NIS2 is EU Directive 2022/2555 on a high common level of cybersecurity. It replaces the original NIS Directive of 2016, covers many more sectors and sets concrete requirements for risk management, incident response and supplier security. For companies this means three things: check whether you are in scope, put protective measures in place, and report significant incidents within short deadlines. Even if your company is not directly in scope, the requirements often reach you indirectly, through contracts with customers who are. If you are starting from the basics, see also our guide to cybersecurity for small businesses.
In short: NIS2 and the Bulgarian Cybersecurity Act generally apply to medium and large companies - 50 or more employees, or annual turnover and annual balance sheet above EUR 10 million - in 18 sectors such as energy, transport, health, digital infrastructure, manufacturing, food and courier services. For some activities size does not matter. A small company outside these sectors is usually not in scope directly, but the requirements often reach it through contracts with clients that are. The three-question check is below.
Not sure whether your company is in scope of NIS2? Let’s talk about your needs - we will review your environment before we propose a solution and a price. We implement the technical measures, our partner consultant prepares the documentation and risk assessment, and you have one point of contact. More about the service: information security and NIS2 for businesses.
What is NIS2
The directive was adopted at the end of 2022, and member states had to transpose it into national law by 17 October 2024. In Bulgaria this was done with the 2026 amendments to the Cybersecurity Act.
The goal is that companies and institutions the economy depends on keep running when a cyberattack happens. That is why NIS2 looks beyond technology: does the organization manage risk, does it know what to do in an incident, and does it control its suppliers?
NIS2 is not a certificate. There is no document you obtain once and for all. Compliance is shown through working measures, documentation and readiness to demonstrate them during an inspection. Standards such as ISO 27001 help build an orderly security system - see what preparation for ISO 27001 involves - but they do not replace the legal requirements.
It is the main EU act in the field of cybersecurity for medium-sized and large companies.
The Bulgarian Cybersecurity Act: what changed in 2026
NIS2 was transposed into Bulgarian law by the amendments to the Cybersecurity Act, promulgated in State Gazette issue 17 of 13 February 2026 and in force since 17 February 2026. The Act sets out which companies are in scope, which measures they must implement, how incidents are reported and what the penalties are. The minimum set of measures is specified in a Council of Ministers ordinance, but the obligations under the Act already apply.
If you are looking into the Cybersecurity Act because a client has sent you a security questionnaire or new requirements for its suppliers, you are most likely in the supply chain of a company in scope. The requirements then reach you indirectly, even if your company is not directly obliged.
Is your company in scope of NIS2?
Is your company in scope? Three questions
1. Which sector do you work in?
The directive lists two groups of sectors:
- Sectors of high criticality: energy, transport, banking, financial market infrastructure, health, drinking water and waste water, digital infrastructure, business-to-business ICT service management (managed service providers and managed security service providers), public administration and space.
- Other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing (for example medical devices, electronics, machinery and vehicles), digital providers (online marketplaces, search engines, social networks) and research.
2. How large is your company?
As a rule, medium and large enterprises are in scope: companies with 50 or more employees, or with annual turnover and balance sheet above EUR 10 million. For some activities size does not matter, for example providers of public electronic communications networks, DNS services and trust services, and the sole provider of a critical service in the country.
3. What is your role in the supply chain?
This is the question small companies most often miss. If you supply services, software or support to a company in scope, that company must manage the risk from its suppliers. In practice you will receive a security questionnaire or contract clauses, even if you are not legally obliged yourself.
If the answer to the first two questions is yes, your company is most likely in scope as an essential or important entity. The difference between the two groups lies in supervision and in the level of penalties; the required measures are the same.
| Group | Typically | Supervision |
|---|---|---|
| Essential entities | Large companies (over 250 employees or over EUR 50 million turnover) in the high-criticality sectors, plus some providers regardless of size, such as DNS, trust services and public electronic communications | Proactive: inspections and audits even without a report |
| Important entities | Mid-sized companies (from 50 employees or over EUR 10 million turnover) in the high-criticality sectors, plus mid-sized and large companies in the other critical sectors | Reactive: inspection after a report, an incident or a suspected breach |
What IT support looks like in companies with legal security requirements is described in IT support for regulated companies.
What to do after the check
Depending on your answers, you are in one of three cases:
- Your company is in scope. You need technical measures and documentation. We implement and maintain the technical measures - EDR, SIEM, backups with restore testing, updates, access control and 24/7 monitoring. The documentation, policies and risk assessment are prepared by our partner consultant, and you have one contact.
- A client has sent you a security questionnaire. You are not obliged directly, but you have to answer your client. The questions are almost always the same: backups, multi-factor authentication, device protection, who has access and how you respond to an incident. We prepare the technical answers and close the gaps the questionnaire reveals.
- You are not in scope and have no such clients. The law does not oblige you, but the risks are the same. Start with the basics in cybersecurity for small businesses.
Not sure which case you are in? Let's talk about your needs - together with our partner consultant we will review whether and how NIS2 affects your company before we propose a solution and a price.
NIS2 and small and mid-sized businesses
Small companies (under 50 employees and under EUR 10 million turnover) are, as a rule, not directly obliged. But many small and mid-sized companies supply banks, hospitals, energy companies, logistics and manufacturing firms. When such a customer starts applying NIS2, it will ask its suppliers for evidence: how data is protected, who has access, whether there are backups and how incidents are handled.
It makes sense to see NIS2 as a market requirement, not just a law. The company that can answer a large customer's security questionnaire with confidence wins the contract.
NIS2 in plain language
What NIS2 requires in practice
Article 21 of the directive lists at least ten groups of measures. In everyday terms:
- Risk analysis and information system security policies.
- An incident response process: who notices, who decides, who reports.
- Business continuity: backups, disaster recovery and crisis planning.
- Supply chain security: requirements for suppliers and assessment of their risk.
- Security in acquiring, developing and maintaining systems, including vulnerability handling and updates.
- Checking whether the measures actually work, for example through an IT audit of the company infrastructure.
- Basic cyber hygiene and staff training.
- Encryption rules.
- Personnel security, access control and an inventory of assets: devices, accounts and systems.
- Multi-factor authentication and secured communication channels, including for emergencies.
Incident reporting. For a significant incident the company must send an early warning to the competent authority within 24 hours, an incident notification within 72 hours and a final report within one month. Without a process prepared in advance, these deadlines are very hard to meet. That is why proactive monitoring of IT systems, which catches problems early, and ransomware protection matter.
Management accountability and penalties
NIS2 puts security directly on the managing director's desk. Management must approve the measures, oversee their implementation and take part in training. Members of management can be held personally liable for breaches.
Fines are significant. The Cybersecurity Act, which transposes NIS2 into Bulgarian law, sets fines for essential entities of up to EUR 10 million or 2% of total worldwide annual turnover, and no less than EUR 25,000; for important entities, up to EUR 7 million or 1.4% of turnover, and no less than EUR 12,500, whichever amount is higher. Members of management can also face personal fines of EUR 500 to 5,000.
NIS2 and your suppliers
Supplier risk is one of the key points of NIS2. Many incidents start not inside the company but with its IT provider, accounting software or cloud service. That is why the directive requires companies to know which suppliers have access to their systems, what measures they apply and what the contracts say about security and incidents.
If your computer and server support is outsourced, check: does your provider have contractual response times, how does it manage access to your systems, which remote access tool does it use, and will it notify you immediately in case of an incident? If you are still choosing a partner, see how to choose an external IT partner and how to outsource IT support correctly.
Which measures do you have and which are missing?
How to get started: 6 practical steps
- Check your scope with the three questions above and write down the conclusion.
- Make an inventory: employees, devices, accounts, servers, cloud services and suppliers with access.
- Assess the risk: which systems stop the business if they fail, and what happens to the data.
- Close the biggest technical gaps: multi-factor authentication, tested backups, endpoint protection and timely updates.
- Describe the incident process: who reports, when and how, including to the authority within 24 hours.
- Appoint a responsible person in management and plan staff training.
You do not have to do everything at once. What matters is starting with the right scope and documenting what you do.
Not sure where to begin? Our first step is a gap analysis: we review your IT environment against the measures in Article 22 of the Bulgarian Cybersecurity Act and tell you what we found - which measures are already in place, which are missing and in what order it makes sense to close them. Most companies already have some of the measures without knowing it. Let's talk about your needs - we will review your environment before we propose a solution and a price.
What you must be able to show during an inspection
- An inventory of devices, systems and data.
- A risk assessment and measures approved by management.
- Policies: access, passwords and multi-factor authentication, backups, incident response.
- An incident log and completed backup restore tests.
- A list of suppliers and the requirements set for them.
- Evidence of training for management and employees.
Technical NIS2 compliance for managed support clients
Many of the technical NIS2 requirements are everyday IT work. For its clients on subscription support, Helpdesk Bulgaria prepares the IT environment and brings it into technical compliance with NIS2: we implement the measures, maintain them and document them so you can show them during an inspection. The subscription includes:
- 24/7 monitoring of servers and workstations.
- Antivirus licenses and endpoint protection, plus EDR and SIEM for threat detection and analysis on the Professional plan.
- Backup policies and disaster recovery.
- Access and account management, including multi-factor authentication.
- Timely updates and vulnerability remediation.
- A business-grade remote access tool and trackable support tickets.
Technical preparation and technical NIS2 consulting are included in the Professional plan. On the Standard plan, they are charged separately.
Documentation, policies and the risk assessment are prepared by our partner consultant, and you have one point of contact: us. Management accountability and reporting to the authority remain with the company, but with an organized and documented technical foundation they become much easier. See what each plan includes on the computer support page.
We take care of the technical measures with our NIS2 technical measures package: EDR, SIEM, backups, patch management, access control and 24/7 monitoring, while the documentation is prepared by our partner consultant.
Personal data also falls under the GDPR technical measures - see GDPR technical measures for secure company data.
Frequently asked questions
What is the Cybersecurity Act?
It is the Bulgarian law that transposes the NIS2 directive. The amendments were promulgated in State Gazette issue 17 of 13 February 2026 and have been in force since 17 February 2026.
Does NIS2 apply to small companies?
As a rule no, if the company has fewer than 50 employees and under EUR 10 million turnover and balance sheet, except for some specific activities. Small companies often receive requirements indirectly, as suppliers to companies in scope.
A client sent me a security questionnaire because of NIS2. What should I do?
It means you supply a company that is in scope of NIS2 and it manages the risk from its suppliers. The questions are usually about backups, multi-factor authentication, device protection, access to systems and incident response. Answer honestly and close the gaps before you promise anything to your client. For our subscription support clients we prepare the technical answers and implement the missing measures.
Is there a NIS2 certificate?
No. NIS2 is a legal obligation, not a certificate. Compliance is shown through working measures and documentation. Standards such as ISO 27001 help but do not replace the legal requirements.
What are the incident reporting deadlines?
An early warning within 24 hours, a notification within 72 hours and a final report within one month of a significant incident.
What are the penalties?
Up to EUR 10 million or 2% of worldwide turnover for essential entities (at least EUR 25,000) and up to EUR 7 million or 1.4% for important entities (at least EUR 12,500). Members of management can also face personal fines of EUR 500 to 5,000.
Where do I start?
With a scope check and an inventory of systems and suppliers. Then close the biggest technical gaps: multi-factor authentication, backups and device protection. If you want to know exactly where you stand, we start with a gap analysis against the measures in the law - before we propose a solution and a price.
Can Helpdesk Bulgaria bring our company into NIS2 compliance?
For our managed support clients, we bring the IT environment into technical compliance with NIS2: endpoint protection, EDR and SIEM, monitoring, backups, access control and updates, implemented and documented. This is included in the Professional plan; on the Standard plan, technical consulting and EDR and SIEM licenses are charged separately. The documentation, policies and risk assessment are prepared by our partner consultant. Management accountability and reporting to the authority remain with the company.
This article is for information only and is not legal advice. For your specific case, check the current text of the national cybersecurity law.
Tags:
