NIS2 Compliance in Bulgaria: Is your business in scope?
The NIS2 Directive introduces mandatory cybersecurity, risk management, incident reporting, and governance requirements for organizations operating in critical and important sectors.
AMATAS helps organizations assess applicability, achieve compliance, strengthen security posture, and prepare for regulatory audits.
- CREST-accredited
- ISO 27001 certified
- Industry specific solutions
- Trusted by 100+ companies worldwide
Coverage
Does NIS2 Apply to Your Organization?
Organizations typically fall within scope based on sector and size thresholds, though some smaller organizations can also be included depending on their role and criticality.
Essential Entities
- Energy
- Transport
- Banking
- Financial services
- Healthcare
- Drinking water
- Digital infrastructure
- Public administration
- ICT managed services
- Cloud services
- Data centers
- Telecommunications
Important Entities
- Manufacturing
- Food production
- Waste management
- Postal and courier services
- Chemical industry
- Research organizations
- Digital platforms and online marketplaces
NIS2 in Bulgaria
Why this matters now?
No grace period
Obligations applied immediately on 17 Feb 2026. Reduced sanctions ended 1 June 2026.
Fines up to €10M
Or 2% of global annual turnover for essential entities that fail to comply.
Board liability
Management bodies can be held personally liable for cybersecurity failings.
Mandatory audits
Authorities may now issue binding security audit orders and public disclosure requirements.
Key NIS2 Requirements
What your organization needs to do to comply with NIS2
Governance & Risk Management
Clear cybersecurity governance, risk management processes, security policies, and management oversight of cyber risks.
Security Controls & Resilience
Appropriate technical and organizational security measures, including access controls, vulnerability management, backups, and business continuity capabilities.
Incident Detection & Reporting
Processes and capabilities for identifying, responding to, and reporting significant cybersecurity incidents within regulatory deadlines.
Supply Chain & Workforce Security
Third-party risk management practices and employee cybersecurity awareness programs that help reduce risks across the organization.
Prepare for NIS2
How AMATAS Supports Your NIS2 Compliance Journey
Every organization’s compliance journey is different. We provide tailored cybersecurity and compliance services that align with your regulatory obligations, business objectives, and current level of maturity.
NIS2 Gap Assessment
Gain a clear understanding of your organization’s current cybersecurity and compliance posture. We identify gaps against NIS2 requirements and provide practical recommendations to help you prioritize your next steps.
Virtual CISO (vCISO)
Access experienced cybersecurity leadership without the cost of a full-time executive. Our vCISO service helps establish governance, manage cyber risks, support management responsibilities, and guide your NIS2 compliance efforts.
Penetration Testing
Evaluate the effectiveness of your security controls through expert-led testing. Identify vulnerabilities before they can be exploited and gain actionable insights to strengthen your organization’s resilience.
MXDR
Enhance your ability to detect, investigate, and respond to cyber threats with 24/7 monitoring and expert support. Our MXDR service helps organizations improve visibility and respond to incidents more effectively.
Security Awareness Training
Build a security-conscious workforce through engaging and practical training programs. Reduce human risk and help employees recognize and respond to common cyber threats such as phishing and social engineering.
Incident Response Planning
Prepare your organization to respond effectively when a cyber incident occurs. We help develop response procedures, define roles and responsibilities, and support readiness for NIS2 incident reporting obligations.
Compliance Documentation
Develop and maintain the policies, procedures, and supporting documentation required to demonstrate compliance. We help create a structured framework that aligns with both regulatory and business requirements.
Ongoing Compliance Support
NIS2 compliance is an ongoing process, not a one-time project. We provide continuous guidance, reviews, and cybersecurity expertise to help your organization remain compliant and resilient as requirements evolve.
Does NIS2 Apply to Your Organization?
Reach out to us and learn more about how we can be help. We’ll get in touch within one business day.
FAQ
NIS2 - Common questions
Yes. Bulgaria has transposed the NIS2 Directive into national legislation through amendments to the Cybersecurity Act. Organizations that fall within scope are expected to implement appropriate cybersecurity measures, establish incident reporting processes, and meet governance requirements.
Potentially. NIS2 applies to many medium-sized and large organizations operating in sectors such as healthcare, finance, manufacturing, transport, energy, digital services, and telecommunications. In certain cases, smaller organizations may also fall within scope due to their critical role or the services they provide.
Organizations must implement cybersecurity risk management measures, establish incident reporting procedures, manage supply chain risks, strengthen access controls, ensure business continuity, and provide oversight at the management level. Regular assessments, testing, and employee awareness are also important components of compliance.
Both Essential and Important entities are subject to similar cybersecurity and risk management requirements. The main difference lies in the level of regulatory supervision and enforcement, with Essential entities generally subject to more proactive oversight.
Non-compliance may result in regulatory actions, financial penalties, mandatory corrective measures, and increased scrutiny from competent authorities. Beyond regulatory consequences, insufficient cybersecurity controls can also increase operational and reputational risk.
AMATAS supports organizations throughout their NIS2 journey – from applicability assessments and gap analyses to governance, vCISO services, penetration testing, MXDR, security awareness training, and ongoing compliance support. Our goal is to help you build a practical and sustainable approach to NIS2 compliance.
Explore our services
Managed Security
Awareness
We can support you in understanding and strengthening your employees’ security behavior
Virtual
CISO
Let us lead and strategically manage your cyber risks
Virtual
DPO
Rely on our team of privacy and personal data experts
Managed Extended
Detection and Response
Get a cost-effective, advanced, and intuitive 24/7 threat monitoring
Penetration Testing
Trust us to continuously evaluate your organizational exposure.