Preliminary assessment of the third payment request of Romania (2024)

resilience of the public and private entities owning critical infrastructure against cyber risks.

Milestone #151 requires the entry into force of the law on Defence and Cyber Security of Romania to establish the legal and institutional framework for organising and conducting activities in the fields of cybersecurity and cyber defence, cooperation mechanisms and responses of institutions in the fields concerned.

Milestone #151 is the second and last step in the implementation of reform C7.R3 and follows milestone #150 on the adoption of the National Cybersecurity Strategy 2021- 2026, assessed as fulfilled in the context of the first payment request. Therefore, reform C7.R3 had the final expected date for implementation in Q4 2022.

Evidence provided:

The following evidence was provided:

i. Summary document duly justifying how the milestone (including the relevant elements of the milestone, as listed in the description of milestone and of the corresponding measure in the Council Implementing Decision annex) was satisfactorily fulfilled; ii. Copy of the publication of Law No. 58/2023 on Defence and Cyber Security in Romania in the Official Journal No. 214, issued on 15 March 2023; Analysis:

The justification and substantiating evidence provided by the Romanian authorities cover all constitutive elements of the milestone.

The Law on Defence and Cyber Security of Romania shall establish the legal and institutional framework for organising and conducting activities in the fields of cybersecurity and cyber defence, cooperation mechanisms and responses of institutions in the fields concerned.

Law No. 58/2023 on Defence and Cyber Security in Romania (hereinafter referred to as the “Law”) was published in the Official Journal No. 214 of 15 March 2023.2 According to the provisions in Article 12(1) of Law No. 24/2000 on the rules of legislative technique for the drafting of legislative acts, the Law on Defence and Cyber Security of Romania entered into force three days after its publication in the Official Journal.

The Law lays down the legal framework for organising and conducting activities in the fields of cybersecurity and cyber defence. In particular, its Chapter I – General provisions – lays down the networks and informatic systems covered by the Law (Article 3), objectives (Article 4) and principles to ensure cyber security and defence (Article 5).

Moreover, the Law includes several provisions that establish the institutional framework. For the purpose of organising and carrying out activities specific to cyber security in a uniform manner at national level, Article 6 of the Law establishes the National Cyber Security System (CNSS) as the general framework for cooperation between the authorities referred to in Article 10(1). Furthermore, articles 10 to 19 of the Law describe the competent authorities and their respective responsibilities.

2 the entry into force of this law is without prejudice to Romania’s obligation to carry out the complete and correct NIS2 transposition