Cybersecurity Framework Update

• Published date: 18 January 2021
• Subject Matter: Technology, Security
• Law Firm: Maravela, Popescu & Asociatii
• Author: Ms Flavia Ștefura and Cristina Crețu

Romania is enacting the secondary legislation pertaining to cybersecurity in an effort to avoid European sanctions. On October 30, 2020, the European Commission sent a reasoned opinion regarding Romania's failure to notify the national measures allowing for the identification of operators, the number of operators of essential services and the thresholds used in the identification process. The notification process is part of the implementation process of the Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (the "NIS Directive"). NIS Directive was transposed into the Romanian legislation through Law no. 362/2018 for ensuring a high common level of security of networks and information systems ("NIS Law").

The responsibility for setting up the list of essential services within the meaning of the NIS Directive falls with the Romanian National...