NIS2 and Cybersecurity Act compliance
We check whether your company is in scope of NIS2, what its obligations are, and meet them together — risk management, incident reporting and management accountability.
NIS2 and cybersecurity
Directive (EU) 2022/2555 (NIS2) significantly widens the range of organisations with cybersecurity obligations. In Bulgaria the requirements are transposed through the Cybersecurity Act. The scope covers mainly medium and large companies in 18 sectors — from energy, transport and healthcare to manufacturing, food, postal services and digital providers.
The directive splits organisations into essential and important entities. They must apply cybersecurity risk-management measures, report significant incidents within strict deadlines, and their management bodies are accountable for oversight and must undergo training.
Is your company in scope of NIS2?
Two questions give an indicative answer. Sector and size decide — and in some cases the sector alone.
You are in scope as an important entity
The same measures and reporting deadlines. Supervision is ex post — after a report or an incident.
- Supervision
- Ex post — after a report
- Maximum fine
- €7M or 1.4% of turnover
Highly critical sectors
- Energy
- Transport
- Banking
- Financial market infrastructure
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management
- Space
Other critical sectors
- Postal and courier services
- Waste management
- Chemicals
- Food production and distribution
- Manufacturing (medical devices, electronics, machinery, vehicles)
- Digital providers
- Research
Three obligations, ten measures
The law does not prescribe products but managed risk: the right measures, fast reporting and management that is accountable.
Risk management
Ten minimum measures — technical, operational and organisational, proportionate to the risk.
Incident reporting
Significant incidents are reported to the CSIRT: 24 hours, 72 hours, 1 month.
Management accountability
Management approves the measures, oversees them and is trained every 2 years.
-
(a)Risk policies Risk analysis and information system security policies. -
(b)Incidents Detection, response and reporting under a clear procedure. -
(c)Continuity Backups, disaster recovery and crisis management. -
(d)Supply chain Security in relations with suppliers and subcontractors. -
(e)Secure development Acquisition, development and maintenance, incl. vulnerability handling. -
(f)Effectiveness Assessing whether the measures actually work. -
(g)Cyber hygiene Basic practices and staff training. -
(h)Cryptography Encryption and data protection policies. -
(i)People and access HR security, access control and asset management. -
(j)MFA and comms Multi-factor authentication and secured channels, incl. in emergencies.
Friday, 02:14 — the clock starts ticking
What a significant incident looks like when the NIS2 system is ready. The scenario is typical — the deadlines are statutory.
Ransomware encrypts the file server and ERP during the night shift.
- T+0 Detection On time EDR raises an alert. The on-call engineer isolates the network and triggers the incident procedure.
- 24 h Early warning On time To the CSIRT: significant incident, likely malicious, no cross-border impact.
- 72 h Notification On time Initial assessment of severity and impact, indicators of compromise.
- 1 mo. Final report On time Root cause, measures applied and lessons learned — loop closed.
Nobody knows who reports what. The 24-hour deadline runs out in panic, and management is personally liable.
Everyone knows their role, templates are ready, backups work. The incident is unpleasant — but manageable.
More than compliance
Calm before the regulator
Documented measures and evidence, ready for inspection.
Less downtime
An incident is contained in hours, not weeks.
An edge in tenders
Clients under NIS2 choose suppliers with proven security.
Protected management
Clear decisions and minutes prove management met its duties.
A prepared team
People spot phishing and know what to do in an incident.
A path to ISO 27001
The same work is 70–80% of a certifiable system.
Implementation in six steps
A typical project for a medium-sized company takes 3–6 months. We work alongside your daily operations.
- 01 1 wk Scope check Essential, important or out of scope — with reasons.
- 02 2–3 wks Gap analysis Where you stand against the ten Art. 21 measures.
- 03 1 wk Action plan Priorities, owners, deadlines and budget.
- 04 2–4 mo Implementation Policies, procedures and technical measures — MFA, backups, access.
- 05 2 wks Training and test Management training and an incident drill.
- 06 ongoing Maintenance Periodic review, internal audit and updates.
A package ready for inspection
Everything the supervisory authority may ask for — organised and easy to follow.
Free scope check- Opinion on scope and entity category
- Risk assessment and treatment plan
- Cybersecurity policy approved by management
- Procedure and templates for CSIRT reporting
- Business continuity and recovery plan
- Supplier requirements and assessment
- Management training certificate
- Incident drill report
The standards that cover NIS2
NIS2 does not require a certificate — but international standards are the shortest route to demonstrable compliance.
01 How do I know if NIS2 applies to us?
The key criteria are sector and size — as a rule medium (50+ employees or annual turnover above €10M) and large companies. There are exceptions where size does not matter. The check takes one conversation.
02 Is ISO 27001 enough for NIS2?
ISO 27001 covers a large part of the measures and is the best framework, but NIS2 has specific requirements too — reporting deadlines and management accountability. We cover both.
03 What are the penalties?
For essential entities up to €10M or 2% of worldwide annual turnover; for important entities up to €7M or 1.4%. Management accountability also applies.
No such question in the list — ask us directly and we will reply.
Your first consultation is free
Tell us about your company and your goal. You will get a clear plan and a quote within one business day.