The Cybersecurity Bill Advances Towards Final Adoption
The draft amendments to the Bulgarian Cybersecurity Act aim to transpose Directive (EU) 2022/2555 (known as the NIS2 Directive) into national legislation. The main objective of the directive is to raise the overall level of cybersecurity across the European Union by expanding its scope and tightening requirements for various sectors and services.Key highlights of the draft law:
- Broader scope of regulated entities: Two new categories are introduced — essential and important entities. These include organizations from key sectors such as energy, transport, banking, healthcare, digital infrastructure, and more. Classification is based on the size of the entity and the criticality of the services it provides.
- Stricter risk management and incident reporting obligations: Entities will be required to implement appropriate technical and organizational measures to manage risks to the security of their network and information systems. They will also be obligated to report incidents within defined deadlines, improving threat response capabilities.
- Establishment of the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe): This network aims to enhance coordination and information sharing during large-scale cyber incidents among EU Member States. It will support joint incident and crisis management and facilitate cooperation between countries.
- Standardized procedures at national and EU level: A unified standard incident reporting form is planned, reducing administrative burden and improving coordination between competent authorities.
With these amendments, Bulgaria is set to respond to growing cyber threats and strengthen the protection of critical infrastructure by aligning with European standards and building a more robust and resilient national cybersecurity framework.
What does this mean for your organization?
Once adopted, the new requirements will obligate many private and public sector organizations to take concrete steps in managing cyber risks, implementing security measures, and reporting incidents in a timely manner. This creates an urgent need for a clear cybersecurity strategy and trusted partnerships with industry professionals.
If you’d like to find out whether your organization falls within the scope of the new obligations — and how to prepare — reach out to our team for expert guidance. We’ll help you assess risks, align your processes with the latest standards, and build a more resilient cybersecurity posture.
Implementation of management standards
CONSEJO Ltd. is a consulting company with over 20 years of practical experience in the development, implementation and maintenance of management systems in accordance with international standards and regulatory requirements. The company provides consulting services in the areas of quality management, environmental management, occupational health and safety, food safety, information security, cybersecurity, risk management and sustainable development. Our expertise covers standards and schemes such as ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO/IEC 27001, IFS Food, BRCGS and HACCP, as well as consulting services related to NIS2, DORA, GDPR and EcoVadis.
The CONSEJO team has been involved in over 1,500 projects for organizations across various sectors of the economy, including manufacturing, construction, energy, information technology, transport, trade, the food industry and services. Our approach focuses on developing management systems that work effectively in practice, tailored to the specific characteristics and needs of each organization. We work closely with our clients, providing consulting support, staff training and assistance during implementation. We strive to deliver high-quality services within the agreed deadlines and solutions that support successful certification and create long-term value for businesses.
