Cybersecurity and NIS2 for companies

Who this service is for

• Medium-sized and large companies in the sectors covered by the Act — manufacturing, food, transport, energy, healthcare, postal and courier services, waste, chemicals, digital services and others. The full list is in our NIS2 guide.
• Suppliers to large organisations — even if you are not in scope, your NIS2 clients must manage supply chain security (Art. 22(2), item 4) and will ask how you protect their data.
• Small companies without an IT department that want sensible protection — passwords, two-factor authentication, backups, updates — without the bureaucracy.
• Companies after an incident — a hacked mailbox, encrypted files, leaked passwords, invoice fraud.
• International companies with a Bulgarian entity that need a local partner for the technical side of compliance.

What NodePoint does on cybersecurity and NIS2

How we work: from the first conversation to the measures

1. Free first conversation

   sector, number of employees, turnover, what concerns you. Outcome: whether you are in scope and as what type of entity.

2. Survey and inventory

   systems, network, users, suppliers, backups, access rights. Outside Burgas, much of the work can be done remotely.

3. Review of the current state

   comparison with the 12 groups of measures in Art. 22(2) of the Act.

4. Technical guidance and plan

   what, who and by when, prioritised by risk. Management approves it (Art. 21(1)).

5. Implementation

   the technical measures and the training of management and staff; legal documents with partner lawyers.

6. Support and review

   periodic review of the measures (Art. 22(2), item 6) or under managed IT support.

Not sure whether NIS2 applies to you? We will check in the first, free conversation — book it here.

Does NIS2 apply to your company?

A company falls under the Bulgarian Cybersecurity Act if it operates in a sector listed in Annex I or II to the Act and is at least a medium-sized enterprise under the Bulgarian Small and Medium-Sized Enterprises Act — 50 or more employees, or annual turnover and total assets above EUR 10 million (Art. 3 of that Act, as in force from 1 January 2026). Some entities are in scope regardless of size — for example providers of electronic communications services, trust services and DNS.

Essential entities are the large enterprises from Annex I and certain special categories; all other entities in scope are important entities (Art. 4a). The difference lies in supervision and in the level of fines.

The full list of sectors, thresholds and obligations is in our guide, NIS2 in Bulgaria. Check it yourself with the NIS2 check — or NodePoint will go through it with you in the first call.

What does a NIS2 gap analysis include?

A gap analysis compares what the company does today with the measures the law requires. NodePoint goes through the 12 groups of measures in Art. 22(2) — from risk analysis and incident handling to backups, supplier security, encryption, access control and multi-factor authentication.

For each measure, the result is one of three: in place, partly in place or missing — with evidence. At the end you receive a prioritised action plan. This document shows management what it is approving, and shows the supervisory authority that the company is working on the measures.

Technical security measures — what is done in practice

The Act is technology-neutral — it does not require specific products, but "appropriate and proportionate" measures (Art. 22(1)). In practice, for a small or medium-sized company the measures with the biggest effect are:

Servers and backups are covered in servers for businesses, the network in networks and CCTV.

Cybersecurity training for management and staff

The Bulgarian Cybersecurity Act requires members of management bodies to complete training every two years and to offer and organise such training for their employees (Art. 21(2) and (3)). Training is also one of the mandatory measures (Art. 22(2), item 7). The Act does not prescribe a specific platform or format.

NodePoint trains management and staff mainly through its own platform, Sentinel: short regular quizzes, results for management and an annual PDF record showing who was trained, on which topics and whether management also took part. Note that Sentinel's quizzes are in Bulgarian.

What to do during a cyber incident

Call +359 887 975 180 immediately. During business hours, incidents take priority over all other work; clients with a 24/7 support contract also get a response outside business hours. While you wait:

1. Do not switch off the infected computer — disconnect it from the network (cable and Wi-Fi). This stops the spread without losing the traces in memory.

2. Do not pay a ransom and do not write to the attackers.

3. Change your email and banking passwords from another, clean device; turn on two-factor authentication.

4. Write down what you saw, when and on which computer. Take photos of the screen with your phone.

5. If your company is a NIS2 entity, the clock is ticking: early warning to the sectoral CSIRT within 24 hours of becoming aware of a significant incident, incident notification within 72 hours, final report within 1 month (Art. 23(5)).

6. For payment fraud — call your bank immediately; for a crime — report it to the Bulgarian cybercrime unit of the Chief Directorate Combating Organized Crime (cybercrime.bg (external website, opens in a new window)).

NodePoint helps to contain the incident, restore systems and data and preserve the traces in a way that makes them usable for later analysis (computer forensics).

Cyber incident now? Call +359 887 975 180. Call WhatsApp (opens in a new window)

Why we advise every client to stay close to NIS2

NodePoint works with all clients on the same principle: bring them as close as possible to the requirements of the Cybersecurity Act, even when the law does not oblige them to comply. Its measures — two-factor authentication, tested backups, updates, access control, training, an incident plan — are the best protection for a small office too. And companies that work for large clients will be asked about them along the supply chain anyway.

How much does NIS2 compliance cost?

The price depends on the size of the company, the number of systems and sites, how many measures are already in place and whether you want only an analysis or implementation as well. That is why NodePoint starts with a free first conversation and, after the survey, provides a written quote in stages (analysis → guidance and plan → implementation), so that you can see what you are paying for. Prices are by individual quote only.

Frequently asked questions about cybersecurity and NIS2