BulgariaCybersecurity Act, Risk-Management Measures and Governance (Zakon za kibersigurnost, ZKS)
Закон за киберсигурност (ЗКС) чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds you where you are an essential or important entity designated under the Cybersecurity Act's sector annexes, which name a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing and others) are reached too, by declaring that you are an essential or important entity.
- Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use in your core activity or in providing your services, sized to your exposure, your size, and the likelihood and severity of an incident.NIST CSF 2.0ID.RA-06
- Cover, at minimum: risk-analysis and information-system-security policies, incident-handling procedures, business-continuity and backup management, supply-chain security, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policies, and human-resources security and access control.NIST CSF 2.0GV.PO-01
- Have your management body approve and oversee these measures, and have every member of your management body complete cybersecurity training every two years and organise the same training for your staff; a member who fails to do so faces a personal fine of EUR 500 to 5,000.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter Three of the amended Cybersecurity Act (Arts. 27i, 28 and 29) makes an Article 22 or 21 failure an administrative offence carrying a fine or property sanction (imushtestvena sanktsia) imposed by the competent authority, not a criminal offence; the Act attaches criminal liability to no risk-management or governance failure.
Penalty structure
Article 29(2), as substituted by Paragraph 36, sets an essential entity's sanction for an Article 22 or 23 failure at up to EUR 10,000,000 or up to 2 percent of the worldwide annual turnover of the undertaking to which the entity belongs, whichever is higher, but not less than EUR 25,000. Article 29(3) sets an important entity's sanction at up to EUR 7,000,000 or up to 1.4 percent of turnover, whichever is higher, but not less than EUR 12,500 (not separately structured here, since this field holds one tier; see this note). Article 29(4) separately fines a head of an administrative body, a manager, or a management-body member EUR 500 to 5,000 for a violation of Article 21. Article 29(5) exempts an essential entity that is itself an administrative body from the Article 29(2) turnover-based sanction. Article 51 of the amending Act's transitional provisions halved every fine and sanction under this chapter for a violation committed before .
- Rule
- Higher of
- As of
- Minimum
- 25,000
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The national competent authority the Council of Ministers designates per sector under Article 16(1) of the Cybersecurity Act, which also determines essential and important entities under Article 16(3), pt. 8.
Settledness
- As of
- Open questions
- Article 3(3)'s implementing ordinance on the detail of the Article 22 risk-management measures was due within 8 months of the Act's entry into force under Section 47(2) of the transitional provisions, with the pre-existing electronic-communications security rules applying until then under Section 50. Has that ordinance been adopted, and does it narrow or particularise any of the Article 22(2) measure categories?
What this law does
Article 22 of the Cybersecurity Act, as substituted by Paragraph 26 of the amending Act, requires every essential and important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses in its core activity or in providing its services, at a level of security matched to the entity's exposure, size, and the likelihood and severity of an incident.
The measures must follow an all-hazards approach covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures, business continuity (including backup and disaster-recovery management and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the risk-management measures themselves, basic cyber-hygiene practices and cybersecurity training, cryptography and encryption policies, and human-resources security and access control.
Article 21, as substituted by Paragraph 25 of the same amending Act, puts approval and oversight of these Article 22 measures on the entity's own management body (or, for an administrative body, its governing organ), and separately requires every management-body member of an essential or important entity to complete cybersecurity training every two years sufficient to identify risks and assess risk-management practices, and to organise the same training for the entity's staff.
Both articles transpose NIS2 Articles 20 and 21 respectively, and apply, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform, which the amended annex lists among the reached digital service providers.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .