Waste water is in Annex 1 to OUG 155/2024, separate from drinking water but with the same standard score: 67.5 for a small organisation, 135 for a medium-sized one and 202.5 for a large one. The frequent question is not the level but the classification: is a factory with its own treatment plant covered?
Who is covered by NIS2 in waste water
The wording in Annex 1 comes from the NIS2 Directive and covers urban, domestic and industrial waste water. It includes:
- operators of the sewerage service, which collect and dispose of urban and domestic waste water;
- operators of municipal waste water treatment plants;
- specialised companies that collect, dispose of or treat industrial waste water for other companies;
- not covered: undertakings for which collecting, disposing of or treating waste water is a non-essential part of their general activity.
Size is set under Law No. 346/2004: as a rule, 50–249 employees for a medium-sized company and 250 or more for a large one. Small and micro companies are covered only in the special cases set out in the law.
Which assurance level applies
| Organisation size | Entity type | Standard risk score | Assurance level | At self-assessment |
|---|---|---|---|---|
| Small or micro | outside NIS2, except for the cases in the law | 67.5 | basic | 34 controls, threshold 2.5 |
| Medium | important | 135 | important | 133 controls, threshold 3 |
| Large | essential | 202.5 | essential | 218 controls, threshold 3.5 and at least 3 in every category |
The standard score is the DNSC value for the sector, multiplied by 1, 2 or 3 according to size. If you operate in several sectors, the highest score applies.
Find your level and maturity score in a few minutes. The calculator opens with the “Waste water” sector already selected; you choose the size and answer 12 questions.
Calculate the level for waste waterWhich systems are assessed in sewerage and treatment
Unlike drinking water, the main risk in waste water is a discharge into the environment or flooding, not a dry tap. The assessment usually covers:
- treatment plant automation: blowers, aeration tanks, chemical dosing and the sludge line;
- waste water pumping stations and level sensors in the network;
- discharge analysers and reporting to environmental authorities;
- dispatch and failure alarms;
- maintenance and asset management systems;
- remote access by equipment suppliers and integrators.
Your company has its own treatment plant. Is it covered by NIS2?
The annex excludes undertakings for which collecting, disposing of or treating waste water is a non-essential part of their general activity. A dairy or a tannery that treats its own waste water does not become a waste water operator just because it has a treatment plant.
The company may still be covered by NIS2 through its core activity, for example food production, chemicals or manufacturing, in Annex 2. The treatment plant is then assessed as a system supporting that activity, and stopping it can stop production.
Things change when treatment becomes a service: a company treating industrial waste water for other companies, for example in an industrial park, has treatment as its very activity and falls under waste water.
What comes next
- notification to DNSC, within 30 days from the date OUG 155/2024 becomes applicable to the organisation; the first DNSC fine sanctioned exactly this deadline;
- the risk-level assessment, within 60 days of the DNSC decision;
- the self-assessment, within the following 60 days, on the controls of your level;
- the audit, carried out by a DNSC-certified auditor.
How TRU helps
In sewerage and treatment, teams spend a lot of time in the field and systems are often managed by integrators. We start with:
- PenTest, external and internal, checking integrator access and what is exposed to the internet, with reports within 48 hours of the scan being completed;
- SOC 24/7/365, for detection and response outside working hours, when plants run unattended;
- Proton Workspace, for correspondence with authorities and suppliers, encrypted in transit and at rest.
Through CIO-as-a-Service we coordinate the inventory, the relationship with suppliers and the remediation plan. The audit is carried out by DNSC-certified auditors who are TRU partners.
Frequently asked questions
What does industrial waste water mean under NIS2?
Waste water from industrial or commercial activities. What counts is who collects and treats it as a core activity: the sewerage operator or the specialised company is covered, while the factory producing it is not covered on this basis.
Does a large sewerage operator have the essential level?
Yes. The standard score of a large organisation is 202.5, above the 200 threshold, so the essential level: 218 controls, a threshold of 3.5 at self-assessment and at least 3 in every category.
Do the treatment plant’s controllers have to be tested?
You add them to the inventory and check who connects to them. Intrusive testing is done only as planned, with the operator and the integrator, in a maintenance window. You usually start with the IT network and the access points to the automation.
Sources
OUG 155/2024 (in Romanian) · Directive (EU) 2022/2555 · DNSC risk-level methodology (in Romanian).