NIS2 obligations in Moldova

Competent authority & CSIRT Legal ref: Art. 2.1.3

• Agency for Cybersecurity – national CSIRT Information Technologies and Cybersecurity Service – governmental CSIRT ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex 2 of Government Decision 860 on the identification of service providers

• NIS2 The Government Decision No. 860/2024 on the identification of service providers transposes Article 3 and Annexes I and II of the NIS2 Directive. The scope corresponds to NIS 2 except point 1 (c.) – Energy, Oil, which is partially compatible. ecs-org.eu · 28 Oct 2026 · secondary source

Registration

• The identification, registration and record of scope entities are provided in the Government Decision No. 860/2024. The Agency is responsible for identifying and listing service providers according to Law No. 48/2023 and this Regulation. During the identification process, the Agency verifies registration details with the Public Services Agency and operational details with relevant public authorities and regulators. It can also request information from the National Bureau of Statistics on whether a legal entity meets all of the following general conditions: ecs-org.eu · 28 Oct 2026 · secondary source
• Being registered in the Republic of Moldova. ecs-org.eu · 28 Oct 2026 · secondary source
• Operates and/or provides services in at least one of the critical sectors and/or sub-sectors listed in Annex 2 to this Decision. ecs-org.eu · 28 Oct 2026 · secondary source
• Falls under at least one of the types of service providers listed in Annex 2 to this Decision. And at least one of the following specific criteria: ecs-org.eu · 28 Oct 2026 · secondary source
• The size criterion, according to Article 3 paragraph (1) of Law No. 48/2023 ecs-org.eu · 28 Oct 2026 · secondary source
• The criterion of explicit mention of the type of legal entity or the type of service provided, according to Article 3 paragraph (2) letters a) – d) and h) of Law No. 48/2023 ecs-org.eu · 28 Oct 2026 · secondary source
• The criterion of the uniqueness of the essential service provider, according to Article 3 paragraph (2) letter e) of Law No. 48/2023 ecs-org.eu · 28 Oct 2026 · secondary source
• The service disruption criterion, according to Article 3 paragraph (2) letter f) of Law No. 48/2023 ecs-org.eu · 28 Oct 2026 · secondary source
• The critical nature of the legal entity criterion, according to Article 3 paragraph (2) letter g) of Law No. 48/2023 ecs-org.eu · 28 Oct 2026 · secondary source
• Legal entities are designated as service providers through an administrative act issued by the Agency. Before this, the Agency notifies the entity of its intention and the reasons. The entity can object within 15 days. The Agency reviews objections and then either stops the identification process or formally designates the entity as a service provider within 15 working days, providing reasons for its decision. This designation can be challenged in court. ecs-org.eu · 28 Oct 2026 · secondary source
• Approved Government Decision No. 860/2024 on the identification of service providers ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Approved Government Decision No. 860/2024 on the identification of service providers

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting

• Article 7 of the Law on Cybersecurity (No. 48/2023) outlines the roles and responsibilities of the national competent authority in cybersecurity in Moldova (Agency for Cybersecurity). Article 9 of the Law on Cybersecurity (No. 48/2023) specifies the responsibilities and requirements for managing cybersecurity incidents and crises at a national level. Article 12 of the Law on Cybersecurity (No. 48/2023) details the notification obligations of service providers regarding cyber incidents and threats. ecs-org.eu · 28 Oct 2026 · secondary source
• In addition, more detailed provisions on managing and reporting cybersecurity incidents are expected to be approved by the Government Decision regarding the requirements and security measures for service providers <a href="((Draft). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 9.6.2

• At this stage, fines are not provided in our regulation. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: The national cybersecurity programme is currently being developed

• Article 11 of the Law on Cybersecurity (No. 48/2023) focuses on the generic security measures that service providers are obligated to implement and maintain continuously. In addition, more detailed provisions on security measures are expected to be approved by a Government Decision regarding the requirements and security measures for service providers (Draft). ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final text · Government Decision on how to fulfil cybersecurity obligations by service providers in critical sectors; Adopted on 05-09-2025

What changed recently

No dated changes recorded.