(Promulgated in State Gazette No. 59 of 26 July 2019, amended SG No. 36 of 13 May 2022, amended SG No. 47 of 24 June 2022)

 

What you need to know

• The Ordinance sets out specific requirements for ensuring network and information security;
• In the event of a security incident, notification must be submitted within two hours after becoming aware of the incident;
• Full and detailed information regarding the incident must be submitted within five days;
• Incident notifications shall be submitted using the standard templates – Annex No. 7 to Article 31(2) of the Ordinance;
• Within four months from the entry into force of the Ordinance, all organisations falling within its scope must bring their activities into compliance with the network and information security requirements.

 
Scope of application
The Ordinance is mandatory for application by:

• Administrative authorities;
• Operators of essential services within the meaning of the Cybersecurity Act, with regard to the network and information systems used for the provision of essential services;
• Digital service providers within the meaning of the Cybersecurity Act, with regard to the network and information systems used for the provision of digital services;
• Persons performing public functions who are not designated as operators of essential services within the meaning of the Cybersecurity Act, where such persons provide administrative services electronically;
• Organisations providing public services that are not designated as operators of essential services or digital service providers within the meaning of the Cybersecurity Act, where such organisations provide administrative services electronically.

 
The Ordinance regulates:

• Requirements for minimum network and information security measures;
• Recommended network and information security measures;
• Rules for carrying out compliance checks and inspections;
• Procedures for keeping, administering, classifying and maintaining information in the Register of Essential Services pursuant to Article 6 of the Bulgarian Cybersecurity Act;
• Incident notification template (Annex No. 7);
• Incident classification and prioritisation (Annex No. 9);
• Roles and responsibilities of units and employees responsible for network and information security (Article 3, Annex No. 6);
• Minimum required documented information, including an inventory of information assets, network connectivity diagrams, internal rules and procedures, as described in Article 5;
• Requirements for information classification (Article 6, Annex No. 2);
• Rules on risk management (Article 7);
• Rules on information asset management (Article 8);
• Incident management;
• Types of and options for protection of information and network infrastructure (Section II);
• Access management;
• Controls, monitoring and audits, and other related measures.

Alignment with international standards and best practices
The Ordinance is aligned with:

• The ISO/IEC 270xx family of standards – Information Security Management Systems;
• Other international standards in the field of information technology and information security listed in Annex No. 1;
• The recommendations of the Network and Information Security Cooperation Group to the European Commission of February 2018 regarding security measures for operators of essential services;
• Best practices in the field of information and communication technologies recommended by leading organisations in network and information security.

 
How Consejo can help
The Consejo team can assist your organisation in bringing its processes into compliance with the requirements of the Ordinance on the Minimum Requirements for Network and Information Security and the Bulgarian Cybersecurity Act, including assessment, implementation and ongoing support.

 

Ordinance on the Minimum Requirements for Network and Information Security