Bulgaria has officially adopted amendments to its Cybersecurity Act, aligning national legislation with the EU NIS 2 Directive. This update introduces stricter cybersecurity requirements, expands the scope of regulated entities, and places greater responsibility on organizational leadership. For many businesses, NIS 2 represents a shift from best-effort security to legally enforceable cyber risk management.
Expanded scope: More sectors, more organizations
Under NIS 2, the number of regulated sectors has increased significantly. The amended law now applies to organizations operating in essential and important sectors, including but not limited to:
- Energy and utilities
- Transport and logistics
- Healthcare and pharmaceuticals
- Digital infrastructure and cloud services
- Water and waste management
- Manufacturing of critical products
- Space and satellite services
- Public administration and selected judicial bodies
Both public and private organizations may fall within scope, particularly medium and large enterprises whose services are critical to economic or societal functions. Many organizations that were previously unaffected by cybersecurity regulation are now required to comply with them.
What are the key obligations?
The amended Cybersecurity Act introduces several core requirements aligned with NIS 2:
- Risk management and security controls – Organizations must implement appropriate technical and organizational measures to prevent, detect, and respond to cyber incidents.
- Clear incident reporting timelines – NIS 2 introduces a structured reporting process:
- Early warning: within 24 hours of becoming aware of a significant incident
- Incident notification: within 72 hours, including impact and initial findings
- Final report: within 1 month, detailing root cause and remediation actions
- Management accountability – Senior management is explicitly responsible for approving and overseeing cybersecurity measures, elevating cyber risk to a board-level concern.
- Meaningful penalties – Non-compliance may result in significant sanctions, comparable in scale to GDPR fines, reinforcing the need for timely preparation.
What should organizations do next?
NIS 2 compliance is not purely technical. It requires governance, defined processes, and ongoing oversight. Organizations should begin by:
- Determining whether they fall within the NIS 2 scope
- Reviewing existing cybersecurity policies and controls
- Establishing incident reporting and escalation procedures
- Ensuring executive-level ownership of cyber risk
Tip: Find our professional expertise related to NIS 2 readiness in this file here:
How we can support you
Understanding and implementing NIS 2 requirements can be challenging, especially in cloud-based and hybrid environments. Our cybersecurity specialists help organizations assess readiness, close compliance gaps, and build sustainable security programs aligned with the new law.
Contact us to discuss how the NIS 2 changes affect your organization and how we can help you prepare with confidence.
Source: BTA :: Parliament Adopts Conclusive Amendments to Cybersecurity Act to Align with Updated EU Standards
