Network and Information System Directive 2 (NIS2) and the Bulgarian Cybersecurity Act
NIS2 is a European directive that strengthens cybersecurity across Member States through harmonized security and incident reporting requirements, expanded focus areas such as supply chain security, vulnerability management, and cyber hygiene, and enhanced cooperation and information haring among national authorities.
In Bulgaria, NIS2 has been transposed through amendments to the Cybersecurity Act. The amendments were adopted on 5 February 2026, promulgated in State Gazette issue 17 of 13 February 2026 and entered into force on 17 February 2026.
The framework significantly expands the number and types of organizations subject to cybersecurity regulation. It introduces two categories of regulated organizations, essential entities and important entities, and covers sectors including energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management, public administration, postal and courier services, waste management, manufacturing, food, chemicals, digital services and research.
Applicability generally depends on an organization’s sector, activities and size. However, certain organizations may fall within scope regardless of size. Organizations should therefore perform a structured applicability assessment rather than rely only on employee or turnover thresholds.
What does NIS2 mean for your organization?
Essential and important entities are expected to establish appropriate and proportionate technical, operational and organizational measures addressing cybersecurity risks. Key areas include:
Governance & Oversight
- Management body accountability, approval, oversight and training
Cybersecurity Risk Management Measures
- Risk analysis & information security
- Incident handling
- Business continuity, disaster recovery & crisis management
- Supply chain security
- Secure acquisition, development & maintenance (including vulnerability management)
- Effectiveness testing of controls
- Cyber hygiene & cybersecurity training
- Cryptography & encryption
- Human resources security, access control & asset management
- MFA and secure communications
How Deloitte can help
Deloitte can support organizations across the full NIS2 readiness and implementation lifecycle, including:
- Applicability and scoping assessment, to determine how the Bulgarian Cybersecurity Act may apply to the organization;
- NIS2 readiness or maturity assessment, covering governance, processes and technology
- Gap analysis and remediation roadmap, with actions prioritized according to regulatory exposure, risk and implementation effort;
- Governance and management-body support, including executive training;
- Cyber risk-management framework enhancement;
- Third-party and supply-chain risk management;
- Incident management and regulatory reporting preparedness;
- Business continuity, crisis management and operational resilience enhancement;
- Policy, control and documentation development; and
- Implementation and remediation support.
Our multidisciplinary teams combine cybersecurity, technology, regulatory compliance, risk management and operational resilience experience to translate legal requirements into practical and sustainable measures aligned with the organization’s operating environment.
Check your organization’s NIS2 readiness
Complete our short NIS2 readiness check (Pls link to: Network and Information Security 2 (NIS2): GAP Pre-Assessment) to obtain an initial view of your organization’s preparedness.
Based on your responses, our specialists will provide a high-level overview of:
- areas of relative strength;
- potential gaps requiring further assessment; and
- practical priorities for improving NIS2 readiness.
The readiness check provides an initial indication only and does not constitute a formal legal determination of whether your organization falls within the scope of the Bulgarian Cybersecurity Act.
To discuss the potential impact of NIS2 on your organization or learn more about Deloitte’s NIS2 services, contact our team.
