A Practical Assessment Test for the Management of Municipal Enterprises on the Applicability of the Cybersecurity Act and Network and Information Security Requirements

A significant number of municipal enterprises still perceive information security and cybersecurity primarily as technical issues related to IT systems, software, and maintenance. In reality, however, Bulgarian and European law establish clear and binding regulatory requirements for network and information security that apply to a wide range of municipal structures—often without them being fully aware of it.
These requirements stem primarily from Directive (EU) 2016/1148 (the NIS Directive), which introduces obligations to implement appropriate and proportionate security measures and to notify competent authorities in the event of incidents, as well as from the Cybersecurity Act, which transposes the Directive into Bulgarian law and defines the applicable regime for administrative authorities, operators of essential services, and entities performing public functions. At national level, these requirements are further specified by the Ordinance on the Minimum Requirements for Network and Information Security, which sets out the minimum set of organisational and technical measures, policies, and processes that must be implemented.
Against this background, the present article provides practical guidance in the form of a short test designed to help the management of municipal enterprises carry out an initial self-assessment of whether their activities and the systems they use place them within the scope of the applicable network and information security requirements.
 
How to Use the Test
Answer “Yes” or “No” to each of the questions below. Not all answers need to be positive for regulatory obligations to arise—in many cases, a small number of key “Yes” answers may be sufficient.
 
Part I: Activities and Public Importance

1. Does the municipal enterprise provide a service on which the day-to-day functioning of citizens or the municipality depends (e.g. water supply, transport, heating, waste management, social services)?
2. Would a disruption of this service for 24–72 hours have serious consequences for the population or the local economy?
3. Does the enterprise operate in sectors such as:
   • water supply and sewerage;
   • energy / district heating;
   • public transport;
   • waste management;
   • healthcare or social services?

 
Part II: Use of Network and Information Systems

1. Does the enterprise use information systems without which the service could not be provided (ERP systems, SCADA, specialised software, online registers)?
2. Do these systems store data whose loss or compromise would have serious consequences (personal data, official information, operational data)?
3. Is there permanent internet or network connectivity, including remote access or external IT support?

 
Part III: Public Functions and Electronic Services

1. Does the enterprise provide services electronically (electronic applications, payments, queries, portals)?
2. Does the enterprise process personal data of citizens, employees, or counterparties in electronic form?

 
Part IV: Governance and Organisation

1. Is there a formally designated person or function responsible for information security or cybersecurity?
2. Are there written rules or policies in place regarding:

• access to systems;
• passwords and user accounts;
• backups;
• incident response?

 
How to Interpret the Results
🔴 If you have three or more “Yes” answers
This is a strong indicator that the municipal enterprise:

• falls or is likely to fall within the scope of the Cybersecurity Act;
• is required to apply minimum network and information security measures;
• should have policies, procedures, and organisational measures in place, not only technical solutions.

🟡 If you have one or two “Yes” answers
The risk of a formal regulatory obligation is lower, but:

• personal data protection requirements remain applicable;
• good security practices are strongly recommended;
• expansion of activities or further digitalisation may quickly move the enterprise into a higher-risk category.

🟢 If all answers are “No”
The likelihood that the enterprise is subject to regulatory network and information security requirements is low, but:

• basic security and backup measures remain advisable;
• future regulatory changes may alter the enterprise’s status.

 
Why This Test Matters
Many municipal enterprises are, in practice, subject to a regulatory regime without having a clear internal assessment or a documented security framework. This creates:

• regulatory risk;
• operational risk;
• risk to the continuity of public services.

Early self-assessment is the first and most important step towards adequate and proportionate cybersecurity management.