Skip to content
World Watch

Cybersecurity law & regulation in Moldova (2026)

Cybersecurity in Moldova: comprehensive law.

Moldova enacted a comprehensive cybersecurity law (Law No. 48/2023) that entered into force on 1 January 2025 and partially transposes EU Directive 2022/2555 (NIS2), covering risk management, incident reporting, and critical-sector obligations for medium-sized and larger entities. The Cybersecurity Agency was established in December 2023 as the competent national authority and single point of contact, with CERT-GOV-MD providing the operational government CSIRT function. Full NIS2 transposition remains in progress, with further implementing acts adopted through 2025 and a National Cybersecurity Programme for 2026-2030 under development.

Last verified Official sources first · MethodologyCompare Moldova with other countries

Legal framework

Law No. 48/2023 on Cybersecurity (Legea nr. 48/2023 privind securitatea cibernetică), in force 1 January 2025; supplemented by Government Decision No. 1028/2023 (Cybersecurity Agency), Government Decision No. 860/2024 (service-provider identification), and Government Decision No. 562/2025 (sector-specific obligations). Supervised by the Cybersecurity Agency (Agenția pentru Securitate Cibernetică, ASC/NCSC-MD).

Key points: cybersecurity in Moldova

  1. Primary Law, Law 48/2023

    Published in the Official Gazette 2023, no. 151-153, art. 225, and effective 1 January 2025. Transposes Articles 3 and Annexes I-II of EU NIS2 Directive (2022/2555), establishing scope, definitions, governance, and obligations for critical-sector service providers.

    legis.md eeas.europa.eu

  2. Competent Authority

    The Cybersecurity Agency (ASC/NCSC-MD), created by Government Decision No. 1028/2023 in December 2023, exercises national cybersecurity policy, supervisory, and control functions, and serves as the NIS2-designated competent authority and national single point of contact.

    ncsc.md ega.ee

  3. Incident Reporting Obligations

    Essential and critical-sector service providers must report significant cyber incidents to the Cybersecurity Agency. Government Decision No. 562/2025 sets specific cybersecurity obligations and reporting duties for providers in critical sectors; a State Register of Cyber Incidents will enable centralised monitoring.

    euneighbourseast.eu media-azi.md

  4. Critical-Sector Scope

    Government Decision No. 860/2024 identifies which service providers fall within scope. Coverage tracks NIS2 Annexes I-II sectors (energy, transport, banking, health, digital infrastructure, etc.) and applies to medium-sized or larger entities; supervisory powers include compliance verification over operators of critical information infrastructure.

    eufordigital.eu gov.md

  5. CSIRT / CERT Capability

    CERT-GOV-MD, operating under the Information Technology and Cyber Security Service (STISC), is Moldova's sole operational CSIRT and handles incidents for public administration. It is a registered FIRST member and the Council of Europe-recognised national CERT.

    stisc-cert.gov.md coe.int

  6. Ongoing NIS2 Alignment & Strategy

    Transposition is acknowledged as partial; authorities are continuing full alignment with NIS2 as part of EU accession obligations (candidate status since June 2022, negotiations opened June 2024). The National Cybersecurity Programme 2026-2030 will guide further development.

    euneighbourseast.eu undp.org

Sources

  1. legis.md/cautare/getResults?doc_id=136732&lang=ro
  2. eeas.europa.eu/delegations/moldova/moldova-adopted-eu-backed-cybersecurity-law_en
  3. euneighbourseast.eu/news/latest-news/moldova-adopts-eu-backed-cybersecurity-law/
  4. ncsc.md/legislation
  5. gov.md/index.php/en/press-releases/moldovan-government-approves-strategic-pr
  6. stisc-cert.gov.md/index.php/services/?lang=en
  7. coe.int/en/web/cybercrime/cert-md
  8. eufordigital.eu/moldova-enhances-cybersecurity-measures-to-protect-national-interests
  9. media-azi.md/en/uexplicat-securitatea-cibernetica-ce-avem-ce-trebuie-schimbat-ce-u
  10. undp.org/sites/g/files/zskgke326/files/2025-05/jsb_2024_undp_moldova_prodoc_cy
  11. ega.ee/moldova-establishes-national-cybersecurity-agency/

Next for Moldova: Starting a BusinessEasy

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026