Municipal enterprises (including municipal companies and structures providing public services) increasingly manage critical processes through network and information systems, such as water supply and sewerage, transport, district heating, waste management, social and healthcare services, and electronic services for citizens. This places them within the scope of regulatory requirements for network and information security (NIS), which stem primarily from:

• Directive (EU) 2016/1148 (the NIS Directive) – establishing a framework for security measures and incident notification.
• The Cybersecurity Act – the national legal regime in Bulgaria applicable to administrative authorities, operators of essential services, and digital service providers.
• The Ordinance on the Minimum Requirements for Network and Information Security (adopted by Council of Ministers Decree No. 186/2019) – defining a minimum set of measures and requirements for policies and processes.
• GDPR (Regulation (EU) 2016/679) – where a municipal enterprise processes personal data, it is required to implement “appropriate technical and organisational measures” to ensure security.

 
1) First step: What type of entity is the municipal enterprise under the Cybersecurity Act?
The Cybersecurity Act distinguishes between several categories of entities subject to different requirements: administrative authorities, operators of essential services, digital service providers, as well as entities performing public functions when providing administrative services electronically.
In practical terms, for municipal enterprises this means:
A) Municipal administration (as an administrative authority)
Municipal administrations generally fall directly within the scope of the Cybersecurity Act and the Ordinance on the Minimum Requirements for Network and Information Security.
B) Municipal enterprise / municipal company as an operator of an essential service
If the enterprise provides a service in sectors covered by the NIS Directive and the Cybersecurity Act (e.g. water supply, transport, energy/district heating, waste management), it may be classified as an operator of an essential service, with obligations related to security measures and incident notification.
C) Municipal enterprise as an entity performing public functions in the context of e-services
Where administrative services are provided electronically (e.g. portals, electronic payments, online applications), NIS requirements under the Cybersecurity Act and the applicable ordinances are triggered.
 
2) Is an Information Security Management System (ISMS) mandatory?
No explicit ISO/IEC 27001 requirement, but a requirement for a systematic approach
The legal framework does not state that organisations must be certified under ISO/IEC 27001. Instead, it requires that entities:

• have policies/rules, processes, roles, and control measures in place;
• perform risk management and apply proportionate technical and organisational measures;
• maintain procedures for incident management and notification;
• ensure business continuity and recovery.

In practice, this is precisely what an ISMS as a management system represents, regardless of ISO certification. The Ordinance explicitly addresses the establishment of a security policy and specific policies or rules across multiple domains (access control, cryptography, mobile devices, remote work, incident management, third-party relationships, training, etc.).
Conclusion: Municipal enterprises falling within the scope of the Cybersecurity Act and the Ordinance are required to maintain a manageable and documented security framework (i.e. an “ISMS in substance”), even without mandatory certification.
 
3) Network and Information Security Policy: what it should include
The Ordinance on the Minimum Requirements for Network and Information Security requires entities within its scope to maintain a Network and Information Security Policy, covering and/or referencing specific policies on key topics (access management, cryptography, development and change management, incidents, third parties, training, etc.).
An adequate policy in a municipal context should include at least:

• Scope: systems, services, locations, external providers;
• Roles and responsibilities: information owners, administrators, security function/officer;
• Information classification: public / official / sensitive;
• Asset management: inventory of systems, servers, network equipment, applications, data;
• Access control: users, privileges, passwords/MFA, logging, periodic review;
• Vulnerability and patch management;
• Backup and recovery;
• Incident management (including criteria for what constitutes an incident and who is notified);
• Supplier requirements (outsourcing/cloud/support) – contractual security clauses;
• Training and awareness.

 
4) Risk management and security measures (NIS / Cybersecurity Act)
The NIS Directive requires operators of essential services and digital service providers to implement appropriate and proportionate measures to manage risks to the security of network and information systems and to minimise the impact of incidents.
At national level, the Cybersecurity Act details this regime and refers to secondary legislation (the Ordinance) for the minimum scope of measures.
In practice, for a municipal enterprise, this means:

• having a risk assessment process (at least annually and upon significant changes);
• implementing organisational and technical controls based on identified risks;
• documenting risks, decisions, treatment plans, and residual risk;
• being able to demonstrate to a competent authority how risks are managed, not merely which technologies are in place.

 
5) Incidents: obligations for response and notification
A) Cyber incidents under the Cybersecurity Act / NIS
The Cybersecurity Act establishes mechanisms for notifying competent and sectoral teams of incidents, as well as sanctions for failure to meet notification obligations, including late reporting.
Practical minimum for a municipal enterprise:

• an internal Incident Management Procedure;
• criteria for identifying a significant incident;
• duty rosters/contact points and escalation to management;
• an incident log and documentation of lessons learned.

B) Personal data breaches (GDPR)
Where an incident affects personal data, GDPR applies in parallel: the controller or processor must maintain appropriate security measures.
(GDPR also contains specific rules on notification of personal data breaches; these are not analysed here in detail, as the focus is cybersecurity under the Cybersecurity Act and the NIS framework, but in practice the processes must be aligned.)
 
6) Suppliers and outsourcing: a frequently underestimated regulatory risk
One of the most common issues for municipal enterprises is that a significant portion of IT functions is outsourced (maintenance, hosting, software, cloud), while:

• security requirements are unclear or missing in contracts;
• there are no SLAs for incidents and response times;
• there are no requirements for logs, backups, or recovery testing;
• there is no right to audit or control.

The Ordinance and the general principles of the NIS Directive require measures to be both organisational and technical, which in practice includes management of third-party relationships as part of security policies.
 
7) A minimum roadmap to compliance
If a municipal enterprise falls (or is likely to fall) within the scope of the Cybersecurity Act and the NIS framework, the most practical approach is:

1. Determine status: administrative authority / operator of an essential service / public function / other (legal and functional analysis).
2. Inventory of assets and services: systems, data, dependencies, suppliers.
3. Risk assessment and treatment plan.
4. Network and Information Security Policy plus specific policies (access, backups, incidents, change management, suppliers, remote work, etc.).
5. Incident and notification procedures (with roles, templates, contacts).
6. Baseline technical measures: segmentation, updates, logging/monitoring, backups, MFA, privilege management.
7. Training and awareness (at least annually and during onboarding).
8. Review/audit of implementation and corrective actions.

 
Municipal enterprises are not universally required to maintain an ISO-certified ISMS. However, where they fall within the scope of the Cybersecurity Act and the Ordinance on the Minimum Requirements for Network and Information Security, they are required to establish a documented, manageable, and effective framework for network and information security, including policies, risk management, security measures, incident processes, and supplier management.