Safetech Webinar: NIS2 and DORA Regulatory Inspections Are Underway. How Can Organizations Prepare in 90 Days?

Safetech Webinar: NIS2 and DORA Regulatory Inspections Are Underway. How Can Organizations Prepare in 90 Days?

For many organisations, 2025 was the year of notifications and registration in the authorities’ records. In 2026, however, compliance with NIS2 and DORA entered a new stage: the effective verification of the measures implemented. The authorities have supervisory and control procedures in place, and the first sanctions have already been applied.

In this context, the essential question for companies is no longer only whether they have adopted the policies and procedures required by the legislation, but whether they can demonstrate that they work in practice. Is there evidence of implementation? Are the controls tested periodically? Can the organization respond to the authorities’ requests within the deadlines provided by law?

These were the main topics of the webinar “NIS2 and DORA – Ready for Regulatory Inspection”, organized by Safetech Innovations on October 26, 2026.

The presentation was held by Mihail George Guranda, GRC specialist at Safetech Innovations and delegated CISO for an entity in the aeronautical industry. With over 25 years of experience in the legal field and over seven years dedicated to cybersecurity regulation, he has directly participated in the development of the national legislative framework. As Senior Manager in the Regulatory Directorate of DNSC, he coordinated the team that transposed the NIS2 Directive into Romanian legislation through GEO 155/2024 and contributed to the harmonization of NIS2 requirements with DORA in the financial sector. His experience has allowed the subject to be approached both from the perspective of regulatory and control authorities and from that of organizations that must demonstrate compliance.

2026: Authorities have the necessary tools for regulatory inspections

The adoption of DNSC Order no. 3/2025, which regulates supervision, verification and control procedures, and DNSC Order no. 1/2026, on risk management measures and self-assessment methodology, completed the operational framework for the application of NIS2.

In parallel, Government Ordinance no. 14/2026 established the national framework for the application of DORA, including the supervisory duties of the NBR and ASF.

An important difference concerns the way in which organisations are controlled. Under NIS2, essential entities may be subject to proactive supervision, including planned inspections, while for significant entities supervision is mainly reactive, based on indications of non-compliance. In the case of DORA, ICT risk verification is integrated into the current supervisory work of financial institutions.

Regardless of the applicable regime, the principle is the same: the existence of a security policy is not, in itself, proof of compliance. The organization must demonstrate that the policy has been approved, implemented, tested and reviewed.

How a DNSC inspection is carried out and why deadlines matter

One of the most practical topics of the webinar concerned the procedures and deadlines applicable to DNSC inspections. The authority may conduct planned or unplanned inspections, cybersecurity audits, and non-intrusive scans of exposed infrastructure. In certain situations, an organization’s vulnerabilities may be identified before it receives a formal request.

Planned inspections are announced 30 calendar days in advance. Unplanned inspections can be communicated five days in advance or even at the time of start.

A particularly important step occurs after the submission of the finding note. According to the procedure presented in the webinar, the entity usually has only three calendar days to formulate a response, a deadline that can be extended, upon request, up to ten days.

This constraint fundamentally changes the way in which GRC’s work should be organised.

“In the case of a DNSC inspection, the organization usually has only three calendar days to respond to the findings. It is too short a deadline to build arguments and evidence from scratch. Basically, during this interval you can only extract the information from an already prepared compliance file. Therefore, we recommend that the GRC teams permanently have the documentation updated and transform the procedural deadlines into an internal matrix, with clear responsibilities for each stage” said Mihail George Guranda, GRC specialist in Safetech Innovations.

Therefore, the preparation for control cannot begin at the time of receipt of the notification. Organizations need an up-to-date compliance file, clearly defined responsibilities and mechanisms through which documents and technical evidence can be quickly identified.

The first NIS2 sanction and the signal sent to organizations

During the webinar, the case of the first publicly presented DNSC sanction, applied in September 2026 to a public administration entity for non-compliance with the notification obligation, was also analyzed. Beyond the value of the sanction, the case highlights two important aspects.

Firstly, authorities can start checks with administrative obligations that are relatively simple to ascertain, such as notification and registration. Secondly, the imposition of a fine does not remove the obligation to comply. Moreover, the breach of separate obligations can lead to cumulative penalties. Failure to notify and non-implementation of risk management measures are different problems, which can be assessed separately.

For already registered organisations, the following areas of interest may include self-assessment, designation of the security officer, updating the data in the register and demonstrating the implementation of controls.

One control framework, multiple regulations

Another important theme of the webinar was how organizations can manage requirements coming from NIS2, DORA and standards such as ISO 27001, without creating parallel structures and redundant processes.

Safetech Innovations’ recommendation is to build a unique library of controls, in which each piece of evidence has clear identifying elements, a responsible, a test frequency and associated proof.

For example, multi-factor authentication, backup restore testing, centralized logging, incident management, and critical vendor assessment can simultaneously address multiple regulatory requirements.

For groups that include both financial entities subject to DORA and companies covered by NIS2, a common framework allows for the reuse of records, with documentation specific to each legal entity retained.

At the same time, the presentation clarified the responsibility of executive management, the role of legal, IT and SOC teams, and the importance of a GRC function capable of coordinating the entire process.

A 90-day control readiness plan

In order to transform the legislative requirements into a concrete compliance program, Mihail Guranda proposed a 90-day preparedness plan, organized in five stages.

• Days 1–14: Verification of classification and notification

Confirmation of the status of the organization, the data communicated to the DNSC and the applicable obligations.

• Days 15–30: Organisation of the team and procedures

Establishing responsibilities, inspection log and procedural deadline matrix.

• Days 31–60: Preparation of the evidence folder

Assessment of controls, identification of gaps and approval of a remediation plan.

• Days 61–75: Simulating an incident

Testing the organization’s response, including management involvement and reporting obligations.

• Days 76–90: Simulating an inspection

Replication of the stages of a control, from notification and request of documents to the formulation of the response to the findings.

The plan aims not only to improve documentation, but also to verify the organization’s real ability to react under pressure and limited deadlines. An example provided in the webinar is the test of retrieving proof of compliance: randomly choosing a requirement and measuring the time needed to submit documents demonstrating its implementation.

“You randomly choose a requirement and time how long it takes to produce the approved proof. If you exceed 48 hours, you have a problem,” recommended Mihail George Guranda.

Watch the full webinar recording

We invite you to watch the full webinar to understand what it means, in practice, to prepare an organization for an NIS2 or DORA control.