Your rating 5.00 from 1 votes

How ISO/IEC 27001 Supports Compliance with the Bulgarian Cybersecurity Act (NIS2)

With the amendments to the Bulgarian Cybersecurity Act adopted in connection with the transposition of Directive (EU) 2022/2555 (NIS2), cybersecurity is no longer a matter of good practice or technological maturity — it is a legal obligation with specific requirements, deadlines, supervision, and sanctions.
Organizations falling within the scope of the Act as “essential” or “important” entities are now required to establish a systematic, demonstrable, and sustainable model for managing cyber risk.
In this context, ISO/IEC 27001 is not an alternative to the law, but a strategic instrument for its implementation. It provides a management framework that enables legal requirements to be structured, implemented, documented, and demonstrated in a consistent and controlled manner.

The New Reality: What the Cybersecurity Act Requires
The amendments to the Cybersecurity Act significantly expand the scope of regulated entities and place cybersecurity at the core of corporate accountability. Management bodies now bear direct responsibility for approving risk management measures, allocating resources, and overseeing their effectiveness.
The Cybersecurity Act requires:

systematic cyber risk management;
implementation of appropriate technical and organizational measures;
supply chain security;
operational resilience and business continuity;
structured and timely incident reporting;
cooperation with competent authorities;
registration and maintenance of up-to-date information with the regulator.

These requirements cannot be sustainably fulfilled through isolated policies or standalone IT solutions. They require an integrated management system.

ISO/IEC 27001 as a Management Framework for Legal Compliance
ISO/IEC 27001 is an international standard for establishing an Information Security Management System (ISMS). Its value in the context of NIS2 lies in providing structure, methodology, and control mechanisms that transform legal requirements into manageable processes.
1. Systematic Risk Management
NIS2 requires security measures to be risk-based. This means that every organization must identify threats, vulnerabilities, impacts on critical services, and interdependencies.
ISO/IEC 27001 formalizes this process through:

a risk assessment and risk treatment methodology;
a risk register;
documented decisions for risk acceptance, mitigation, or transfer;
a Statement of Applicability (SoA) identifying selected controls and their justification.

This provides the key element regulators expect: evidence that measures are not arbitrary, but the result of systematic analysis.

2. Management Commitment and Accountability
The law emphasizes the responsibility of management bodies. ISO/IEC 27001 requires active involvement of top management — including policy approval, objective setting, resource allocation, and participation in periodic management reviews.
Cybersecurity is therefore embedded in strategic governance rather than confined to the IT function. Executives gain mechanisms for oversight and accountability, while IT teams receive a clear framework for action and prioritization.

3. Incident Management and Regulatory Reporting
NIS2 introduces specific timelines and stages for notification of significant incidents. ISO/IEC 27001 establishes the foundation by requiring incident management procedures, classification, recording, root cause analysis, and corrective actions.
When aligned with regulatory deadlines, these processes ensure operational readiness for regulatory reporting, rather than reactive crisis management.

4. Operational Resilience and Business Continuity
One of the strongest intersections between the law and ISO/IEC 27001 concerns service continuity. The Cybersecurity Act requires the capability to maintain and restore critical functions in the event of a cyber incident.
ISO/IEC 27001 requires planning and testing of business continuity and recovery measures within the ISMS framework. This includes conducting a Business Impact Analysis (BIA), defining Recovery Time Objectives (RTOs), allocating backup resources, and performing regular testing.
For management, this protects reputation and contractual commitments; for IT, it ensures structured preparedness for real-world attack or disruption scenarios.

5. Supply Chain Security
NIS2 requires management of risks arising from suppliers and external ICT service providers. In an environment of cloud services and outsourcing, this is a critical dimension.
ISO/IEC 27001 requires third-party risk assessment, contractual security requirements, access control, and monitoring. External dependencies are thus transformed into managed risk rather than a security blind spot.

6. Technical Measures and Operational Controls
Although the law does not prescribe specific technologies, it requires “appropriate technical and organizational measures.” ISO/IEC 27001 translates this into structured control domains such as:

asset management and information classification;
cryptography and data protection;
access control;
logging and monitoring;
vulnerability and patch management;
change management.

General legal requirements are thereby converted into concrete, manageable control mechanisms.

7. Training and Security Culture
The human factor is central to both the law and ISO/IEC 27001. The standard requires documented and periodically evaluated awareness and training programs.
This supports the legal obligation to reduce risk by strengthening the competence of personnel and management.

8. Internal Control, Audit, and Demonstrability
The law provides for supervision and inspections by competent authorities. ISO/IEC 27001 establishes internal audit mechanisms, nonconformity registers, corrective actions, and management reviews.
This culture of auditability is essential. Regulators assess evidence, not intentions.

Important: ISO/IEC 27001 ≠ Automatic Compliance
Certification under ISO/IEC 27001 does not automatically ensure full compliance with the Cybersecurity Act.
The law contains requirements that go beyond ISO/IEC 27001, such as:

registration in the national cybersecurity register maintained by the competent authority;
formal classification as an “essential” or “important” entity;
specific notification timelines and formats;
interaction with competent authorities and CSIRTs;
explicit obligations of management bodies.

These elements require additional regulatory alignment, even where an ISMS is already implemented.

The Strategic Benefit of Integration
Integrating ISO/IEC 27001 with the requirements of the Cybersecurity Act is not merely a compliance exercise. It creates:

predictability in risk management;
increased resilience during incidents;
improved communication between management and IT;
reduced legal and reputational risk;
enhanced trust among clients and partners.

For executives, this means control and business protection.
For IT professionals, it provides a clear framework, priorities, and management-level support.

The Role of Consejo
At Consejo, we view ISO/IEC 27001 not as an end in itself, but as a tool for achieving regulatory resilience and strategic risk governance.
We support organizations to:

determine whether they fall within the scope of the Cybersecurity Act;
conduct a comprehensive gap analysis;
establish or adapt an ISMS in accordance with ISO/IEC 27001;
implement regulatory reporting processes;
structure management accountability;
prepare for supervisory reviews and inspections.

Our approach is pragmatic: not merely formal compliance, but real cyber resilience and controlled risk.

In an environment of heightened regulatory scrutiny and escalating cyber threats, organizations can no longer rely on fragmented measures. The Cybersecurity Act requires systemic governance, accountability, and controlled risk management.
ISO/IEC 27001 provides a structured governance framework through which these regulatory requirements can be met in a sustainable and strategically aligned manner.
Organizations that build an integrated information security management model will not merely achieve compliance. They will become more resilient, better prepared, and more competitive in the digital environment.

Consejo is your partner in this process.

Implementation of management standards

CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.

The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.

Partners