Cybersecurity risk management system:

• technical measures;
• technical measures;
• operational measures;

These measures must:

• manage the risks affecting the network and information systems used in their operations;
• follow a systemic approach;
• be proportionate to the level of exposure to risk.

The framework also refers to CNCS regulation for:

• the definition of specific minimum measures;
• the definition of compliance levels.

The areas to be covered by cybersecurity measures include:

• incident handling;
• business continuity;
• supply chain security;
• security in the acquisition, development and maintenance of network and information systems;
• assessment of the effectiveness of the measures adopted;
• basic cyber hygiene practices;
• basic cyber hygiene practices;
• cryptography and encryption;
• human resources security;
• access control;
• asset management;
• multi-factor authentication or continuous authentication.

In the case of relevant public entities:

• they will be subject to the measures to be established by CNCS regulation.

The decree gives specific attention to supply chain security. The measures to be adopted must take into account:

• the vulnerabilities of each direct supplier and service provider;
• the overall quality of products from a cybersecurity perspective;
• the security practices of suppliers;
• coordinated risk assessments of supply chains involving critical ICT products, systems or services.

Essential and important entities must:

• carry out a risk analysis;
• document that analysis;
• manage the risks relating to the assets that ensure the continuity of the operation of network and information systems.

Based on that assessment, they must also:

• adopt appropriate measures;
• apply proportionate measures to manage the identified risks.

Essential and important entities must prepare and maintain an annual report including, among other elements:

• a summary description of the main activities carried out in the field of network and information systems security;
• quarterly incident statistics;
• quarterly incident statistics;
• recommendations for improvement;
• identified issues;
• measures implemented.

As regards the submission of the report:

• in the case of essential entities, it must be submitted to CNCS;
• in the case of important entities, it must be provided when requested.

Essential and important entities must appoint a cybersecurity officer responsible for managing cybersecurity and information security.

This person must:

• be a member of the management, executive or administrative bodies;
• or report directly to those bodies within the organisation.

Entities that were already in operation when the decree entered into force have:

• 20 working days to notify CNCS of that appointment.

In practice, this deadline falls:

• at the beginning of May 2026.

The minimum duties of this officer include:

• proposing risk management measures;
• supporting supervisory activities;
• promoting a culture of cybersecurity;
• managing residual risk;
• ensuring the preparation of the annual report;
• coordinating the actions of the permanent contact point, where applicable.

Essential and important entities must ensure and notify CNCS of a permanent contact point with continuous availability.

This contact point must ensure:

• operational and technical information flows with the cybersecurity authority;
• operational and technical information flows with the cybersecurity authority;
• the implementation of procedures defined in civil protection emergency plans affecting network and information systems;
• the receipt of guidance, recommendations, technical instructions and orders issued by the cybersecurity authority.

As with the cybersecurity officer:

• the notification must be made by entities already in operation within 20 working days of the decree entering into force.

CNCS may require essential, important and relevant public entities to obtain:

• cybersecurity certification, whether national, European or international, demonstrating compliance with the applicable measures;
• the use of ICT products, services and processes certified under national and European cybersecurity certification schemes.

Essential, important and relevant public entities must notify CNCS of any significant incident.

For this assessment, factors such as the following must be taken into account:

• the number of users affected;
• the total number of users of the disrupted service;
• the duration of the incident;
• the severity of the disruption;
• the impact on economic and social activities.

The framework provides for:

• an initial notification without undue delay and within 24 hours of establishing that a significant incident exists, or may come to exist;
• an update within 72 hours, where necessary;
• a notification of the end of significant impact within 24 hours of that impact ending;
• a final report in accordance with the applicable regime.

In addition:

• the cybersecurity authority must, where possible, respond within 24 hours of receiving the initial notification.

The framework distinguishes the intensity of supervision according to the type of entity.

Essential entities

Essential entities are subject to broader supervisory measures, including:

• on-site inspections;
• on-site inspections;
• regular or targeted security audits;
• ad hoc audits;
• security checks;
• requests for information, documents and evidence of compliance.

Important entities and relevant public entities

Important entities and relevant public entities are subject to an ex postsupervisory regime, applicable where there is evidence, indication or information of non-compliance.

This regime may include:

• on-site inspections;
• ex post remote supervision;
• targeted audits;
• ad hoc audits;
• security checks;
• requests for access to documentation and evidence.

Failure to comply with the obligations laid down in the new Cybersecurity Legal Framework may give rise to significant fines.

In the case of essential entities, very serious administrative offences may lead to fines of:

• €10 million;
• or 2% of worldwide annual turnover, whichever is higher.

CNCS has also highlighted this strengthening of the sanctions framework as one of the clearest signs of greater accountability.

In addition:

• decisions and measures adopted by the authorities may be challenged under the terms set out in the decree.