Directive (EU) 2022/2555 of the European Parliament and of the Council on measures for a high common level of cybersecurity across the Union is a legislative act aimed at achieving a high common level of cybersecurity throughout the European Union.
The Directive, commonly referred to as NIS2, replaced Directive (EU) 2016/1148 (NIS1). It entered into force on 16 January 2023 (20 days after its publication in the Official Journal on 27 December 2022). In Bulgaria, the Directive has been transposed through amendments to the Bulgarian Cybersecurity Act, promulgated in State Gazette No. 17 of 13 February 2026, introducing new and significantly stricter requirements.
NIS2 sets out the core framework for cybersecurity risk management measures and reporting obligations across all sectors and activities falling within its scope.
 

What is new?

New sectors added
Directive (EU) 2022/2555 expands its scope by introducing new sectors based on their importance to the economy and society and by establishing clear size thresholds for the entities concerned (all medium-sized and large organisations in selected sectors fall within the scope of NIS2). At the same time, the Directive allows Member States a degree of flexibility to identify smaller entities with a high security risk profile.
 
Scope of NIS2 / the Cybersecurity Act
Directive (EU) 2022/2555 establishes the framework for cybersecurity risk management and reporting obligations across all covered sectors.
The Bulgarian Cybersecurity Act defines the national framework for cybersecurity risk management and incident reporting obligations in the Republic of Bulgaria.
The requirements apply primarily to public and private entities operating in the economic sectors listed in Annex I and Annex II to the Act that meet the criteria for medium-sized or large enterprises under Article 3(1) of the Bulgarian Small and Medium-Sized Enterprises Act, while Article 4(9) of that Act (regarding partner and linked enterprises) does not apply. Specifically:

• Essential entity: an entity listed in Annex I with more than 250 employees and an annual turnover exceeding €50 million or a balance sheet total exceeding €43 million (Art. 4a(1)(1) of the Act);
• Important entity: an entity listed in Annex I or Annex II with 50–249 employees and a turnover or a balance sheet total between €10 million and €50 million (Art. 4a(2) of the Act).

Any company falling within these categories must implement appropriate and proportionate technical, operational and organisational measures to protect its network and information systems.
The Act also applies, irrespective of size, to entities such as providers of public electronic communications networks, trust service providers, DNS service providers, public administration bodies, and other entities referred to in Article 4(3) of the Act.
A new Article 6a of the Act (2026) introduces the lex specialis principle: where sector-specific legislation (e.g. in banking or telecommunications) provides for measures with an equivalent effect, the provisions of the Act do not apply in a duplicative manner.
Registration obligation: Entities referred to in Articles 4 and 4a of the Act must register in a register maintained by the Minister of e-Government (Art. 6 of the Act). The register is not public.

Essential and Important Sectors
 
New categorisation of sectors
Organisations are classified based on their level of importance and are divided into essential and important entities, which are subject to different supervisory regimes. The distinction between operators of essential services and digital service providers has been removed.
 
Supply Chain Security
NIS2 and the Bulgarian Cybersecurity Act significantly expand requirements related to supply chain security. Organisations are required to manage risks arising from third-party suppliers, products, services, and ICT components. Entities must ensure that critical elements of their supply chains do not pose cybersecurity risks.

Key obligations include:

• assessing supplier risk and periodically monitoring their reliability;
• selecting ICT suppliers and manufacturers that follow recognised cybersecurity standards and best practices;
• including cybersecurity requirements in contractual arrangements with suppliers and subcontractors;
• managing risks related to critical ICT products and components, including vulnerability management and response;
• complying with national and EU-level measures restricting high-risk suppliers.

The objective is to ensure that cybersecurity extends beyond internal processes to all participants in the supply chain..

Significant increase in fines
Directive (EU) 2022/2555 and the Bulgarian Cybersecurity Act introduce higher penalties, stricter supervisory measures by national authorities, and more rigorous enforcement.
Administrative fines may be imposed by competent authorities to ensure compliance, taking into account factors such as the degree of fault, the scale of the infringement, and the potential negative consequences.
The Directive sets the following maximum levels, on the basis of which national law determines the specific amounts:

• Essential entities — up to €10 million or 2% of total worldwide annual turnover (whichever is higher);
• Important entities — up to €7 million or 1.4% of total worldwide annual turnover (whichever is higher).

For the specific sanctions applicable in Bulgaria, reference should be made to the current text of the Bulgarian Cybersecurity Act (Articles 36–37 et seq.). In view of these penalties, it is essential that organisations have a clear understanding of the requirements, as even minor incidents may be classified as significant and subject to reporting.

Cybersecurity risk management measures
NIS2 and the Cybersecurity Act require essential and important entities to implement appropriate and proportionate cybersecurity risk management measures to address relevant cyber threats. These measures follow an all-hazards approach aimed at protecting network and information systems and their physical environment.
Minimum requirements include:

• risk analysis and information security policies;
• incident handling procedures;
• business continuity, including backup management and disaster recovery;
• supply chain security and management of relationships with direct suppliers;
• security in the acquisition, development and maintenance of network and information systems, including vulnerability management and disclosure;
• policies and procedures for assessing the effectiveness of cybersecurity risk management measures;
• cybersecurity training and basic cyber hygiene practices;
• policies on the use of cryptography and, where appropriate, encryption;
• human resources security, access control policies and asset management;
• incident management planning;
• use of multi-factor authentication (MFA), continuous authentication solutions and secure internal communications.

Technologies supporting compliance
NIS2 and the Bulgarian Cybersecurity Act, together with implementing acts and ENISA guidelines, encourage or support the adoption of technologies such as:

• zero trust principles;
• secure configuration;
• network segmentation;
• identity and access management;
• end-to-end encryption;
• secure routing standards;
• security by design and secure development practices;
• tools for detecting and preventing cyberattacks; 
• open-source cybersecurity solutions. 

Reporting obligations
The Bulgarian Cybersecurity Act establishes a procedure for reporting significant incidents to the relevant sectoral Computer Security Incident Response Team (CSIRT) under Article 23(1) of the Act.
An incident is considered “significant” if it has caused or may cause serious disruption of services, financial losses, or significant material or non-material damage to other parties.
Entities must notify their CSIRT as follows:

• early warning within 24 hours;
• incident notification within 72 hours, including an initial assessment;
• intermediate report where necessary or upon request;
• final report within one month;
• where applicable, notification of potentially affected users.

In view of the potential sanctions, it is essential that organisations clearly understand these obligations.

 
Supervisory powers and measures 
To strengthen the powers of competent authorities, the Bulgarian Cybersecurity Act provides a minimum set of supervisory measures and enforcement tools for overseeing essential and important entities.
A distinction is made between supervisory regimes:

• essential entities are subject to ex ante supervision; 
• important entities are subject to ex post supervision (triggered by incidents or signals).

 
ISO/IEC 27001 and NIS2
Implementation and certification under ISO/IEC 27001 "Information Security, Cybersecurity and Privacy Protection. Information Security Management Systems - Requirements" significantly facilitate the process of achieving compliance with NIS2 and the Bulgarian Cybersecurity Act. The standard provides a structured framework for implementing an Information Security Management System (ISMS), which is a core requirement under NIS2. Many of the Directive’s requirements can be effectively addressed through the implementation of an ISMS in accordance with ISO/IEC 27001.

 
The deadline for transposing the Directive was 17 October 2024. Each Member State must adopt and publish national rules applicable from 18 October 2024.

Directive (EU) 2022/2555 - EUR-Lex (europa.eu)
 

DIRECTIVE (EU) 2022/2555 (NIS2)