NIS2 consultancy and compliance support

The NIS2 Directive (EU) 2022/2555 sets cybersecurity risk-management and incident-reporting obligations for essential and important entities in the sectors listed in its Annexes I and II. In Romania it is transposed by Government Emergency Ordinance (OUG) 155/2024, which designates the National Cyber Security Directorate (DNSC) as the competent authority.

TEMERON helps organisations understand what the rules mean for them and put the technical and organisational measures in place. We combine regulatory work with hands-on security engineering: the same team that writes the policies also configures the monitoring.

What NIS2 requires

NIS2 applies, in general, to medium-sized and larger organisations of the types listed in Annexes I and II that operate in the EU; some entities fall under it regardless of size (Art. 2). The main obligations are:

• Risk-management measures (Art. 21): at least risk-analysis and security policies, incident handling, business continuity and crisis management, supply-chain security, secure acquisition and development including vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.
• Governance (Art. 20): management bodies approve the measures, oversee their implementation, can be held liable, and must follow training.
• Incident reporting (Art. 23): an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month.
• In Romania, entities in the Annex 1 and Annex 2 sectors notify DNSC for registration (OUG 155/2024, Art. 18) and report significant incidents to the national CSIRT (Art. 15).

How we support you

• Scope check: are you in a NIS2 sector, and are you likely to be an essential or important entity — or a supplier your customers will assess?
• Risk assessment and gap analysis against the Art. 21 measures.
• Security governance: policies, roles, and material for management approval and oversight.
• Incident-reporting workflows aligned with the 24-hour / 72-hour / one-month timeline.
• Compliance documentation that links each measure to evidence.
• Technical measures: security monitoring with TEMERON's XDR (our own Wazuh deployment), log collection and alerting, system hardening and access control, secure CI/CD practices.

Why TEMERON

TEMERON has worked in software and IT since 2002 and is based in Timișoara. We take part in EU-funded cybersecurity and security research — CIPHER (Digital Europe Programme) and CROSSMARE (Horizon Europe) — and act as an external advisor on AI ethics and compliance in the Horizon Europe project ENDURANCE, whose objective includes the joint implementation of the CER and NIS2 directives.

Frequently asked questions