Public administration holds citizens data and runs the services people cannot do without: civil registry, taxation, social assistance, procurement, electronic front desks. Unlike a private operator, a public institution cannot suspend its activity until a problem is fixed, and it cannot choose its users. The risk landscape is made worse by legacy systems, constrained security budgets and infrastructure fragmented across dozens of institutions with very different levels of maturity, yet connected to one another through data exchange.
Directive (EU) 2022/2555 (NIS 2) lists public administration in Annex I, among the sectors of high criticality. The obligations cover risk analysis, technical and organisational measures, incident reporting and continuity of public services, and responsibility for approving and supervising those measures rests explicitly with the management of the institution.
Legal framework
At European level:
- Directive (EU) 2022/2555 (NIS 2): Official text on EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: Official text on EUR-Lex
At national level (Romania):
- GEO no. 155/2024: Official Gazette no. 1332/2024
- Law no. 124/2025: Official Gazette no. 638/2025
- DNSC Order no. 1/2025 on the notification of entities: Official Gazette no. 776/2025
- Order on disruption criteria and risk assessment: Official Gazette no. 776/2025
The Public administration sector
Essential entities:
Public administration entities of central government as defined by a Member State in accordance with national law, and public administration entities at regional level as defined by a Member State.
- Central government institutions and their subordinate bodies
- Regional and, where designated nationally, local administration entities
- Operators of national registries and electronic public service platforms
- Institutions managing data exchange between public authorities
Sector-specific cyber threats
- Ransomware affecting registries and case management systems
- Unauthorised access to citizens personal data
- Phishing and business email compromise targeting staff and suppliers
- Attacks on electronic front desk and identity verification services
- Exploitation of unsupported legacy systems
- Compromise of interconnections between institutions
NIS 2 requirements for the public administration sector
Mandatory measures:
- Inventory and classification of critical IT and OT assets
- Security policies approved at management level, with explicit responsibilities
- Network segmentation and separation of OT and IT communication channels
- Traffic monitoring and anomaly detection (IDS/IPS)
- Access control and multi-factor authentication, including for remote supplier access
- Incident response and business continuity plans, tested annually
- Cybersecurity training for operations and maintenance teams
- External security audits and attack simulations
- Monitoring of equipment and IT service suppliers
Critical interdependencies
- Data exchange chains that propagate a compromise between institutions
- Dependency on shared national infrastructure and communications networks
- Direct impact on citizens who have no alternative provider
- Interaction with data protection obligations for large volumes of personal data
In public administration, an incident is not only an operational problem but a matter of public trust. NIS 2 makes management accountable for cybersecurity, and for institutions serving citizens who have nowhere else to go, tested continuity plans are as important as prevention.
The other sectors in this series
The NIS 2 Directive covers eleven sectors of high criticality. Each has its own essential entities, specific threats and mandatory measures.