Insights
Analysis and practical guidance from our work in detection and response, incident readiness, offensive validation, and regulatory transformation.
The CRA's first hard deadline arrives on 11 September 2026, when manufacturers must start reporting actively exploited vulnerabilities within 24 hours. The staged timeline, who is in scope, and what to do before full application in December 2027.
DORA has applied since 17 January 2025 and Romania's OUG 14/2026 gives BNR and ASF enforcement powers. The five pillars, the Romanian supervision framework, and a pragmatic compliance path.
Understand Romania's NIS2 registration, DNSC assessment, RSSI, annual compliance and incident-reporting deadlines under GEO 155/2024 and Law 124/2025.