Article 13 of OUG 155/2024 lists ten areas of measures that essential and important entities must cover, and for four of them it explicitly requires policies and procedures. The management bodies approve them (art. 14). At the audit, the DNSC-certified auditor checks each document and the evidence that it is applied. The self-assessment methodology in DNSC Order 1/2026 scores documentation and implementation separately.
The ten areas of art. 13 and their documents
| Letter | Documents | Evidence the auditor asks for |
|---|---|---|
| (a) risk analysis and information system security | information security policy; risk analysis methodology; risk register; review calendar | the risk level assessment submitted to DNSC; the annual self-assessment; management minutes |
| (b) assessing the effectiveness of measures | assessment procedure: indicators, tests, internal audit | penetration test reports; SOC reports; exercise results |
| (c) cryptography and encryption | cryptography policy: what is encrypted, where, with which keys, who manages them | configurations; certificate inventory; proof of encryption in transit and at rest |
| (d) supply chain | supplier policy; security clauses in contracts; list of critical suppliers | contracts; supplier assessments; monitoring evidence |
| (e) acquisition, development, maintenance, decommissioning; vulnerabilities | vulnerability and patch management procedure; disclosure procedure; change management procedure | scan reports; patch records; retests after remediation |
| (f) human resources, access control, assets | access control policy: roles, rights, review; joiner and leaver procedure; asset inventory | the asset list; periodic rights reviews; accounts disabled on leaving |
| (g) incident handling | incident handling procedure, with the notification deadlines: 24 hours, 72 hours, one month; incident register | notifications sent to DNSC; SOC reports; response exercises |
| (h) business continuity | continuity plan; backup policy; disaster recovery plan; crisis management plan | backup restore tests; continuity exercises |
| (i) cyber hygiene and training | hygiene rules: passwords, updates, email, devices; training programme | attendance lists; management courses (art. 14 para. (2)); materials used |
| (j) authentication and secure communications | multi-factor authentication standard; list of systems covered; secure channels, including the emergency one | configurations; screenshots; list of approved exceptions |
The exact number of controls depends on your assurance level: 34, 133 or 218, by risk level. The list above covers the areas; the controls say how deep you go into each.
What the auditor checks on each document
- it is approved by management, dated and signed;
- it has a named owner, not “the IT department”;
- it has a version and a review date that is respected;
- it is known by the people who have to apply it;
- it has evidence that it works: logs, reports, configurations, minutes;
- exceptions are documented and approved, not tolerated.
Frequent mistakes
- Copied policies
- A set of downloaded documents, with another company’s name left in a header. The auditor recognises them from the first page.
- Policies without evidence
- The backup policy exists, the restore test was never done. In the self-assessment, implementation scores zero.
- An outdated asset inventory
- The server decommissioned last year is still in the inventory, the new one is not. DNSC can request the list at any time.
- An incident procedure without deadlines
- It does not say who notifies DNSC and within what time. The first DNSC fine was precisely for a notification deadline.
- Everything left to IT
- Policies written and approved only by IT. The law places them with management.
The order to do them in
- The risk level assessment, to know how many controls you have to cover.
- The asset inventory and the risk list: without them, no policy has an object.
- The policies tied to liability and deadlines: security and risks (a), access and assets (f), incidents (g), continuity (h).
- The remaining areas: suppliers (d), vulnerabilities (e), cryptography (c), authentication (j), training (i), assessing effectiveness (b).
- The evidence, collected as you apply them: reports, logs, minutes.
- The self-assessment, then the remediation plan, then the audit.
How TRU helps
Through CIO-as-a-Service, from €100 per hour, we write the policies and procedures with you, on the structure above, take them to management for approval and prepare the audit file. The technical evidence comes from PenTest, SOC 24/7/365 and Proton Business. The audit is performed by DNSC-certified auditors, TRU partners, under a direct contract.
Sources
OUG 155/2024, consolidated text (in Romanian), art. 11, 13 and 14 · DNSC Order no. 1/2026, the measures and the self-assessment methodology.