Preliminary assessment of the first payment request of Romania

easures for critical blocks in close collaboration with the other institutions involved; o development of project performance management systems in covering specific objectives of the digital pillar; o development and regulation of the regulatory, methodological framework and of the functional, operational and financial procedures in its field of activity; o development of tools for implementing the digital related policies; o project management and reporting of all the stages of completing the objectives 12  established within the digital related measures in the national recovery and resilience plan; o fulfilment of any other attributes necessary to cover the implementation of the digital related national recovery and resilience plan reforms and investments.  The operationalisation of a temporary Digital Transformation Task force that shall employ during the implementation period of the Recovery and Resilience Plan 17 highly specialised contractual posts in the field of digital technologies and project management specialists. The announcement of the 17 vacancies for the task force Unit was published in the Official Journal (part III) No 311 on 05/04/2022. The results of the recruitment procedure were published on the official webpage of the Ministry of Research, Innovation and Digitalisation on 12/05/2022 and 16 candidates were selected (link in the cover note). No candidate successfully passed the competition for the Executive Manager position during this recruitment round. A new recruitment process was therefore conducted from 23/05/2022 to 30/06/2022 for this remaining position. An Executive Manager was subsequently selected, and the result of the recruitment process was published on the Ministry’s webpage (link in the cover note). As of 04/08/2022, 5 of the task force employees were terminated after their 30-days evaluation period due to the results of their activity-based assessments. These assessments were conducted by a committee for the periodical evaluation of the task force members’ performance appointed by Ministerial Order 20586 issued on 31 May 2022 and by Ministerial Order 20912 issued 12 July. Another recruitment session will be organised from 12/08/2022 to 23/09/2022 to fill the current open positions. As required by the CID Annex, the task force first became operational on 2 June 2022, when the first four employees started work and their employment contracts corroborate this. The CID Annex further requires that the task force should employ 17 employees during the implementation period of the RRP. This requirement is substantiated by article 1 (2) of Government Emergency Ordinance 30/2022 which provides explicit wording as regards the staffing of task force, which “shall consist of 17 specialist posts, including one management position and 16 positions of specialists under an individual fixed-term employment contract, respectively during the implementation of Romania’s NRRP.” Additionally, the specification in the cover note that another recruitment session will be organised from 12/08/2022 to 23/09/2022 to fill the current open positions is expected to enable the establishment of a fully staffed task force during the implementation period of the RRP. Finally, the CID Annex requirement that the employees of the task force should be specialised in the field of digital technologies and project management is corroborated by Ministerial Order 20374 issued on 15 April 2022. Ministerial Order 20374 for the procedure for recruiting the task force personnel makes clear, under Article 4, that “the task force employs 17 specialists with advanced digital skills and specialised project management skills in the field of digital transformation, in accordance with the Council Decision of 3 November 2021 approving the evaluation of the Romanian NRRP (hereinafter referred to as the Romanian NRDP), including a coordinator”. In turn, Article 18(4) specifies that “for specialised positions in digitalisation, the interview shall be organised within a timeframe specified in the calendar of the procedure, in three successive steps during the same day and shall have the following components: a) Verification of knowledge of data structures and algorithms; b) Verification of knowledge of system design, cloud computing, digitalisation; 5 c) The candidate’s motivation, experience and creativity; test in English”. The link to the results of the recruitment procedure demonstrates that 13 the people selected are those who scored the highest in the competition. Ministerial Order 20437 for the establishment of the salary scale for the task force staff also includes information on the qualifications required for each position. The Romanian Audit Authority recommended for the task force to become operational by employing 17 highly specialised contract agents in the field of digital technologies and specialised project management. The Audit Authority found the recommendation partially implemented, as it will only be fully implemented once the task force is fully staffed with 17 employees. The Commission considers that the documents provided are sufficient to demonstrate that the task force is established and operational and that the CID Annex and the verification mechanism in the operational arrangements are respected given that the task force is expected to be fully staffed after the next recruitment session running from 12 August until 29 September 2022 to fill the 5 current open positions. Commission Preliminary Assessment: Satisfactorily fulfilled Related Measure: Transition to EU 2025 connectivity targets and stimulate private Number: 146 investment for the deployment of very high-capacity networks Name of the Milestone: Entry into force of the 5G network security law Qualitative Indicator: Provision in the law indicating the entry into force of Time: Q2 2021 the 5G security law Context: Milestone 146 is part of the reform for the transition to EU 2025 connectivity targets and the stimulation of private investment for the deployment of very high capacity networks. The aim of this reform is to accelerate the national roll-out of 5G networks, in accordance with security regulations, and provide broadband coverage for white areas (small rural municipalities, isolated localities, disadvantaged inhabited areas), tackling the rural – urban digital divide, reducing the administrative burden and streamlining procedures and fees, creating the prerequisites for equal access to digital services and internet access. This reform is composed of four milestones, covering the entry into force of the 5G security law due Q2 2021 (milestone 146), then the publication of the call for tender for the authorisation of telecommunications operators to grant 5G licences (milestone 147) by Q2 2022. These licences will then be assigned based on the results of this competitive selection procedure (milestone 149) in Q3 2022. Recommendations from the EU connectivity toolbox will also be implemented by Q3 2022 (milestone 148). Milestone 146 establishes that communication providers are only able to use technologies, equipment and software in 5G networks from manufacturers authorised in advance by decision of the Prime Minister, on the basis of the opinion of the Supreme Council of National Defence. Based on the 5G network security law, each manufacturer of 5G equipment and software has to apply for this authorisation, which will be submitted to the Ministry responsible for Communications. Evidence provided: In line with the verification mechanism set out in the Operational Arrangements, the following evidence was provided: 1. Copy of the publication in the Official Journal, part I, no 590/11.06.2021, pp. 7-9 (Law 163/2021). 14  2. Summary document duly justifying how the milestone was satisfactorily fulfilled (Cover Note). Analysis: The 5G network security law adopted by the Romanian Parliament (no. 163/2021) satisfactorily addresses all the requirements from the description of the milestone in the Annex to the Council Implementing Decision. The 5G network security law was adopted on 7 June 2021, published in the Official Gazette on 11 June 2021 and entered into force on 14 June 2021 (except for the provisions of art. 9 and art. 12-16, which entered into force 30 days from the date of publication of the law in the Official Gazette, according to art. 17 from the law). Article 1 makes clear that the law targets producers of technology, equipment and software used in information and communication infrastructures of national interest and in electronic communications networks providing 5G networks. In Article 3, the law establishes that the use of technology, equipment and software in 5G networks, with the exception of terminal equipment used by end-users, shall be subject to the producers obtaining an authorisation by decision of the Prime Minister, on the basis of the assent of the Supreme National Defence Council (CSAT). Article 4 further explains that the application for the authorisation shall be submitted to the Ministry responsible for communications, which shall immediately forward it to the Supreme National Defence Council (CSAT). Commission Preliminary Assessment: Satisfactorily fulfilled Related Measure: Ensuring cybersecurity of public and private entities owning Number: 150 critical value infrastructure Name of the Milestone: Adoption of the National Cybersecurity Strategy 2021- 2026 Qualitative Indicator: Adoption of the National Cybersecurity Strategy 2021- Time: Q4 2021 2026 by the government Context: Milestone 150 is part of a reform to ensure the cybersecurity of public and private entities owning critical value infrastructure. The aim of this reform is to continue the process of strengthening the resilience of the public and private entities owning critical infrastructure against cyber risks. This reform contains two milestones (150 and 151). Milestone 150 provides for the adoption of the National Cybersecurity Strategy 2021-2026 by the government by Q4 2021 while milestone 151 calls for the entry into force of the law on Defence and Cyber Security of Romania by Q4 2022. Milestone 150 aims to establish provisions regarding regular assessments and updates of the cybersecurity regulatory and institutional framework to: (1) strengthen the public-private-academic partnership to increase the cyber resilience of society as a whole, (2) to develop the capacity to respond to cyberattacks and the resilience of systems, networks and services and (3) to consolidate the role of Romania in the cybersecurity architecture at international level. Evidence provided: In line with the verification mechanism set out in the Operational Arrangements, the following evidence was provided: 15  1. Summary document duly justifying how the milestone was satisfactorily fulfilled (Cover Note). 2. Copy of the adopted Strategy in the Official Journal n.2 bis of 3 January 2022. 3. Link to the website where the strategy can be accessed. The authorities also provided: 4. Copy of the judgement approving the publication of the Strategy in the Official Journal No.2 of 3 January 2022 of the Government Decision 1321. Analysis: The National Cybersecurity Strategy 2021-2027, including the Action Plan for implementation, was approved on 30 December 2021 by Government Decision 1321 and published in Official Journal on 3 January 2022. The annex 1 of the Government Decision contains the published National Cybersecurity Strategy. The Strategy fulfils the requirements established in the description of the measure and the milestone in the Council Implementing Decision as follows:  On the regular assessments and updates of the cybersecurity regulatory and institutional framework; Section 3 of the Strategy sets out principles which must be respected to ensure Romania’s cybersecurity. In particular, principle 3 calls for “the constant updating and adaptation of the regulatory and procedural framework [...] to meet the objectives of cybersecurity, given the constant evolution of technology and regulations in the field at international level.” Objective 2 of the action plan for the implementation of the Strategy in Annex 2 of the strategy calls for the “evaluation and regular updating of the cyber security and defence legislative framework in relation to evolving threat”. Sections 4.2.1 and 4.2.2 of the Strategy provide for the consolidation of the role of the Cyber Security Operational Council and the establishment of the National Cyber Security Directorate. Chapter 3 of Annex 1 to the Government Decision and sub-measures 4.2.1 and 4.2.2 of the Strategy provide for the consolidation of the role of the Cyber Security Operational Council and the establishment of the National Cyber Security Directorate.  With respect to strengthening the public private-academic partnership to increase the cyber resilience of society as a whole; Principle 4 in section 3 and section 4.3 of the strategy describe cyber security as the responsibility of all actors involved (public administration authorities and institutions, private entities and citizens). In particular, section 4.3 emphasises that pragmatic public-private partnership between public authorities and institutions, private entities, academia and research and citizens is a necessity when cyber-attacks target a large number and a wide spectrum of networks and information systems. This section highlights the necessity of programmes to raise public awareness, improve cybersecurity culture and promote cyberspace hygiene in the whole of society to prevent cyberattacks. In addition, the Strategy lists pragmatic public-private partnership as one of the five objectives of 16 strategic importance in the field of cybersecurity.  Regarding the development of the capacity to respond to cyber-attacks and the resilience of systems, networks and services; Section 4.4 of the strategy details measures to increase resilience by implementing all necessary proactive measures aimed at ensuring the resilience of network and information systems and by developing capabilities and mechanisms to deter cyber-attacks affecting society or national security interests. In particular, measures are proposed for the: o Development of sectoral computer emergency response teams (CERTs) and security operations centres (SOCs) o Conducting of exercises with high practical applicability o Development of proactive, responsive and deterrence capabilities  Concerning the consolidation of the role of Romania in the cybersecurity architecture at international level; Principle 4 in section 3 of the strategy details how cybersecurity is strengthened through pragmatic cooperation at international level. This principle calls for Romania to continue to play an active and relevant role in major international structures and initiatives related to digital and cybersecurity actions and strengthen its position as a centre of excellence and relevant actor for European and international cybersecurity. Commission Preliminary Assessment: Satisfactorily fulfilled Number: 211 Related Measure: Reform of the public pension system Name of the Milestone: Contract technical assistance provided by an entity that shall be selected according to the national public procurement legislation Qualitative Indicator: Contract signed Time: Q4 2021 Context: The underlying reform (Component 8, Reform 6) involves the adoption of a new law on the public pension system, with the input of technical assistance, which is going to replace the Law 127/2019. The objective is to ensure fiscal sustainability in an environment of ageing population, to correct inequities, to ensure the sustainability, predictability and adequacy of the system and respect the contributory principle in relation to the beneficiaries of pension entitlements. This milestone requires the signing of a technical assistance contract by an entity that shall be selected according to the national public procurement legislation. It is among the first steps in the implementation of the reform (Component 8, Reform 6). A contemporary step also due in Q4/2021 is the fulfilment of milestone 212 (Entry into force of a minister’s order setting up a monitoring committee in charge of reviewing, with the support of the technical assistance provider the pension system and the policy interventions in the pension system). The next steps consist of the fulfilment of milestones 213 (Q1 2022), 214 (Q1 2023) and 215 (Q4 2022), regarding the regulatory framework of Pillar 2 pensions, and the legislative frameworks for the general pension and special pension systems respectively. The technical assistance provided as part of 211 will form the basis for the entry into force of the new law on the 17 pension system (milestone 214), as outlined in the Council Implementing Decision Annex. Evidence provided: In line with the verification mechanism set out in the Operational Arrangements, the following evidence was provided: 1. Summary document duly justifying how the milestone (including all the constitutive elements) was satisfactorily fulfilled ( “Cover Note”).