Măsuri de gestionare a riscurilor de securitate cibernetică
NIS2 says what you must achieve, never how you demonstrate it. Romania answers with RO MMS. If you operate there, this is what your regulator reads.
Reviewed . Verify against the scheme owner before relying on this for a certification decision.
This framework is not compliance
Holding a high self-assessed maturity score does not by itself prove compliance. The obligation is owed under the ordinance, and the self-assessment is a filing you make about yourself, annually, signed off by your management under article 12(4) — it is what a supervisor starts from, not what closes the matter. Essential entities that identify deficiencies then owe a remediation plan within thirty days under article 12(5), and a cybersecurity audit is separately mandatory under article 11(5).
We put that first because it is the most expensive misunderstanding about any national framework. ISO/IEC 27001 helps build the management system, but the filing is against this catalogue and no other document: the self-assessment is submitted through the DNSC platform on the DNSC's own control identifiers.
3 tiers, cumulative
Each level contains everything below it. The counts are the controls a level adds, because that is the figure that stays stable across publications.
| Level | Adds | Cumulative | Intended for |
|---|---|---|---|
| Nivel de bază | 34 | 34 | Entities whose assessed risk level is the lowest of the three |
| Nivel important | 99 | 133 | Entities at the middle assessed risk level |
| Nivel esențial | 85 | 218 | Entities at the highest assessed risk level |
Thirty-four controls. The floor, not a starter kit: it is the applicable set for the entities it is assigned to.
Ninety-nine further controls. Cumulative: it contains the base level.
Eighty-five further controls, 218 in all. Cumulative again.
Each control carries TWO scores, not one: documentation maturity and implementation maturity, each an integer from 1 to 5, each justified in writing and each expected to be backed by operational evidence. A written policy on its own moves one of the two numbers.
The catalogue is taken under article 12(1) of Ordonanța de urgență nr. 155/2024, which directs the DNSC to set the technical, operational and organisational requirements giving effect to the ten measures of article 13. It is organised as functions, categories, subcategories and controls — six functions: governance, identification, protection, detection, response and recovery. That is not the shape of article 21(2) of the directive, nor of article 13 of the ordinance, both of which are flat lists of ten. Expect to re-cut your evidence. Which published taxonomy, if any, those six functions are drawn from is not recorded here: we have not read the annex.
Why there is no unit-level mapping
Article 21(2) is the article of NIS2 — Directive (EU) 2022/2555 — that lists the ten risk-management measures every entity in scope owes, lettered (a) to (j). Those ten letters are the first column of each table on this page, and the keys every mapping we publish hangs off. The ten measures, one by one.
The three levels and their cumulative totals — 34, 133 and 218 — are consistently reported, as are the six functions and the dual 1-to-5 scoring. The control identifiers themselves sit in the annex published in Monitorul Oficial, Partea I, nr. 712 bis, which we have not transcribed.
Not recorded yet at control level. Note, and do not over-read, that 34 / 133 / 218 are the published totals of CyFun Basic, Important and Essential to the control — and Romania is a joint owner of CyFun. That is a coincidence worth investigating, not an equivalence: no source we have read says the DNSC catalogue is CyFun, and we will not publish a mapping inferred from three matching integers.
No stable public identifiers to map against
This is a fact about the framework, not a gap in our research. Publishing invented identifiers here would give false precision on the most binding document in the country. The level this framework does publish is recorded above.
What you already have, for the same measure
Nobody in scope starts from nothing. RO MMS is what your supervisor reads; ISO 27001 and NIST 800-53 are what most organisations already run. Read a row across and you have the whole path, from the article to the control you can point at today.
| NIS2 art. 21(2) Directive (EU) 2022/2555 | ISO 27001 ISO/IEC 27001:2022 Annex A control | NIST 800-53 NIST SP 800-53 Rev. 5 control family |
|---|---|---|
| (a) Risk analysis | 5.1 5.2 5.3 5.4 5.7 5.31 5.35 5.36 | RA PL PM |
| (b) Incident handling | 5.5 5.6 5.7 5.24 5.25 5.26 5.27 5.28 6.8 8.15 8.16 | IR AU SI |
| (c) Continuity | 5.29 5.30 7.5 7.11 7.12 8.13 8.14 | CP PE |
| (d) Supply chain | 5.19 5.20 5.21 5.22 5.23 | SR SA |
| (e) Secure development | 5.8 8.8 8.9 8.25 8.26 8.27 8.28 8.29 8.30 8.31 8.32 8.33 8.34 | SA CM MA RA SI |
| (f) Effectiveness | 5.33 5.35 5.36 8.16 | CA PM |
| (g) Hygiene and training | 5.37 6.3 8.7 | AT SI CM |
| (h) Cryptography | 8.24 | SC |
| (i) HR, access, assets | 5.9 5.10 5.11 5.12 5.13 5.15 5.16 5.17 5.18 6.1 6.2 6.4 6.5 6.6 6.7 7.1 7.2 7.3 7.4 7.6 7.7 7.8 7.9 7.10 7.13 7.14 8.1 8.2 8.3 8.4 8.10 8.11 8.12 8.18 8.19 | PS AC IA CM MP PE |
| (j) MFA and comms | 5.14 8.5 8.6 8.17 8.20 8.21 8.22 8.23 | IA AC SC |
A crosswalk is not an equivalence
Holding the controls in a row does not discharge the measure. Each framework words its requirement differently, and each mapping has a stated limit:
- ISO 27001 — Mapping a control does not make it applicable: applicability comes from your risk assessment and your Statement of Applicability. Note also that the risk-assessment obligation of article 21(2)(a) is carried by clause 6.1 of the standard, not by Annex A — a control-only reading misses it.
- NIST 800-53 — Family level, not control. A family contains controls of very different scope, and which of them apply depends on the baseline and tailoring you operate — so a family match is a starting point for scoping, never evidence that a measure is met.
Use a row to find the evidence you already hold, then read the requirement itself.
- https://www.ccjtm.ro/monitorul-712-din-data-27-08-2026/
- https://www.ziuaconstanta.ro/stiri/actualitate/dnsc-lanseaza-instrumentele-pentru-autoevaluarea-maturitatii-masurilor-de-securitate-cibernetica-951975.html
- https://lege5.ro/gratuit/ge3daobuguydk/ordonanta-de-urgenta-nr-155-2024-privind-instituirea-unui-cadru-pentru-securitatea-cibernetica-a-retelelor-si-sistemelor-informatice-din-spatiul-cibernetic-national-civil
We are not affiliated with Directoratul Național de Securitate Cibernetică (DNSC). RO MMS and related marks belong to their owners.