After repeated postponements, the National Assembly has adopted at second reading the amendments and supplements to the Bulgarian Cybersecurity Act, thereby aligning Bulgarian legislation with Directive (EU) 2022/2555 (NIS 2). The Act establishes a new and significantly higher framework for the management of cyber risks and the resilience of both the public and private sectors.
With the adopted amendments, the scope of the Cybersecurity Act is expanded and a distinction is introduced between “essential” and “important” entities. The Cybersecurity Act now covers organizations from critical sectors such as energy, transport, healthcare, digital infrastructure, the financial sector, water, waste, food, and others. For these entities, specific obligations are introduced, including:

• cybersecurity risk management;
• reporting of significant cyber incidents within short timeframes;
• involvement and accountability of management bodies;
• implementation of proportionate technical and organizational measures;
• being subject to enhanced supervision and control by the competent authorities.

The Cybersecurity Act also strengthens the national framework for responding to large-scale cyber incidents and crises by improving coordination between institutions and enhancing information exchange at both national and European levels. Significant sanctions for non-compliance are also provided for, in line with the requirements of NIS 2.
For businesses and public organizations, this entails the need for a timely assessment of the applicability of the Cybersecurity Act, adaptation of internal policies and procedures, training of management and staff, and the establishment of a sustainable cyber risk management system.
The CONSEJO team closely monitors developments in the regulatory framework and supports organizations in identifying applicable requirements, preparing for compliance with NIS 2, and integrating cybersecurity as an integral part of overall risk management and compliance.