If you run a small business, you've probably heard of NIS2 already — usually together with the figure "fines of 10 million euros". The good news: your company is most likely not directly covered by the directive. The less good news: that doesn't mean you escape it. Your larger clients, banks, hospitals and the institutions you work with are starting to vet their suppliers — and the question "what security and backup measures do you have?" is appearing more and more often in contracts. Let's put things in order, without jargon.
What NIS2 is, in short
NIS2 is the European directive on network and information security (EU Directive 2022/2555), transposed in Romania by Government Emergency Ordinance (GEO) no. 155/2024, approved with amendments by Law no. 124/2025. The authority applying it is DNSC — the National Cyber Security Directorate, which has also issued the implementing rules (Orders no. 1/2025 and 2/2025).
In plain terms: the state requires companies in critical sectors — energy, healthcare, transport, banking, water, digital infrastructure, postal services, food production and others — to take serious cybersecurity measures, register with DNSC and report incidents within strict deadlines.
Is my company directly covered?
The basic rule: the directive covers medium and large entities (generally from 50 employees or over €10 million turnover) operating in the sectors listed in the law's annexes. A company with 5–15 employees, a single medical practice or an accounting firm usually isn't directly covered — with a few specific exceptions (for example, certain digital service providers are covered regardless of size).
If in doubt, the right check is against the criteria in GEO 155/2024, not articles on the internet — and a consultant or even DNSC can confirm whether you're covered.
Why it affects you even if you're not directly covered
Article 21 of the directive requires covered entities to secure their supply chain as well — meaning their suppliers. In practice, a clinic, a bank or a manufacturer covered by NIS2 will start asking small partners for concrete evidence: security policies, tested backup, a continuity plan. Supplier questionnaires have already started circulating, and one of the first technical questions is invariably: "describe your backup procedure and the last time you tested a restore".
In other words: NIS2 doesn't come to you with a fine, it comes to you through your clients. And small businesses that can answer "yes, we have tested 3-2-1 backup, with a report" will win contracts over those that can't.
The deadlines that matter in 2026
For entities covered by the law, the calendar looks like this: registration with DNSC (on the NIS2@RO platform) has to happen within 30 calendar days of becoming covered, with an annual confirmation by 31 March. For incidents, the deadlines are tough: an early warning within 24 hours, a detailed notification within 72 hours and a final report within 30 days. And fines reach €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones — with liability that can extend personally to management.
Where backup fits into all this
Among the minimum measures explicitly required by Article 21 of the directive is business continuity: backup management and disaster recovery. It's not a recommendation — it's on the mandatory list, at the same level as encryption and multi-factor authentication.
That confirms what we've told our clients from the start: backup isn't optional insurance, it's basic infrastructure. A 3-2-1 system — a local copy on a NAS with immutable snapshots, an encrypted copy in the cloud, documented restore tests — covers exactly the continuity requirement in NIS2 and, at the same time, the integrity and availability obligations in the GDPR.
What you should do now, in practice
If you're a small business and not directly covered by the law: you don't register anywhere and you don't pay anything — but prepare for your large clients' questions. Concretely: put your backup on paper (what gets copied, where, how often), test a restore at least once a year and keep the evidence, and turn on two-factor authentication on critical accounts. If you work with hospitals, banks, local authorities or large companies, do this before they ask you to.
If you suspect your company might be directly covered — check now, not after the first inspection. The 30-day deadline from becoming covered runs whether or not you knew about it.
Want to see quickly where you stand? Take the free backup and ransomware check: 14 questions, 10 minutes, with a score for each area and the first actions to take.
Frequently asked questions
Are companies with fewer than 50 employees completely exempt from NIS2?
Usually yes, with specific exceptions in a few sectors (certain digital and infrastructure services). But the requirements reach small businesses indirectly, through contracts with clients covered by the law.
What does a covered company that doesn't register with DNSC risk?
Fines under GEO 155/2024, which can reach millions of euros for essential and important entities, plus liability for management.
Is cloud backup enough for the NIS2 continuity requirement?
On its own, no. The requirement covers a complete system: managed backups, a disaster recovery plan and proof that restores work. A sync to Google Drive or OneDrive isn't backup.
Read also
Not sure whether your backup would pass a supplier questionnaire?
The free 30-minute assessment tells you exactly where you stand: what you have covered, what's missing and what a client covered by NIS2 would ask of you. No obligation.