Essential and important entities designate the persons responsible for network and information system security within 30 days of being notified of the DNSC director’s decision. At larger essential entities, the person must have managerial authority, report directly to management and operate independently of IT. Responsibility for the measures stays with management, whoever holds the role.
What the law says
Article 14 of OUG 155/2024 places cybersecurity with management. The management bodies approve the risk management measures, supervise their implementation and are liable for breaches. They also attend accredited training courses and ensure staff are trained.
The same article requires them to set up permanent contact channels, allocate the necessary resources and designate the persons responsible for network and information system security. The deadline is 30 days from notification of the DNSC director’s decision registering the entity as essential or important.
For essential entities other than public administration, micro and small enterprises, art. 14 para. (4) adds cumulative conditions for the designated person:
- managerial authority;
- direct reporting to the entity’s management bodies;
- independence from the IT and operational technology structures;
- access to the resources needed to supervise and implement the measures;
- an accredited specialist course recognised by DNSC, obtained within 12 months of designation.
For important entities and for small essential entities, the designation obligation remains, without these conditions.
Who can be the NIS2 security officer
- An employee with authority
- The natural option where a security director or risk manager with authority and budget already exists. The independence-from-IT condition means that, at large essential entities, the head of IT cannot combine the role: they would supervise their own measures.
- An external consultant, by mandate
- The law uses the verb “designate” and does not tie the role to an employment contract. An external officer meets the conditions through the appointment decision and a written mandate: direct reporting to management, access to systems and documents, the authority to require measures from suppliers. Responsibility stays with management.
- What does not work
- A name on a form, without time, access or authority. During audits and inspections, DNSC looks for evidence that the role is exercised: assessments, plans, reports, decisions.
In-house or outsourced
The real question is who has the time and the competence, not where they are employed.
| Criterion | In-house officer | Outsourced officer |
|---|---|---|
| Cost | Salary, taxes, training. An experienced specialist is expensive and hard to find. | Monthly subscription, a fraction of the cost of an employee. You pay for the time used. |
| Independence from IT | Hard to achieve where IT has 2–5 people who all operate systems. | Set by contract: does not operate the systems, supervises them. |
| Time to start | Months, if you recruit. | Days. |
| Continuity | Depends on one person. | A team, with a stand-in. |
| Knowledge of the company | Deep, from the inside. | Built in the first weeks, with access to people and documents. |
Outsourcing makes sense at important entities and at essential entities below the threshold of the art. 14 para. (4) conditions, where no in-house specialist exists, and at large ones as a transition until they recruit.
What the NIS2 security officer does, month by month
- keeps the risk level assessment current and prepares the annual self-assessment of the measures under DNSC Order 1/2026;
- turns the self-assessment result into the remediation plan, with deadlines and owners;
- writes and updates the policies and procedures the measures require and takes them to management for approval;
- coordinates the security providers: SOC, penetration testing, backup, encryption;
- prepares the audit and the relationship with the DNSC-certified auditor, then follows up the plan after the report;
- coordinates the notification of significant incidents to DNSC within the legal deadlines: early warning within 24 hours, notification within 72 hours, final report within one month;
- reports to management, periodically, on the status of the measures and the remaining risks.
How TRU helps
Through CIO-as-a-Service we take on the role of outsourced NIS2 security officer: the appointment decision and written mandate, the risk level assessment, the self-assessment, the remediation plan, the policies and the coordination of suppliers. We report directly to management.
The audit stays separate: it is performed by DNSC-certified auditors, TRU partners, under a direct contract. For the technical measures you have, when needed, PenTest, SOC 24/7/365 and Proton Business.
The cost depends on the risk level and on how much of the role we take over. We set it after a 30-minute conversation.
Sources
OUG 155/2024, consolidated text (in Romanian), art. 14 and 60, approved with amendments by Law no. 124/2025 (Official Gazette no. 638 of 7 July 2025) · DNSC: legislation · DNSC Order no. 1/2026.