NIS2 in Groups: DNSC Fixes Three Implementation Models

Romania’s National Cybersecurity Directorate (DNSC) published a decision on 21 September 2026, in the Official Gazette no. 798, resolving an ambiguity that had kept board rooms of multinational groups with Romanian subsidiaries guessing for a year: a security policy written at headquarters in Munich or Paris is no longer sufficient for the Bucharest entity. Every subsidiary classified as essential or important under Directive (EU) 2022/2555 must demonstrate effective enforcement on its own infrastructure.

Three Models, One Accountability

The decision defines three ways an entity can show that a control is in force: adopted (applies the group policy in full, without adaptation), implemented (operates the control with its own resources, on its own infrastructure), and shared (uses a common group service — SOC, IAM, backup — with a contract and measurable SLAs).

The distinction matters for the subsidiary CISO: for each of the 10 categories of measures set out in Article 21 of the NIS2 Directive, transposed locally through Law 244/2024, there must be an explicit mapping between the control and the model applied. A DNSC audit that finds only the group-level policy, with no proof of execution on local assets, closes with a non-conformity finding. The ENISA technical implementation guidance points in the same direction: evidence resides at the evaluated entity, not at HQ.

What Changes Operationally

A group with 4 entities in Romania that previously reported a single compliance matrix will now file 4 separate matrices. DNSC requires logs, tickets, and reports generated from systems actually running at the evaluated entity — not aggregated extracts.

nis2_control_map:
  entity: SC Filiala RO SRL
  control: A.8.16_monitoring_activities
  model: shared          # adopted | implemented | shared
  provider: group_soc_de
  sla_ref: MSA-2026-014
  evidence:
    - source: siem.group.local
      tenant: ro-filiala
      retention_days: 365
    - artifact: monthly_review_2026-08.pdf

Decision flow for each control:

The shared model will cover most groups: a centrally operated SOC serving all subsidiaries is acceptable, but the intra-group contract must include tenant isolation, retention, and auditor data-access clauses. Those who lack these by the first reporting cycle — the European Commission’s official NIS2 timeline lists annual reporting as an active obligation — lose an entire year to remediation.

CAI Technology’s Take

What we see across consulting clients is that the hard part is not choosing the model — it is the evidence. A control marked “shared” without exportable per-tenant logs is operationally equivalent to one that is missing. Our recommendation for every group with a presence in Romania: run a reconciliation exercise before reporting — control by control, who operates it, where the evidence lives, how it is extracted. The Lexnomia team has prepared intra-group clauses aligned with the DNSC decision and an audit checklist covering all three models — you can start from our NIS2 compliance framework.

Further Reading

• NIS2 in Romania 2026: Deadlines, Obligations, Fines
• Cut SOC Triage from Hours to Minutes with LLMs
• EU AI Act Omnibus: Six Days to Transparency