I am a TSO / DSO / electricity producer in Romania — am I in scope of NIS2?
Yes. NIS2 Art. 2 + Annex I explicitly list the electricity sub-sector (electricity undertakings via Directive 2019/944 Art. 2, TSOs, DSOs, producers, NEMOs, aggregators, demand response, storage operators, operators of significant recharging points) as a sector of high criticality [C2][C9]. If you are a medium or large entity (>= 50 staff or >= EUR 10 million turnover / balance-sheet total), you are an essential entity. Entities below the threshold can be notified individually by DNSC if they have a critical role — small storage operators connected to the transmission grid, aggregators with a portfolio above a certain level, charging stations with impact. In Romania, OUG 155/2024 + Law 124/2025 + DNSC manage registration, supervision and enforcement; ANRE cooperates on the sectoral side [C6][C13].
How do NIS2 and NCCS stack up for a large TSO or DSO?
Neither exempts you from the other. NIS2 (horizontal cybersecurity) imposes the ten minimum risk-management measures and reporting on a 24h/72h/1 month track to DNSC [C3][C4]. NCCS (sectoral, lex specialis for electricity) introduces high-impact vs. critical-impact classification, EU-wide risk-assessment methodologies (revised every three years), regional mitigation plans, differentiated minimum + advanced controls, and a reporting channel to competent national authorities and ACER [C7][C8]. In practice: a single risk-management framework that satisfies both, and two parallel reporting channels (DNSC for NIS2 + competent national authority for NCCS on the sectoral side).
What counts as a `significant incident` for a grid operator under NIS2 + NCCS?
NIS2 Art. 23(3) defines a significant incident as one that has caused or is capable of causing severe operational disruption or financial loss for the entity, or has affected or is capable of affecting other persons through considerable material or non-material damage [C4]. Operationally, for an electricity operator: compromise or loss of SCADA/EMS/DMS, encryption of dispatching systems, manipulation of protection relays, locked HMIs in the control room, exfiltration of grid configuration data, compromise of a contractor with remote access to substations. NCCS adds a sectoral category: incidents affecting cross-border flows [C7][C8]. When in doubt, file an early warning within 24 hours — you can retract later if it turns out to be minor.
Incident reporting deadlines to DNSC and the NCCS competent authority — exact?
Two parallel channels. NIS2 (to CSIRT/DNSC, under OUG 155/2024 + Law 124/2025): early warning within 24 hours of awareness, incident notification within 72 hours, final report within one month (Art. 23) [C4][C6]. NCCS (to the competent national authority + ENTSO-E for high/critical-impact entities, with ACER escalation routes on cross-border impact): complementary sectoral channel, timeline mapped on NCCS Art. 38-39 procedures [C7][C8]. Practical recommendation: prepare a single process that feeds both forms automatically from the control room, with escalation to CISO + crisis management, chief dispatcher and the ANRE / Transelectrica authority (for those connected to transmission).
We have an MSP / external contractor operating our SCADA — are we covered?
It does not exempt you from NIS2. ICT/OT vendor compromise is the most frequent vector in energy attacks: 2015 Ukraine — entry via an infected email to an employee, 6-month escalation; 2021 Colonial Pipeline — VPN password without MFA on a contractor [C-I1][C-I3]. NIS2 Art. 21(2)(d) requires supply-chain risk management, including contractual clauses (incident-response SLA, audit rights, exit strategy, controlled sub-outsourcing, mandatory MFA on remote access, SBOM for OT products) [C3]. NCCS adds sectoral supply-chain requirements for critical vendors [C7][C8]. The CRA, from 11 December 2027, will require manufacturers of PLCs/RTUs/IEDs to be compliant by design — operators become demanding buyers [C10]. The operator remains legally responsible for grid security — ICT outsourcing transfers operations, not liability.
We have digital substations with connected relays and IEDs — how do I apply NCCS + IEC 62443/62351 together?
NCCS requires minimum + advanced controls on OT components, referencing a list of European/international standards [C7][C8]. IEC 62443 (IACS) covers the security of industrial automation and control systems (PLCs, SCADA, HMIs, sensors) with the Security Levels SL1-SL4 framework [C11]. IEC 62351 covers the security of power-automation protocols (IEC 61850 on digital substations, IEC 60870-5-101/-104 on telecontrol) — mutual authentication, integrity, confidentiality at protocol level [C11]. Concretely: ask for SBOM and an IEC 62443-4-1/-4-2 conformity declaration when procuring IEDs and gateways; enable IEC 62351 authentication where the devices support it; segregate VLANs by device class; behavioural monitoring on IEC 104 (alarms on atypical command patterns, as Industroyer2 would have triggered). Non-patchable substations get compensating controls via network isolation + passive monitoring.
What is the maximum fine ceiling for an essential electricity operator?
Under NIS2 Art. 34: at least EUR 10,000,000 or 2% of annual worldwide turnover, whichever is higher, for essential entities [C5]. For important entities: EUR 7,000,000 or 1.4% [C5]. In Romania, OUG 155/2024 + Law 124/2025 transposed the NIS2 thresholds; DNSC is the enforcement authority for sanctions, with administrative gradation (warning, compliance order, temporary suspension of services) + personal liability of management (NIS2 Art. 20, including temporary prohibition from exercising managerial functions) [C6][C5]. Sanctions may be cumulative with those under sectoral energy law (Romanian Electricity and Gas Law) and general law (GDPR Art. 83 if the incident also affects personal data).
Who is personally liable within company management?
NIS2 Art. 20 requires the management body (board of directors, management board, managing director / CEO) to approve cyber risk-management measures, oversee implementation and undergo regular training [C3]. Members may be held personally liable for breaches of Art. 21. The directive allows Member States to impose temporary prohibitions on exercising managerial functions for essential entities (NIS2 Art. 32(5)) [C5]. In Romania, OUG 155/2024 + Law 124/2025 transposed these provisions [C6]. Practical implementation: a board decision approving the cyber risk-management framework — signed, dated, archived — an annual report to the board from the CISO + operational-risk committee, and documented board training (at least annual).
