Guide
NIS2 - the essentials, in brief
NIS2 is the European Union directive on a high common level of cybersecurity - Directive (EU) 2022/2555. In Bulgaria it was transposed by the Act amending and supplementing the Cybersecurity Act, promulgated in State Gazette No. 17 of 13 February 2026.
The law requires essential and important entities in the listed sectors to apply cybersecurity risk management measures, to report significant incidents within short deadlines and to ensure that management is accountable. Non-compliance leads to penalties.
Essential and important entities apply the same measures and have the same reporting obligations. The difference lies in supervision and penalties: essential entities are also subject to inspections in advance, while important entities are supervised mainly after a report or an incident.
Who is NIS2 for
Medium-sized and large organisations in the sectors listed in the annexes are covered - and some smaller ones by exception:
- Energy, transport and water supply
- Banks and financial market infrastructure
- Healthcare and the manufacture of pharmaceuticals
- Digital infrastructure and IT services
- Postal and courier services, waste management
- Manufacture of food, chemicals and machinery
What NIS2 requires
The measures cover policies on risk analysis and information system security, incident handling, business continuity and crisis management, supply chain security, security in the acquisition and development of systems, assessment of effectiveness, cyber hygiene and training, cryptography, personnel security and access control, and multi-factor authentication.
A significant incident is one that has caused or may cause serious disruption to services or financial losses, or considerable damage to others. Such incidents are reported in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
Management approves the measures, oversees their implementation and undergoes training at least once every two years; employees are trained regularly.
The benefits
Complying with the law protects you from penalties: for essential entities up to €10 million or 2% of worldwide annual turnover, for important entities up to €7 million or 1.4% - whichever amount is higher. Members of management can also be fined personally, and for essential entities a temporary ban on exercising management functions is possible.
Beyond the law, the measures reduce the real risk of attacks, data leaks and disruption. ISO/IEC 27001 is the most direct route to them and provides evidence for clients and regulators.
How implementation works
- Scope checkWhether the organisation falls under the law - sector, size and type of entity - and registration in the register of entities.
- Gap analysisA comparison of the current measures with the requirements of the law and its implementing ordinance.
- Risk assessmentThe cyber risks to systems, data and suppliers.
- Measures and policiesThe 10 groups of measures - policies, procedures and technical solutions.
- Reporting and trainingAn incident procedure for the 24 h / 72 h / 1 month deadlines, and training for management.
- Review and improvementInternal audit, assessment of effectiveness and an improvement plan.
What you get
- Written assessment of whether you are in scope
- Gap analysis against the law
- Cyber risk assessment
- Policies and procedures for the 10 measures
- Incident reporting procedure
- Business continuity plan
- Trained management and staff
- Roadmap to ISO/IEC 27001