NIS 2: What does Bulgarian business need to know?

As technology evolves and cyber threats increase, protecting information systems is becoming a key priority for European businesses and the public sector.

This article will introduce you to the main aspects of the Directive and what it means for business in Bulgaria.

What is NIS 2?

NIS 2 is the second version of the Network and Information Security (NIS) Directive, which aims to harmonise cybersecurity standards across EU Member States. Coming into force in January 2023, it replaces the previous NIS Directive from 2016, expanding the scope and introducing new requirements for organisations operating in key economic sectors.

The main objectives of NIS 2 are:

• Increase resilience to cyber threats through enhanced security measures.
• Extending the scope of the Directive to more industries and companies.
• Reinforcing controls and introducing strong sanctions for non-compliance.
• Improve international cooperation on cyber security.

Who is affected by NIS 2?

Whereas the previous NIS Directive focused on a limited range of ‘essential services’, NIS 2 covers significantly more sectors and extends the requirements to businesses and sectors of impact, namely:

• Electricity;
• District heating and cooling;
• Oil;
• Natural Gas;
• Hydrogen.

• Air;
• Transport, Air, Rail;
• Water;
• Road.

Other critical sectors:

• Manufacture of medical devices and in vitro diagnostic medical devices
• Manufacture of computers, electronic and optical products
• Manufacture of electrical equipment
• Manufacture of machinery and equipment n.e.c.
• Manufacture of motor vehicles, trailers and semi-trailers
• Manufacture of other transport equipment

What are the new requirements?

NIS 2 requires affected organisations to take steps to improve their cyber security. Key obligations include:

1. Risk management:
   • Cyber risk analysis and assessment.
   • Develop security policies and incident response plans.
2. Technical measures:
   • Use of multi-factor authentication (MFA).
   • Encryption of sensitive information.
   • Continuous monitoring of networks and systems.
3. Supply chain security:
   • Risk assessment related to suppliers and partners.
   • Introduce security requirements in contracts with third parties.
4. Incident reporting:
   • Reporting security breaches within 24 hours of detection.
5. Training and awareness:
   • Conduct training for employees on good data protection practices.

What are the penalties for non-compliance?

One of the most significant changes in NIS 2 is the more severe penalties for non-compliance.

Sanctions also include administrative inspections and suspension of executives for serious violations.

How to prepare for NIS 2?

Businesses and organisations in Bulgaria should start preparing immediately to avoid risks and penalties. Here are some key steps:

1. Analyze the current situation:
   • Check whether your organisation is covered by the directive.
   • Identify cybersecurity vulnerabilities.
2. Implement international standards:
   • Follow best practices such as ISO/IEC 27001 for information security management.
3. Train staff:
   • Conduct regular training for employees and management.
4. Build response plans:
   • Prepare incident management and data recovery strategies.
5. Work with experts:
   • Consult with cybersecurity specialists to ensure you meet all requirements.

Why is NIS 2 important?

The directive aims not only to protect individual companies, but also to improve society’s overall resilience to cyber attacks. As the popular saying goes, “A chain is only as strong as its weakest link.”

In this context, NIS 2 ensures that every organisation, regardless of size or sector, will contribute to the security of the digital environment.

Conclusion

Contact us to find out how the Balkan Services team can help you achieve NIS 2 compliance and protect your business from cyber threats!

If you’re looking for professional advice on securing your company’s IT data, our IT experts are here to help.

Balkan Services has been implementing business software solutions and providing comprehensive IT support since 2006, with over 720 projects completed.