On October 30, 2020, the European Commission sent a reasoned opinion[1] regarding Romania’s failure to notify the national measures allowing for the identification of operators, the number of operators of essential services and the thresholds used in the identification process. The notification process is part of the implementation process of the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (the “NIS Directive”). NIS Directive was transposed into the Romanian legislation through Law no. 362/2018 for ensuring a high common level of security of networks and information systems (“NIS Law”).

The responsibility for setting up the list of essential services within the meaning of the NIS Directive falls with the Romanian National Computer Security Incident Response Team (“CERT-RO”)[2].

In an effort to observe the two-month deadline provided by the European Commission, the Romanian Government adopted the Government Decision no. 963/2020 for the approval of the List of essential services[3] (“Government Decision no. 963/2020”), and the Government Decision no. 976/2020 on the approval of threshold values for establishing the significant disruptive effect of incidents on the networks and computer systems of essential service operators[4] (“Government Decision no. 976/2020”).

The Government Decision no. 963/2020 sets for each of the sectors mentioned in the Annex to the NIS Law the list of essential services, as follows:

The NIS Directive provided for the Member States to identify the threshold values that set the significant disruptive effect of the incidents at the level of the networks and informatic systems of the essential services providers.

After receiving the reasoned opinion issued by the European Commission, the Romanian Government has expedited the process of setting the threshold values and has published the same in order to be used in identifying the operators of essential services.

The thresholds set through Government Decision no. 976/2020 are both intersectoral, meaning that the same are applicable to all the seven sectors under the scope of the NIS Law, and sector-specific for each of the above-mentioned sectors.

The intersectoral thresholds relate to:

The sector-specific thresholds include some concrete values for different criteria and metrics used for the activities in each sector (for example, in the electric energy sector, the drinking water supply). However, for most actors and activities in the specific sectors (such as, for example, the banking system, the financial infrastructure system, the medical assistance system and the digital infrastructure system), the incidents must be reported without exception.

Following the publication of these two Government Decisions, the companies operating in the sectors that are in the scope of NIS Law have until December 17, 2020 to assess both the list of essential services and the thresholds provided by the legal enactments in order to decide if they qualify as essential services providers that must register with CERT-RO.

Nevertheless, NIS Law just started to be fully applicable in Romania. Therefore, it will be interested to see all the further developments in this respect in both regulation and jurisprudence.

Flavia Ștefura 

Senior Associate

[email protected]

Cristina Crețu

Senior Privacy & Technology Consultant

[email protected]

[1] https://ec.europa.eu/commission/presscorner/detail/en/inf_20_1687

[2] CERT-RO is the national competent authority for the security of networks and information systems that provide essential services or digital services, designated in accordance with NIS Law.

[3] The Government Decision no. 963/2020 was published in the Official Gazette no. 1086 from November 16, 2020.

[4] Government Decision no. 976/2020 was published in the Official Gazette no. no. 1089 from November 17, 2020