Server Hardening and NIS2 Compliance in Romania

What hardening means in practice

We start from a verifiable baseline, the CIS benchmark for your distribution, then adjust it to what actually runs. Unused services are switched off, SSH accepts keys only, service accounts are separated, sudo is narrowed and auditd logs leave the server. Containers get minimal images, a non-root user and resource limits. Databases do not listen on a public IP. Each deviation from the standard is written down with its reason, so an auditor finds no surprises.

• SSH with keys only, admin access from the private network
• CIS benchmark for your distribution, exceptions documented
• auditd, file integrity checks and logs shipped off the server
• Minimal, non-root container images with resource limits
• Immutable 3-2-1 backups with a restore tested regularly

Why patch deadlines are now counted in hours

The gap between a CVE being published and the first mass exploitation has collapsed from months to hours. Automated scanners and LLM agents sweep the internet, recognise the exposed version and try a generated exploit with no human involved, so an unpatched server gets no grace period. We therefore run automated compliance scans (CIS, OpenSCAP, Lynis), detect configuration drift and set tiered patch deadlines: hours for actively exploited flaws, days for the rest. Where we cannot patch at once, a virtual patch goes into the WAF.

From technical measures to your compliance file

NIS2 is transposed in Romania by OUG 155/2024 and DNSC orders, with administrative sanctions for essential and important entities. The audit itself is done by DNSC-authorised auditors; we deliver the technical side: asset inventory, patch policy, backup and restore procedure, access matrix, logs and scan reports. For GDPR you get an Article 28 data processing agreement, standard contractual clauses for transfers and data kept in the EU. Our own practice is aligned with ISO 27001, without claiming a formal certificate.

A baseline once, verification every month

The first hardening pass on a server is a delivery with a start and an end; what follows is verification. You request the work from the DevOps Services section of the client panel with the date you prefer. Plans bring 1 h a month on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers by plan and 10 h on GPU. One new server usually fits the allowance; a whole fleet or an audit with many requirements does not, and the rest is billed separately. Unused hours are not carried over.

How we work

1. Request from the panel

   Open the request in DevOps Services, name the servers in scope, the framework that binds you (NIS2, GDPR, a customer requirement) and the date you want.

2. Baseline assessment

   We scan with Lynis and OpenSCAP, compare the result with the CIS benchmark and note each deviation together with its impact on your application.

3. Applying the measures

   We apply hardening through Ansible in agreed windows, with a way back. After each group of changes we test that your application still behaves.

4. Handover with evidence

   You receive a before and after report, the patch policy, the restore procedure and a script that re-checks the baseline every month.

Use cases

Technology stack

• CIS Benchmarks
• Lynis
• OpenSCAP
• Ansible
• auditd
• nftables
• restic
• Wazuh

Frequently asked questions

• What is NIS2 and who has to comply in Romania?

  The EU cybersecurity directive, transposed in Romania by OUG 155/2024 and DNSC orders. It covers essential and important entities in sectors such as energy, transport, health, water, public administration and their digital suppliers. If you serve one of them, its requirements reach you through the contract.

• What are the penalties for NIS2 non-compliance?

  The Romanian framework provides administrative sanctions for essential and important entities, plus corrective measures. In practice the cost arrives earlier: large customers ask for security questionnaires and evidence, and not having them stalls contracts before any authority gets involved.

• How fast must security patches be applied?

  For actively exploited vulnerabilities, within hours rather than weeks, because automated scanners find unpatched systems almost immediately after a CVE is published. The rest go into planned windows. Where an update needs testing, we put a virtual rule in the WAF and restrict access meanwhile.

• What does server hardening mean?

  Reducing the attack surface: you remove what you do not use, close what should not be exposed, cut permissions to the minimum and switch logging on. It is measured against a standard, usually a CIS benchmark, so you can prove what you applied and what you excluded on purpose.

• Are your services aligned with ISO 27001?

  We work in alignment with ISO 27001 and offer an Article 28 GDPR data processing agreement with standard contractual clauses for transfers, but we do not claim a formal certificate. For your own audit we supply the technical evidence: applied policies, scan reports, logs and backup procedures.

• What is a CIS benchmark?

  A public set of recommended settings for a system such as Debian, Ubuntu, RHEL, Docker, Kubernetes or PostgreSQL. We use it as a measurable baseline, with automated scanning and a before and after report, so that every deviation is deliberate and documented rather than accidental.