{"id":2348,"date":"2026-10-30T10:32:43","date_gmt":"2026-10-30T07:32:43","guid":{"rendered":"https:\/\/www.net-security.ro\/?p=2348"},"modified":"2026-10-30T10:34:34","modified_gmt":"2026-10-30T07:34:34","slug":"ordinul-1-2026-anexa-2-metodologia-de-autoevaluare-a-maturitatii-masurilor-de-gestionare-a-riscurilor-de-securitate-cibernetica","status":"publish","type":"post","link":"https:\/\/www.net-security.ro\/index.php\/2026\/10\/30\/ordinul-1-2026-anexa-2-metodologia-de-autoevaluare-a-maturitatii-masurilor-de-gestionare-a-riscurilor-de-securitate-cibernetica\/","title":{"rendered":"Ordinul 1\/2026 Anexa 2 Metodologia de autoevaluare a maturit\u0103\u021bii m\u0103surilor de gestionare a riscurilor de securitate cibernetic\u0103"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

\n

Anexa 2<\/span><\/b><\/p>\n

Metodologia de autoevaluare a maturit\u0103\u021bii m\u0103surilor de gestionare a riscurilor de securitate cibernetic\u0103<\/span><\/b><\/span><\/p>\n

 <\/span>Articolul 1<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

(1) Directoratul Na<\/span>\u021bional de Securitate Cibernetic\u0103 dezvolt\u0103
\n\u0219i pune la dispozi\u021bia tuturor entit\u0103\u021bilor esen\u021biale \u0219i importante dou\u0103
\nmecanisme destinate s<\/span>tabilirii
\nnivelului de maturitate a m\u0103surilor de gestionare <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate <\/span>cibernetic\u0103 <\/span>ale <\/span>entit\u0103\u021bii, <\/span>\u00een <\/span>conformitate <\/span>cu <\/span>art. <\/span>12 <\/span>alin. <\/span>(4) <\/span>\u0219i <\/span>art.<\/span><\/p>\n

37 alin. (8) lit. b) din Ordonan\u021ba de urgen\u021b\u0103 a
\nGuvernului nr. 155\/2024, respectiv:<\/span><\/p>\n

 <\/span><\/p>\n

a)
\n <\/span><\/span><\/span>Platforma NIS2@RO;<\/span><\/a><\/span><\/p>\n

 <\/span><\/p>\n

b)  <\/span>instrumentele <\/span>de <\/span>evaluare <\/span>a <\/span>maturit\u0103\u021bii <\/span>m\u0103surilor
\n<\/span>de <\/span>gestionare <\/span>a <\/span>riscurilor <\/span>de <\/span>securitate
\ncibernetic\u0103, corespunz\u0103toare fiec\u0103rui nivel de asigurare: EV<\/span>AL_MMS_B pentru nivelul de Baz\u0103,
\nEVAL_MMS_I pentru nivelul Important \u0219i EVAL_MMS_E pentru nivelul E<\/span>s<\/span>en\u021bial.<\/span><\/p>\n

(2)
\n<\/span>\u00cen <\/span>cazul <\/span>\u00een <\/span>care <\/span>Platforma <\/span><\/span>NIS2@<\/span>RO<\/span><\/a> <\/span>este <\/span>indisponibil\u0103, <\/span>se <\/span>utilizeaz\u0103 <\/span>instrumentele <\/span>de <\/span>evaluare <\/span>a maturit\u0103\u021bii,  <\/span><\/span>care  <\/span><\/span>se  <\/span><\/span>descarc\u0103
\n <\/span><\/span>de
\n <\/span><\/span>pe
\n <\/span><\/span>website<\/span>-ul  <\/span><\/span>oficial  <\/span><\/span>al  <\/span><\/span>Directoratului  <\/span><\/span>Na\u021bional
\n <\/span><\/span>de
\n <\/span><\/span>Securit<\/span>ate<\/span> Cibernetic\u0103 (https:\/\/www.dnsc.ro\/) \u0219i se utilizeaz<\/span>\u0103 la nivel local, conform instruc\u021biunilor
\npublicate. Articolul 2<\/b><\/span><\/a><\/span><\/p>\n

(1) Pentru calcularea
\nscorului de maturitate, reprezent\u00e2nd gradul de conformitate al entit\u0103\u021bii cu
\nControalele aplicabile nivelului s\u0103u de asigurare, se atribuie o valoare num\u0103r
\n\u00eentreg de la 1 <\/span>la 5 fiec\u0103ruia dintre
\nurm\u0103torii <\/span>doi parametri ata\u0219a\u021bi
\nfiec\u0103rui Control:<\/span><\/p>\n

a)  <\/span><\/span>Maturitatea
\ndocumenta\u021biei, <\/span>care <\/span>m\u0103soar\u0103
\n<\/span>gradul <\/span>\u00een <\/span>car<\/span>e <\/span>regulile
\n<\/span>\u0219i <\/span>proced<\/span>urile <\/span>scrise <\/span>satisfac cerin\u021bele Controlului;<\/span><\/p>\n

b) <\/span>Maturitatea implement\u0103rii, care m\u0103soar\u0103
\ngrad<\/span>ul \u00een care practicile <\/span>opera\u021bionale efective corespund Controlului
\n\u0219i documenta\u021biei aferente.<\/span><\/p>\n

(2) <\/span>Este <\/span>obligatorie <\/span>completarea <\/span>variabilelor \u201eScor <\/span>documenta\u021bie\u201d <\/span>\u0219i <\/span>\u201eScor <\/span>implementare\u201d <\/span>pentru fiecare Control.<\/span><\/p>\n

(3) <\/span>Atribuirea <\/span>valorilor <\/span>prev\u0103zute <\/span>la alin.
\n<\/span>(1) <\/span>se <\/span>determin\u0103 <\/span>prin <\/span>evalu<\/span>area <\/span>satisfacerii <\/span>criteriilor <\/span>\u0219i
\nvalorilor de prag conform stadiilor de maturitate predefinite, astfel:<\/span><\/p>\n

a)  <\/span><\/span>Stadiul  <\/span>1 
\n<\/span>–  <\/span>Ini\u021bial:  <\/span>valoarea 
\n<\/span>maturit\u0103\u021bii  <\/span>1;  <\/span>a\u0219tept\u0103ri 
\n<\/span>privind  <\/span>nivelul  <\/span>de 
\n<\/span>maturitate  <\/span>a documenta\u021biei – \u201enu
\nexis<\/span>t\u0103 documenta\u021bie a procesului <\/span>sau aceasta <\/span>nu este aprobat\u0103 ofi<\/span>cial
\nde c\u0103tre <\/span>conducere\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201enu <\/span>exist\u0103
\n<\/span>un <\/span>proces standard\u201d;<\/span><\/p>\n

b) <\/span>Stadiul
\n<\/span>2 <\/span>– <\/span>Repetabil: valoarea mat<\/span>urit\u0103\u021bii <\/span>2; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei <\/span>– <\/span>\u201eexist\u0103 <\/span>documenta\u021bie <\/span>a <\/span>procesului <\/span>aprobat\u0103
\n<\/span>oficial, <\/span>dar <\/span>care <\/span>nu <\/span>a <\/span>fost <\/span>revizuit\u0103<\/span><\/p>\n<\/div>\n


<\/span><\/p>\n

\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/span><\/p>\n

\u00een <\/span>ultimii <\/span>2 <\/span>ani\u201d; <\/span>a\u0219tept\u0103ri
\n<\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces
\nad-hoc, desf\u0103\u0219urat \u00een mod informal\u201d;<\/span><\/p>\n

c) <\/span>Stadiul 3 – Definit: valoarea maturit\u0103\u021bii
\n3; a\u0219tept\u0103ri privind nivelul de maturitate a documenta\u021biei – \u201eexist\u0103
\ndocumenta\u021bie a proce<\/span>sului aprobat\u0103
\noficial, iar excep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;
\n<\/span>excep\u021biile <\/span>documentate <\/span>\u0219i <\/span>aprobate
\nreprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>5% <\/span>din
\ncazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind
\n<\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,
\n<\/span>care este <\/span>implementat; <\/span>sunt <\/span>disponibile <\/span>dovezi <\/span>pentru <\/span>majoritatea <\/span>activit\u0103\u021bilor; <\/span>excep\u021biile <\/span>de <\/span>proces
\nsunt mai pu\u021bin de 10%\u201d;<\/span><\/p>\n

d) <\/span>Stadiul
\n<\/span>4 <\/span>– <\/span>Gestionat: <\/span>valoarea mat<\/span>uri<\/span>t\u0103\u021bii <\/span>4; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei – \u201eexist\u0103 documenta\u021bie a
\nproce<\/span>sului aprobat\u0103 oficial, iar
\nexcep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;
\n<\/span>excep\u021biile <\/span>documentate <\/span>\u0219i <\/span>aprobate
\nreprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>3% <\/span>din
\ncazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind
\n<\/span>nivelul <\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,
\n<\/span>care este implementat; sunt disponibile dovezi pentru toate acti<\/span>vit\u0103\u021bile; sunt colectate \u0219i raportate
\nmetrici <\/span>detaliate <\/span>ale <\/span>proc<\/span>esului;
\n<\/span>a <\/span>fost <\/span>stabili<\/span>t\u0103 <\/span>o \u021bint\u0103
\n<\/span>minim\u0103 <\/span>pentru metrici; <\/span>excep<\/span>\u021biile <\/span>de proces sunt mai pu\u021bin de 5%\u201d;<\/span><\/p>\n

e)  <\/span>Stadiul <\/span>5 <\/span>– <\/span>Optimizare: <\/span>valoarea <\/span>maturit\u0103\u021bii <\/span>5; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul <\/span>de <\/span>maturitate <\/span>a documenta\u021biei – \u201eexist\u0103 documenta\u021bie a
\nproce<\/span>sului aprobat\u0103 oficial, iar
\nexcep\u021biile sunt documentate <\/span>\u0219i <\/span>aprobate;
\n<\/span>excep\u021biile <\/span>doc<\/span>umentate
\n<\/span>\u0219i <\/span>aprobate <\/span>reprezint\u0103 <\/span>mai <\/span>pu\u021bin <\/span>de <\/span>0,5% <\/span>din cazuri\u201d; <\/span>a\u0219tept\u0103ri <\/span>privind <\/span>nivelul
\n<\/span>de <\/span>maturitate <\/span>a <\/span>implement\u0103rii <\/span>– <\/span>\u201eexist\u0103 <\/span>un <\/span>proces <\/span>formal,
\n<\/span>care este implementat; sunt disponibile dovezi pentru toate acti<\/span>vit\u0103\u021bile; sunt colectate \u0219i raportate
\nmetrici <\/span>deta<\/span>liate <\/span>ale <\/span>procesului; <\/span>a fost <\/span>stabilit\u0103 <\/span>o <\/span>\u021bint\u0103 <\/span>minim\u0103 <\/span>pentru <\/span>metrici, <\/span>care <\/span>se \u00eembun\u0103t\u0103\u021be\u0219te continuu; excep\u021biile de <\/span>proces sunt mai pu\u021bin de 1%\u201d.<\/span><\/p>\n

(4) <\/span>Variabilelor <\/span>\u201eScor <\/span>documenta\u021bie\u201d <\/span>\u0219i <\/span>\u201eScor <\/span>implementare\u201d <\/span>le <\/span>este atribuit\u0103 <\/span>valoarea
\n<\/span>numeric\u0103 corespunz\u0103toare de la 1 la 5, aferent\u0103 stadiului de maturitate
\nstabilit potri<\/span>vit alin. (3).<\/span><\/p>\n

(5) Pentru fiecare
\nControl se atribuie valori pentru \u201eScor documenta\u021bie\u201d \u0219i \u201eScor implementare\u201d,
\npotrivit alin. (4). Fiecare valoa<\/span>re
\neste justificat\u0103 \u00een scris, prin informa\u021b<\/span>ii
\n\u0219i argumente.<\/span><\/p>\n

(6) Pentru fiecare
\nSubcategorie se calculeaz\u0103 \u201eScor maturitate documenta\u021bie\u201d \u0219i \u201eScor maturitate
\nimplementare\u201d ca medie aritmetic\u0103 a valorilor corespunz\u0103toare ale Controale<\/span>lor din acea Subcategori<\/span>e.<\/span><\/p>\n

(7) Pentru fiecare
\nCategorie se calculea<\/span>z\u0103 \u201eScor
\nmaturitate documenta\u021bie\u201d \u0219i \u201eScor maturitate implementare\u201d ca medie aritmetic\u0103
\na valorilor corespunz\u0103toare ale Subcategoriil<\/span>or
\ndin acea Categorie.<\/span><\/p>\n

(8) Pentru fiecare
\nCategorie se calculeaz\u0103 scorul de maturitate ca medie aritmetic\u0103 a scoruri<\/span>lor prev\u0103zute <\/span>la <\/span>alin. <\/span>(7).<\/span><\/p>\n<\/div>\n


<\/span><\/p>\n

\n

 <\/p>\n

 <\/p>\n

 <\/span><\/p>\n

(9) <\/span>Scorul <\/span>total <\/span>de <\/span>maturitate
\n<\/span>al <\/span>entit\u0103\u021bii <\/span>se <\/span>ob\u021bine <\/span>ca <\/span>medie <\/span>aritmetic\u0103
\n<\/span>a <\/span>scorurilor <\/span>de <\/span>maturitate <\/span>ale<\/span><\/p>\n

 <\/span><\/p>\n

Categoriilor.<\/span><\/p>\n

 <\/span><\/p>\n

(10) Scorurile pe Con<\/span>troale \u0219i pe Categorii, precum \u0219i scorul
\ntotal de maturitate al entit\u0103\u021bii, indic\u0103 totodat\u0103 ecar<\/span>tul fa\u021b\u0103 de scorurile-\u021bint\u0103 <\/span>necesare
\npentru atingerea conformit<\/span>\u0103\u021bii.<\/span><\/p>\n

(11) <\/span>Pentru <\/span>atingerea <\/span>conformit\u0103<\/span>\u021bii, <\/span>valorile
\n<\/span>ob\u021binute <\/span>de <\/span>entitate
\n<\/span>\u00een <\/span>urma autoevalu\u0103rii <\/span>sunt <\/span>cel <\/span>pu\u021bin egale cu urm\u0103toarele scoruri-\u021bint\u0103,
\nstabilite pentru fi<\/span>ecare nivel de
\nasigurare:<\/span><\/p>\n

a)  <\/span><\/span>pentru
\nnivelul de Baz\u0103: scorul-\u021bint\u0103 al fiec\u0103rui Control marcat ca M\u0103sur\u0103 cheie este
\nde cel pu\u021bin 2,5, iar scorul-\u021bint\u0103 total al <\/span>entit\u0103\u021bii
\neste de cel pu\u021bin 2,5;<\/span><\/p>\n

b)  <\/span><\/span>pentru <\/span>nivelul <\/span>Important: <\/span>scorul<\/span>-\u021bint\u0103 <\/span>al <\/span>fiec\u0103rui
\nControl <\/span>marcat <\/span>ca <\/span>M\u0103sur\u0103 <\/span>cheie <\/span>este <\/span>de <\/span>cel
\npu\u021bin 3, iar scorul-\u021bint\u0103 total al entit\u0103\u021bii este de cel pu\u021bin 3;<\/span><\/p>\n

c)  <\/span><\/span>pentru
\nnivelul Esen\u021bial: scorul-\u021bint\u0103 al fiec\u0103rui Control marcat ca M\u0103sur\u0103 cheie este
\nde cel pu\u021bin <\/span>3, <\/span>scorul-\u021bint\u0103 <\/span>total <\/span>al <\/span>fiec\u0103rei
\n<\/span>C<\/span>ategorii <\/span>este <\/span>de <\/span>cel <\/span>pu\u021bin <\/span>3, <\/span>iar <\/span>scorul
\n<\/span>general <\/span>al <\/span>entit\u0103<\/span>\u021bii
\neste de cel pu\u021bin 3,5.<\/span><\/p>\n

Articolul 3<\/span><\/b><\/span><\/p>\n

 <\/span><\/p>\n

Atunci c\u00e2nd, \u00een urma
\nautoevalu\u0103rii, nu sunt atinse scorurile<\/span>-\u021bint\u0103
\naferente nivelului de asigurare evaluat, prev\u0103zute la art. 2, entitatea are
\nobliga\u021bia de a \u00eentocmi un plan de m\u0103suri pentru remedierea tuturor deficie<\/span>n\u021belor care au condus la neconformitate,
\nplan ce cuprinde ac\u021biunile ce urmeaz\u0103 a fi \u00eentreprinse \u0219i termenele asumate
\npentru implementare.<\/span><\/p>\n<\/div>\n



<\/span><\/p>\n


<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Articolul 1<\/p>\n

(1) Directoratul Na\u021bional de Securitate Cibernetic\u0103 dezvolt\u0103 \u0219i pune la dispozi\u021bia tuturor entit\u0103\u021bilor esen\u021biale \u0219i importante dou\u0103 mecanisme destinate stabilirii nivelului de maturitate a m\u0103surilor de gestionare a riscurilor de securitate cibernetic\u0103 ale entit\u0103\u021bii, \u00een conformitate cu art. 12 alin. (4) \u0219i art.
\n37 alin. (8) lit. b) din Ordonan\u021ba de urgen\u021b\u0103 a Guvernului nr. 155\/2024, respectiv:<\/p>\n","protected":false},"author":1,"featured_media":1931,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t