Digital providers are in Annex 2 to OUG 155/2024, and medium-sized and large companies are important entities, with standard scores of 110 and 165, so the important level. The most frequent question, though, is a different one: is my online shop an online marketplace?
Who is covered by NIS2 as a digital provider
The NIS2 Directive, taken over in Annex 2, names three types of digital provider:
- providers of online marketplaces, meaning platforms through which consumers buy from other traders or other consumers;
- providers of online search engines;
- providers of social networking services platforms.
Size is set under Law No. 346/2004: as a rule, 50–249 employees for a medium-sized company and 250 or more for a large one. Small and micro companies are covered only in the special cases set out in the law.
Which assurance level applies
| Organisation size | Entity type | Standard risk score | Assurance level | At self-assessment |
|---|---|---|---|---|
| Small or micro | outside NIS2, except for the cases in the law | 55 | basic | 34 controls, threshold 2.5 |
| Medium | important | 110 | important | 133 controls, threshold 3 |
| Large | important | 165 | important | 133 controls, threshold 3 |
The standard score is the DNSC value for the sector, multiplied by 1, 2 or 3 according to size. If you operate in several sectors, the highest score applies.
An earlier version of the methodology exempted digital providers from the risk-level assessment. DNSC Order No. 1/2026 replaced that provision, and the exemptions now cover only the financial sector and providers designated as critical under DORA. Digital providers carry out the assessment, with a standard score of 55.
Find your level and maturity score in a few minutes. The calculator opens with the “Digital providers” sector already selected; you choose the size and answer 12 questions.
Calculate the level for your platformWhich systems are assessed at an online platform
At an online platform, the application is the business. The assessment usually covers:
- the web and mobile apps, with the APIs used by sellers and partners;
- user accounts, authentication and password recovery;
- payments, payouts to sellers and integration with payment processors;
- cloud infrastructure, content delivery networks and DDoS protection;
- content moderation and internal admin tools;
- personal data of buyers and sellers.
Online shop or online marketplace?
NIS2 takes over the definition from consumer protection law: an online marketplace is a service, operated by or on behalf of a trader, that allows consumers to conclude distance contracts with other traders or consumers.
An online shop selling only its own products is not in this sector. A shop that opens its platform to third-party sellers becomes, for that part, an online marketplace. What counts is what the platform does, not what it is called, and the size rule still applies: small and micro companies are not covered.
For online marketplaces, search engines and social networks, the European Commission set out the technical requirements in Implementing Regulation (EU) 2024/2690, which applies directly. It is worth reading alongside the DNSC controls.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
How TRU helps
For online platforms, attacks come straight from the internet, at any minute. We start with:
- PenTest, external, every month, on the application, the APIs and the admin panels, with reports within 48 hours of the scan being completed;
- SOC 24/7/365, to detect account takeovers and unusual access to admin panels;
- Proton Workspace, for the team: email, documents and passwords in Proton Pass, encrypted in transit and at rest.
Through CIO-as-a-Service we coordinate the inventory, the relationship with suppliers and the remediation plan. The audit is carried out by DNSC-certified auditors who are TRU partners.
Frequently asked questions
I run a medium-sized online shop. Am I covered by NIS2?
Not as a digital provider, if you sell only your own products. You may be covered through another sector, for example if you are also a wholesaler of food or chemicals.
Is a classified ads platform covered?
It depends on its features. If the transaction is concluded through the platform, it comes close to the definition of an online marketplace. If it only puts buyer and seller in touch and they agree outside it, analyse the classification carefully.
Is a small marketplace covered?
As a rule, no. Small and micro companies are covered only in the special cases in the law, for example if DNSC designates them.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian) · Implementing Regulation (EU) 2024/2690 · DNSC Order No. 1/2026 (in Romanian).