Romania
Romania transposed NIS2 through OUG 155/2024, later approved through Law 124/2025. DORA applies to financial entities within its scope.
← Services
EU cyber resilience and compliance operations
Meet the obligation. Operate the control. Prove resilience.
DORA and NIS2 support for regulated organisations, critical entities, ICT providers, and regional groups in Romania, Bulgaria, Moldova, and neighbouring markets.
Scope a regulatory resilience programme ↗Regional scope
One region. Different legal positions.
The first task is to establish why a requirement applies. Entity type, sector, size, services, group structure, national law, and customer contracts can all change the answer.
Bulgaria
Bulgaria published amendments to its Cybersecurity Act in February 2026. Regional organisations need a common control baseline with country-specific reporting and supervisory procedures.
Moldova
DORA and NIS2 do not automatically apply solely because an organisation operates in Moldova. Requirements may arise through EU groups, regulated customers, supplier contracts, domestic law, or EU alignment.
Regional suppliers
Cloud, software, managed service, security, and other ICT providers may receive control, evidence, reporting, testing, and exit requirements from regulated customers.
Engagement options
Five ways to move from requirement to operation.
The service line packages capabilities from Offensive, Defensive, Engineering, and Assurance. It does not replace the permanent service catalogue.
Applicability and Control Baseline Sprint
Establish the regulatory and contractual drivers, current control state, evidence position, critical dependencies, and priority roadmap.
- Entity, service, sector, and jurisdiction mapping
- Critical service and dependency map
- Control and evidence baseline
- Prioritised 90-day and 180-day roadmap
DORA Operational Resilience Programme
Turn financial-sector resilience obligations into governance, testing, supplier controls, incident processes, recovery routines, and management evidence.
- ICT risk governance and accountability
- Incident classification and reporting readiness
- Resilience testing and recovery
- ICT third-party information and control support
NIS2 Security Operations Programme
Implement and operate cybersecurity risk-management measures around governance, incidents, supply chains, continuity, vulnerability handling, and evidence.
- Risk-management measure implementation
- Management accountability and reporting
- Incident and crisis readiness
- Supply-chain and vulnerability controls
Regulatory Resilience Validation
Challenge whether selected controls and operational capabilities work through evidence review, technical testing, attack-path analysis, exercises, and remediation verification.
- Control design and effectiveness review
- Attack-path and purple-team validation
- Incident and recovery exercises
- Independent evidence-based conclusion
Managed Compliance and Resilience Operations
Maintain control routines, evidence, metrics, supplier reviews, exceptions, remediation, and management reporting after the initial programme.
- Control operating calendar
- Evidence and exception management
- Regulatory change impact review
- Quarterly management decision pack
One operating model
Compliance work across all four security pillars.
DORA and NIS2 are inputs to the existing Ananke Labs practice. The work crosses technical testing, operations, implementation, and assurance while keeping ownership and independence clear.
Offensive
Attack paths, penetration testing, purple-team validation, resilience testing, and remediation verification.
Defensive
Detection, incident reporting, response, crisis leadership, threat intelligence, and recovery readiness.
Engineering
Architecture, identity, logging, cloud, secure delivery, resilience controls, and evidence automation.
Assurance
Applicability mapping, control effectiveness, supplier assurance, evidence quality, and management conclusions.
Typical programme outputs
01Applicability and obligations register
02Critical service and dependency map
03Control and evidence baseline
04Prioritised implementation roadmap
05Incident and reporting readiness pack
06Executive resilience and risk decision brief
Last reviewed 28 August 2026
Official regulatory references
Regulatory content is maintained against primary sources. Country procedures and supervisory expectations may change, so scope is reconfirmed at the start of every engagement.
- NIS2 Directive policy and implementation overviewEuropean Commission
- Digital operational resilience for the financial sectorEuropean Commission
- NIS2 Technical Implementation GuidanceENISA
- OUG 155/2024 on cybersecurityRomanian legislative portal
- Law 124/2025 approving OUG 155/2024Romanian legislative portal
- Cybersecurity Act amendments, State Gazette issue 17National Assembly of Bulgaria
- Cybersecurity legal frameworkSTISC Moldova
- Commission Delegated Regulation (EU) 2025/1190 on TLPTEUR-Lex
Start with applicability, critical services, and the decision deadline.
Share the entities, countries, services, sector, group structure, important suppliers, current programme, and the decision or supervisory milestone you need to support.
Scope a regulatory resilience programme ↗