identify an Annex II entity as essential, for example if it is the sole provider of a service. The final classification comes from the DNSC decision entering the entity in the register.

The difference matters for supervision and for fines. Under OUG 155/2024 as amended by Law 124/2025, the maximum fines for the most serious category of offences reach 7 million euro or 1.4% of worldwide annual turnover for important entities, and 10 million euro or 2% for essential ones, whichever is higher. For other offences, including those linked to incident notification, the caps are 300,000 lei for important entities and 500,000 lei for essential ones.

Registering with DNSC

Order 1/2025 set a deadline of 30 days from its entry into force for notification, and that deadline expired in September 2025. The obligation did not go away: a company that is in scope and has not notified must do so now, using the tools published on dnsc.ro. After the registration decision comes the risk level assessment under the methodology in Order 2/2025, with deadlines that run from the date the decision is communicated.

From the same date, management has 30 days to appoint the people responsible for the security of networks and information systems (art. 14 para. (3) of the OUG, in the form given by Law 124/2025).

Incident reporting

For a significant incident, the directive requires three steps:

• an early warning within 24 hours of becoming aware of the incident
• an incident notification within 72 hours
• a final report within one month of the notification

In a plant this means knowing in advance who decides that an incident is significant, who sends the notification and what information you already have to hand. Ransomware that stops the recipe server or the SCADA system on a Friday evening is not the moment to start looking for the procedure.

Management is accountable

The directive requires management bodies to approve risk management measures, oversee their implementation and be held accountable. In Romania, Law 124/2025 specifies that members of management bodies take accredited professional training, and that the general meeting of shareholders and the board of directors are not management bodies within the meaning of the ordinance. Approving and overseeing the measures therefore falls to executive management, not only to the IT department.

Supply chain

The minimum list of measures in Article 21 of the directive includes supply chain security, meaning the relationship with direct suppliers and service providers. The entity must take into account the vulnerabilities of each supplier and their secure development practices.

The effect runs both ways. If you are in scope, you will be asking your suppliers questions. If you are not, but you deliver to someone who is, you will receive questionnaires and new contract clauses.

What it means for OT

The directive speaks of “networks and information systems” and does not exclude production. In practice the automation network enters the risk assessment just like the office servers. A few points to check now:

• an inventory of the equipment on the production network: PLCs, HMIs, industrial PCs, switches, with firmware and operating system versions
• separation between the office network and the production network, with documented firewall rules
• remote access by machine suppliers: who has an account, through which channel, with what authentication, and who approves each session
• 4G routers or modems installed by suppliers in electrical cabinets, which bypass the plant firewall
• backups of PLC programs and HMI configurations, tested by restoring them
• multi-factor authentication for remote access, which the directive mentions explicitly among the measures

Remote service access deserves to be checked first. A router that came with the machine and was configured at commissioning often stays outside the IT inventory, and so outside the risk assessment.

What is still unclear

The secondary framework is still moving. After the August 2025 orders, DNSC issued further acts, including rules from November 2025 on supervision and control, and their texts are best read directly on legislatie.just.ro. The precise deadlines for the risk assessment, the self-assessment of measures and the remediation plan come from the DNSC orders in force and from the decision each entity receives, not from summaries.

If you are not sure your company falls under NIS2, the first practical step is to compare your actual activities and size figures with Annexes 1 and 2 of OUG 155/2024 and, if needed, ask DNSC for its view.

For questions and real experience with registration or with supplier access to machines, we talk in the WhatsApp group “Digitalisation & Industry 4.0”.